This release adds 3 notable features for engineering teams evaluating rollout.
Published 4mo
MCP Security & Auth
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
agent-security
ai-agent-security
ai-security
claude-code
codex
cursor
+14 more
hallucination-detection
llm-security
mcp
mcp-security
mcp-server
openclaw
owasp
package-hallucination
prompt-injection
static-analysis
security
supply-chain-security
vulnerability-scanning
windsurf
Summary
AI summaryUpdates What's New, Bug Fixes, and Usage ```bash across a mixed release.
Full changelog
What's New
Security Analysis Mode for cr-agent (--mode security)
- Dedicated security-focused LLM prompts with sink localization instructions
- Post-filtering drops non-security findings unless they have CWE/OWASP mapping
- Carrier/sink deduplication using heuristic scoring (file path, language signals, CWE)
- Tiered guard recognition (strong/medium/weak) to reduce false positives on guarded code
- Cross-file security context summaries for better LLM analysis
Usage
# Security-only mode — focused on exploitable vulnerabilities
npx cr-agent analyze ./path/to/project --mode security
# Shorthand
npx cr-agent analyze ./path/to/project --security-only
# SARIF output for CI (recommended with security mode)
npx cr-agent analyze ./path/to/project --format sarif --mode security
Bug Fixes
- Fix crossFileDedup collapsing independent findings
- Fix Math.random() map key collision risk
- Fix duplicate extractImports logic
- Fix double IO in context assembler
- Fix mode validation and fallback behavior
- Fix missing claude CLI flags (
-stdin marker,--no-session-persistence)
Tests
- 119 code-review-agent tests (30 new for postprocess, 11 for security-summary)
- 1404 total tests passing
Full Changelog: https://github.com/sinewaveai/agent-security-scanner-mcp/compare/v4.0.1...v4.1.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Agent Security Scanner Mcp
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]