Vigil 0.9.3

Vigil 0.9.3 — MCP Registry metadata and AUR packaging

Metadata and distribution release. No code or rule changes: 263
deterministic rules, 14 MCP tools. Release assets are the same signed set as
0.9.2 (6 binaries, 6 deb/rpm/apk packages, CycloneDX SBOM, cosign bundle,
provenance).

Added

• MCP Registry metadata — the npm launcher now carries
  mcpName: io.github.LevapVeeskela/vigil, and the repository ships a
  schema-validated server.json for the official MCP Registry. Publishing the
  registry entry requires the owner's GitHub OAuth; the npm package is ready.
• AUR packaging — packaging/aur/PKGBUILD and .SRCINFO for
  vigil-bin (x86_64/aarch64), with the exact release checksums recorded on
  main after the release.
• Directory and trust docs — ready-to-paste metadata for Glama, Smithery,
  mcp.so, PulseMCP and awesome lists, plus a CII Best Practices checklist.

Install

npm i -g lv24-vigil@0.9.3
pip install lv24-vigil==0.9.3
docker run --rm -v "$PWD:/workspace" ghcr.io/levapveeskela/lv24-vigil:0.9.3 scan --no-llm --path /workspace

AUR (after the package is published): yay -S vigil-bin.

Verify

gh attestation verify vigil_0.9.3_linux_amd64 --repo LevapVeeskela/lv24-vigil
cosign verify-blob --bundle checksums.txt.sigstore.json checksums.txt \
  --certificate-identity-regexp 'https://github.com/LevapVeeskela/lv24-vigil/.github/workflows/release.yml@refs/tags/v0.9.3' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Full changelog: CHANGELOG.md

Vigil 0.9.2

Vigil 0.9.2 — signed packages, SBOM, GHCR, pre-commit

0.9.2 supersedes 0.9.1, whose release workflow failed before publishing.
No rule changes: 263 deterministic rules, 14 MCP tools.

Added

• Linux packages — .deb, .rpm and .apk for linux/amd64 and
  linux/arm64, attached to the release and listed in checksums.txt.
• Self-SBOM — vigil-sbom-0.9.2.cdx.json (CycloneDX 1.6), generated by
  vigil sbom during the release.
• Signatures and provenance — keyless cosign bundle
  checksums.txt.sigstore.json over every binary and package, plus GitHub
  build-provenance attestations.
• GHCR image — multi-arch ghcr.io/levapveeskela/lv24-vigil:0.9.2
  (amd64/arm64), distroless, non-root, with BuildKit provenance and SBOM.
• OpenSSF Scorecard — weekly and branch-protection workflow, SARIF in the
  Security tab, public score and badge.
• pre-commit hooks — .pre-commit-hooks.yaml with vigil-scan and an
  opt-in vigil-mcp-audit; see docs/pre-commit.md.

Install

npm i -g lv24-vigil@0.9.2
pip install lv24-vigil==0.9.2
docker run --rm -v "$PWD:/workspace" ghcr.io/levapveeskela/lv24-vigil:0.9.2 scan --no-llm --path /workspace
sudo apt install ./vigil-0.9.2-linux-amd64.deb

Verify

gh release download v0.9.2 --pattern checksums.txt --pattern checksums.txt.sigstore.json
cosign verify-blob --bundle checksums.txt.sigstore.json checksums.txt \
  --certificate-identity-regexp 'https://github.com/LevapVeeskela/lv24-vigil/.github/workflows/release.yml@refs/tags/v0.9.2' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify vigil_0.9.2_linux_amd64 --repo LevapVeeskela/lv24-vigil

Full changelog: CHANGELOG.md

Vigil 0.9.0

Vigil 0.9.0 — 263 rules, MCP audit, SBOM, inline suppression

Vigil 0.9.0 adds an offline MCP configuration audit, SBOM export and inline
suppression, and expands the deterministic catalog from 221 to 263 rules
across 10 families and 14 MCP tools.

