v1.3.0 — Context-Aware False Positive Reduction

Context-Aware False Positive Reduction

Adds an application_profile parameter to all code analysis tools, enabling users to specify their application type (CLI tool, MCP server, web app, etc.) to suppress irrelevant findings. A CLI tool script no longer gets flagged for missing MFA, TLS headers, or database encryption it doesn't use.

Added

• ApplicationContext Module (analyzers/application_context.py): Capability-based context system with 8 predefined profiles (cli-tool, mcp-server, web-app, api-service, iac-only, library, batch-job, full)
• application_profile Parameter: New optional parameter on analyze_infrastructure_code, analyze_application_code, and analyze_cicd_pipeline MCP tools
• FalsePositiveJudge: New adversarial judge that validates context-aware filtering quality
• False Positive Adversarial Test Cases: 7 new test cases covering CLI tool suppression, full profile preservation, backward compatibility, and unknown profile handling
• ApplicationContext Unit Tests: 21 tests covering profiles, tag/family suppression, pattern integration, and serialization

Changed

• Pattern Engine: GenericPatternAnalyzer now accepts application_context to pre-filter patterns by tags and families
• Analyzer Pipeline: Context filtering threaded through generic_adapter.py -> pattern_tool_adapter.py -> generic_analyzer.py
• Traditional Analyzer Filtering: Post-merge _apply_context_filter() suppresses traditional analyzer findings by keyword and family matching
• Evaluator Tool Registry: Updated to support application_profile for all analyzer tools including analyze_cicd_pipeline
• Pattern Schema V2 Docs: Added Context-Aware Filtering section and Application Context Profiles table

Fixed

• Tag normalization: Pattern YAML tags using hyphens (e.g., security-headers) now correctly match CAPABILITY_TAG_MAP entries using underscores
• Unused imports/variables: Cleaned up test files

Upgrade Guide

The new application_profile parameter is fully backward compatible. All existing tool calls work unchanged. To reduce false positives, add the parameter:

# Before (unchanged, still works):
result = analyze_application_code(code=my_code, language='python')

# After (reduced noise for CLI tools):
result = analyze_application_code(code=my_code, language='python', application_profile='cli-tool')

Available profiles: cli-tool, mcp-server, web-app, api-service, iac-only, library, batch-job, full

Full Changelog: v1.2.0...v1.3.0

What's Changed

• docs: add Git Flow workflow section to copilot instructions by @KevinRabun in #11
• fix: address PR#12 security review - path validation, thread-safe cache, tests by @Copilot in #13
• security: harden file operations and external API calls by @KevinRabun in #12
• Add adversarial judges for quality and accuracy testing by @KevinRabun in #14
• feat: context-aware false positive reduction with application_profile… by @KevinRabun in #15

Full Changelog: v1.2.0...v1.3.0

What's Changed

• docs: add Git Flow workflow section to copilot instructions by @KevinRabun in #11
• fix: address PR#12 security review - path validation, thread-safe cache, tests by @Copilot in #13
• security: harden file operations and external API calls by @KevinRabun in #12
• Add adversarial judges for quality and accuracy testing by @KevinRabun in #14
• feat: context-aware false positive reduction with application_profile… by @KevinRabun in #15

Full Changelog: v1.2.0...v1.3.0