Agent Security Scanner Mcp

What's New

🤖 LLM-Powered Semantic Code Review Agent

This release adds code-review-agent/ — a new LLM-powered semantic code review tool that uses intent profiling to distinguish safe patterns from dangerous ones based on project context.

The key differentiator: Same code, different verdicts based on what the project is supposed to do:

• A build tool running subprocess.run() with hardcoded commands → expected (that's its job)
• An e-commerce app calling eval(req.query.filter) → dangerous (shouldn't eval user input)
• A file organizer calling os.remove() → expected (that's its purpose)
• An auth API calling fs.writeFile(req.body.path) → dangerous (shouldn't write arbitrary files)

Key Features

| Feature | Description |
|---------|-------------|
| Intent Profiling | Reads README, dependencies, and structure to understand project purpose |
| 3 LLM Providers | Anthropic API, OpenAI API, Claude CLI (no API key needed!) |
| 3 Output Formats | Colored terminal text, JSON, SARIF 2.1.0 |
| Dynamic Chunking | Large files split based on token budget, not hardcoded line limits |
| Dependency Graph | Resolves JS/TS/Python imports including barrel re-exports |
| Prompt Injection Defense | System prompts mark repo content as untrusted input |

Usage

cd code-review-agent
npm install
npm run build

# Analyze a project (no API key needed with claude-cli!)
npx tsx bin/cr-agent.ts analyze ../path/to/project -p claude-cli -v

# View intent profile
npx tsx bin/cr-agent.ts intent ../path/to/project -p claude-cli

# Output as SARIF for GitHub Code Scanning
npx tsx bin/cr-agent.ts analyze ../path/to/project -f sarif

Stats

• 17 source files, 9 test files (58 tests), 4 test fixture projects
• Tested live: 18 real findings on VulnApp, ~1 false positive per 15 findings on hardenedapp

Full Changelog

New Features:

• feat: add LLM-powered semantic code review agent (#44)

Dependencies:

• chore(deps): bump @hono/node-server from 1.19.9 to 1.19.11
• chore(deps): bump express-rate-limit from 8.2.1 to 8.3.0
• chore(deps): bump hono from 4.12.5 to 4.12.7