Added

• vigil mcp-audit / vigil_mcp_audit — audits MCP configuration files
  (.mcp.json, .vscode/mcp.json, opencode.json, Claude Desktop configs)
  without starting a server or contacting an endpoint. Ten VGL-MCP rules
  cover unpinned npx/uvx packages, literal secrets, docker sockets and
  privileged containers, cleartext endpoints, filesystem roots, wildcard
  auto-approve lists, prompt-injection phrases in tool descriptions, mutable
  images, disabled TLS verification and shell wrappers.
• vigil sbom — emits a deterministic CycloneDX 1.6 or SPDX 2.3 JSON bill
  of materials from the dependency manifests Vigil already understands.
  Offline; config excludes are directory-oriented so lockfiles stay in the
  inventory.
• Inline suppression — # vigil:ignore VGL-SEC-014 reason="test fixture" until=2026-12-31 on the finding line or the line above. Supports rule lists,
  *, reasons, expiry warnings, --no-inline-suppressions and
  scan.inline_suppressions. Suppressed findings stay visible in the suppressed
  list.
• Five new detection rules — VGL-AUTH-023 (JWT key material from
  jku/x5u/jwk), VGL-WEB-026 (static server rooted at the project root),
  VGL-INJ-063 (Django raw SQL), VGL-INJ-064 (PHP XXE) and VGL-INJ-065
  (Ruby raw/html_safe).

Fixed

• OSV advisories withdrawn by the source are no longer reported; MAL-*
  records are critical malware findings with remove/rotate remediation.
• Python dependency collection covers requirements*.txt, -r/--requirement
  chains and PEP 621 pyproject.toml dependencies.
• The pre-commit hook scans the staged diff (git diff --cached) instead of the
  working tree, so a staged-then-reverted secret is still caught.
• VGL-WEB-002 covers Java and PHP traversal sinks; VGL-WEB-003 covers Java
  sendRedirect and Spring redirect:.
• MCP findings redact literal credentials from snippets and evidence; SBOM
  surfaces truncation and coverage warnings instead of silently dropping them.

Verified

• go test ./..., go vet ./..., gofmt clean; npm launcher tests 14/14.
• 263 rules, no duplicate IDs; 14 MCP tools; self-scan exits 0.
• All seven npm packages and PyPI 0.9.0 published from this tag.

Install

npm i -g lv24-vigil@0.9.0
vigil version
vigil rules          # 263
vigil mcp-audit .
vigil sbom . --format cyclonedx

PyPI: pip install lv24-vigil==0.9.0.

GitHub Actions / Marketplace

The action defaults to CLI 0.9.0; pin the action to v0.9.0 or a commit SHA:

- uses: LevapVeeskela/lv24-vigil@v0.9.0
  with:
    fail-on: high

Full changelog: CHANGELOG.md

Vigil 0.8.0

Vigil 0.8.0 — real OSV severities, locked OSV endpoint, anti-RE fixes

Upgrade from 0.7.x if you use vigil dependencies or scan.osv: 0.7.x
reported every OSV advisory as medium. The minor bump is for the breaking
project-config change below.

Security

• Breaking for committed project files: scan.osv_base_url is rejected in
  a committed .vigil.yaml / .vigil.yml / vigil.yaml, like base_url. A
  scanned repository could otherwise send the package inventory to its own host
  and feed back forged advisory records. Set a mirror in the user config or with
  VIGIL_OSV_BASE_URL (in CI, as a workflow env), or pass --osv-base-url.
• The MCP vigil_dependencies argument osvBaseUrl accepts https, or plain
  http only on a loopback host, and refuses credentials in the URL without
  echoing them.
• vigil status / vigil doctor print a reduced report with a configError
  object instead of stopping on an unloadable config; the exit code stays 1.

Fixed

• Dependency severities were always medium. Each advisory's full record is
  now fetched (GET /v1/vulns/{id}, bounded to 500 records, 8 concurrent
  requests), with a warning when a record cannot be fetched. --fail-on high
  can now fire on a dependency advisory.
• A querybatch response with a different result count than queries is
  discarded for that batch instead of attributing advisories to the wrong
  packages.
• Dependency coverage gaps are reported as warnings: oversized or unparseable
  manifests, an inventory truncated by the package limit, and packages left
  unqueried after a failed batch.
• OSV result pages are followed (next_page_token, up to 10 pages per package,
  200 page requests per audit); a limit that is hit is reported.
• OSV findings in vigil scan (with scan.osv) go through the baseline and
  disable_rules, so an accepted advisory can be suppressed like any finding.
• vigil_scan, vigil_review, vigil_explain, vigil_fix and
  vigil_threat_model declare openWorldHint: true; offline tools stay false.
• Anti-RE debug/dev/test/example path checks match whole words: devportal/,
  devtools/, debugger/ or latest/ no longer hide findings, while
  src/dev, RunnerDebug, vite.config.dev.ts and e2e/ are still treated as
  non-release (e2e/ was previously reported).
• VGL-ARE-055 also reports Hermes disabled in the Podfile
  (:hermes_enabled => false, hermes_enabled: false, USE_HERMES = '0') and
  in the pre-0.71 Gradle template (enableHermes: false).
• VGL-ARE-001–005 skip example and test apps and androidTest manifests;
  VGL-ARE-020 no longer flags flutter build web --release;
  VGL-ARE-052/053 scope project.pbxproj settings per configuration header;
  VGL-ARE-054 treats an enclosing if (BuildConfig.DEBUG) { block as a debug
  guard; VGL-ARE-057/058 match the [FuseV1Options.RunAsNode]: true
  computed-key form and ignore Markdown that quotes a fuse setting.
• The repository ships a .vigil.yaml with the same excludes as the CI
  self-scan, so a local vigil scan . matches the gate.
• vigil hardening --rules can only narrow the anti-RE set; a non-VGL-ARE ID
  is rejected. vigil hardening --help now describes the command.
• vigil_hardening no longer names a configured model in its summary.
• MCP prompts/list and resources/list return a stable, name-sorted order.

Verified

• go test ./..., go vet ./..., npm 14/14 and Python 5/5 are green.
• Catalog: 221 deterministic rules (23 in VGL-ARE), 13 MCP tools.
• vigil scan . --no-llm --fail-on high exits 0 on this repository.

Install

npm i -g lv24-vigil@0.8.0
vigil version
vigil rules          # 221
vigil dependencies .

PyPI: pip install lv24-vigil==0.8.0.

GitHub Actions / Marketplace

The action defaults to CLI 0.8.0; pin the action to v0.8.0 or a commit SHA:

- uses: LevapVeeskela/lv24-vigil@v0.8.0
  with:
    fail-on: high

Full changelog: CHANGELOG.md

Vigil 0.7.1

Note: vigil dependencies in 0.7.1 reports every OSV advisory as medium, with no fixed version or description, so --fail-on high cannot fire on dependency advisories. Use 0.8.0 for real severities.

Vigil 0.7.1 — anti-RE false-positive fixes

Patch release for the 0.7.0 anti-RE hardening family. No rule IDs changed;
the catalog remains 221 deterministic rules (23 in VGL-ARE).

Fixed

• VGL-ARE-006 no longer flags a network_security_config.xml under
  src/debug (or another debug variant). Debug-only configs are not shipped in
  the release APK.
• VGL-ARE-053 no longer flags COPY_PHASE_STRIP = NO by itself. Modern
  Xcode projects use that default while STRIP_INSTALLED_PRODUCT = YES still
  strips the shipped binary. The rule now reports only
  DEBUG_INFORMATION_FORMAT = dwarf and STRIP_INSTALLED_PRODUCT = NO.

Verified

• The LV24 Flutter mobile project now scans clean with vigil hardening.
• go test ./..., go vet ./... and the npm package tests are green.

Install

npm i -g lv24-vigil@0.7.1
vigil version
vigil rules          # 221
vigil hardening .
vigil dependencies .

PyPI: pip install lv24-vigil==0.7.1.

GitHub Actions / Marketplace

The action defaults to CLI 0.7.1; pin the action to v0.7.1 or a commit SHA:

- uses: LevapVeeskela/lv24-vigil@v0.7.1
  with:
    fail-on: high

Full changelog: CHANGELOG.md

Vigil 0.7.0

Use 0.7.1 or newer. 0.7.0 contains two anti-RE false positives: VGL-ARE-006 flags debug-variant network security configs, and VGL-ARE-053 flags the modern Xcode COPY_PHASE_STRIP = NO default. 0.7.1 fixes both.

Vigil 0.7.0 — anti-RE hardening and dependency advisories

Anti-RE hardening (23 rules, VGL-ARE)

The new family checks release configurations against the surfaces a
reverse-engineering toolkit inspects. It reports missing controls and debug
leaks, never vulnerability, exploitability or bypass claims.

• Android: release R8/minification, debug signing, debuggable,
  allowBackup, cleartext traffic, network security config, WebView debugging.
• iOS: get-task-allow, App Transport Security, release testability, debug
  symbols and stripping.
• Flutter / React Native: release --obfuscate, Hermes disabled.
• Electron / JS: webSecurity, Node isolation, ASAR packing, Electron fuses
  (RunAsNode, inspector arguments, ASAR integrity, only-load), production
  source maps, minification.
• Native / .NET: Rust release debug info, .NET Release symbols and
  optimization, Node inspector flags.

The REA-to-rule mapping and explicit gaps are documented in
docs/anti-re-hardening.md.

Dependency advisories

• New vigil_dependencies MCP tool and vigil dependencies CLI command.
• Reads package-lock.json, pnpm-lock.yaml, yarn.lock,
  requirements.txt, Pipfile.lock, poetry.lock, uv.lock, go.mod,
  Cargo.lock, composer.lock, Gemfile.lock, pubspec.lock, pom.xml,
  gradle.lockfile and NuGet packages.lock.json.
• Queries OSV.dev for known public advisories. Network is explicit; no package
  manager runs and nothing is written. No match does not mean safe, and
  zero-day, private or unpublished advisories are not covered.

MCP surface

• 13 tools, including vigil_hardening and vigil_dependencies.
• New prompts anti_re_hardening and dependency_audit.
• New --no-osv scan flag.

Rules

221 deterministic rules in nine families: secrets 29, injection 47,
crypto 16, auth 17, web 18, config/IaC 37, CI 19, dependencies 15, anti-RE 23.

Install

npm i -g lv24-vigil@0.7.0
vigil version
vigil rules          # 221
vigil hardening .    # anti-RE gaps
vigil dependencies . # known OSV advisories

PyPI: pip install lv24-vigil==0.7.0 (thin launcher, needs Node.js 18+).

GitHub Actions / Marketplace

The Vigil security scan
action defaults to CLI 0.7.0; pin the action to v0.7.0 or a commit SHA:

- uses: LevapVeeskela/lv24-vigil@v0.7.0
  with:
    fail-on: high

Verify

npm view lv24-vigil version          # 0.7.0
npm view lv24-vigil dist.attestations
vigil version                        # vigil 0.7.0

Full changelog: CHANGELOG.md

Vigil 0.6.0

Vigil 0.6.0 — 198 deterministic rules

This release expands the deterministic catalog from 163 to 198 rules. It is a
rules-only release: no engine, CLI or MCP behaviour changes.

Added rules (35)

Family	New	Total	Examples
Secrets	5	29	Telegram bot token, Vault service/batch token, npm token, GitLab token, Azure Service Bus SharedAccessKey
Injection	10	47	Go SQL built from dynamic input, Java XXE/JNDI, Ruby unsafe deserialization, .NET legacy formatters, TypeNameHandling, Python os.popen/pickle loaders, PHP extract, EF Core raw SQL
Crypto	4	16	Java trust-all TrustManager, .NET validation callback, PHP/Ruby TLS verification disabled, legacy SSLv3/TLS 1.0/1.1
Auth	1	17	OAuth redirect_uri taken from request data
Web	1	18	Spring Boot actuator exposure *
Config / IaC	9	37	Docker privileged and host namespaces, seccomp/AppArmor unconfined, dangerous capabilities, IAM full admin, security group 0.0.0.0/0, S3 public access disabled, IMDSv1, nginx upstream TLS off
CI	2	19	workflow_run checkout of fork-controlled refs, untrusted event data in actions/github-script
Dependencies	3	15	Composer secure-http off, Yarn strict SSL off, Go checksum verification off

Rules were selected from gitleaks/trufflehog/detect-secrets, Semgrep, Bandit,
gosec, FindSecBugs, Brakeman, nodejsscan, hadolint, Checkov/tfsec/KICS,
kube-linter/kubesec, zizmor and OWASP guidance. Only P0/P1 high-signal patterns
were accepted; generic names, entropy-only matches, taint-only candidates and
style heuristics were rejected.

VGL-CI-018 deliberately flags only fork-controlled refs
(workflow_run.pull_requests[0].head.*, workflow_run.head_repository).
head_branch/head_sha alone is not treated as untrusted.

Install

npm i -g lv24-vigil@0.6.0
vigil rules        # 198 rules
vigil scan . --no-llm

PyPI: pip install lv24-vigil==0.6.0 (thin launcher, needs Node.js 18+).

GitHub Actions / Marketplace

The Vigil security scan
action defaults to CLI 0.6.0; pin the action itself to v0.6.0 or a commit SHA:

- uses: LevapVeeskela/lv24-vigil@v0.6.0
  with:
    fail-on: high

Verify

npm view lv24-vigil version          # 0.6.0
npm view lv24-vigil dist.attestations
vigil version                        # vigil 0.6.0

Full changelog: CHANGELOG.md

Vigil 0.5.4

Vigil Security Scan

Deterministic security audit for your repository, running on the runner with no model key by default.

• 163 deterministic rules — secrets, injection, crypto, auth, web, config/IaC, CI and dependencies.
• Offline by default — no-llm: true needs no API key and makes no model call.
• SARIF 2.1.0 — upload to GitHub code scanning; fail-on: high exits 2 on findings.
• Optional LLM triage — set no-llm: false and provide a model key via env if you want triage, fixes or a threat model.
• No telemetry — the action installs the lv24-vigil npm package and runs it; only the configured model endpoint is contacted.

Usage

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v7
  - id: vigil
    uses: LevapVeeskela/lv24-vigil@v0.5.4
    with:
      path: .
      fail-on: high
      no-llm: true
      format: sarif
  - if: always()
    uses: github/codeql-action/upload-sarif@v4
    with:
      sarif_file: ${{ steps.vigil.outputs.sarif }}

The action's version default is 0.5.4, so uses: ...@v0.5.4 installs the matching CLI. Set version: latest only when you deliberately want the newest npm release.

Inputs

Input	Default	Description
path	.	Repository path to scan.
fail-on	high	Exit 2 when a finding at or above this severity exists: low, medium, high, critical.
no-llm	true	Deterministic rules only. Set false only when a model key is configured.
format	sarif	sarif, json, md or html.
version	0.5.4	npm version or dist-tag of lv24-vigil to install.

Outputs

Output	Description
sarif	Path to the generated report (SARIF by default).
report	Path to the generated report.
exit-code	Vigil exit code: 0 clean, 1 error, 2 findings at or above fail-on.
version	npm version or dist-tag installed by the action.

Links

• README
• CI guide
• GitHub Marketplace
• Full changelog

Vigil 0.5.3

Warning

The composite action at this tag falls back to latest because GITHUB_ACTION_REF is empty in composite actions. Use v0.5.4 or newer. The npm package and binaries at v0.5.3 are fine.

Vigil Security Scan Deterministic security audit for your repository, running on the runner with no model key by default. - 163 deterministic rules тАФ secrets, injection, crypto, auth, web, config/IaC, CI and dependencies. - Offline by default тАФ no-llm: true needs no API key and makes no model call. - SARIF 2.1.0 тАФ upload to GitHub code scanning; fail-on: high exits 2 on findings. - Optional LLM triage тАФ set no-llm: false and provide a model key via env if you want triage, fixes or a threat model. - No telemetry тАФ the action installs the lv24-vigil npm package and runs it; only the configured model endpoint is contacted. ### Usage yaml permissions: contents: read security-events: write steps: - uses: actions/checkout@v7 - id: vigil uses: LevapVeeskela/lv24-vigil@v0.5.3 with: path: . fail-on: high no-llm: true format: sarif - if: always() uses: github/codeql-action/upload-sarif@v4 with: sarif_file: ${{ steps.vigil.outputs.sarif }} The action pins the npm CLI to the action tag by default (v0.5.3 тЖТ lv24-vigil@0.5.3). Set version: latest if you deliberately want the newest npm release. ### Inputs | Input | Default | Description | |---|---|---| | path | . | Repository path to scan. | | fail-on | high | Exit 2 when a finding at or above this severity exists: low, medium, high, critical. | | no-llm | true | Deterministic rules only. Set false only when a model key is configured. | | format | sarif | sarif, json, md or html. | | version | action tag | npm version or dist-tag of lv24-vigil to install. | ### Outputs | Output | Description | |---|---| | sarif | Path to the generated report (SARIF by default). | | report | Path to the generated report. | | exit-code | Vigil exit code: 0 clean, 1 error, 2 findings at or above fail-on. | | version | npm version or dist-tag installed by the action. | ### Links - README - CI guide - GitHub Marketplace - Full changelog

Vigil 0.5.2

Vigil Security Scan

Deterministic security audit for your repository, running on the runner with no model key by default.

• 163 deterministic rules — secrets, injection, crypto, auth, web, config/IaC, CI and dependencies.
• Offline by default — no-llm: true needs no API key and makes no model call.
• SARIF 2.1.0 — upload to GitHub code scanning; fail-on: high exits 2 on findings.
• Optional LLM triage — set no-llm: false and provide a model key via env if you want triage, fixes or a threat model.
• No telemetry — the action installs the lv24-vigil npm package and runs it; only the configured model endpoint is contacted.

Usage

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v7
  - id: vigil
    uses: LevapVeeskela/lv24-vigil@v0.5.2
    with:
      path: .
      fail-on: high
      no-llm: true
      format: sarif
      version: 0.5.2
  - if: always()
    uses: github/codeql-action/upload-sarif@v4
    with:
      sarif_file: ${{ steps.vigil.outputs.sarif }}

Inputs

Input	Default	Description
path	.	Repository path to scan.
fail-on	high	Exit 2 when a finding at or above this severity exists: low, medium, high, critical.
no-llm	true	Deterministic rules only. Set false only when a model key is configured.
format	sarif	sarif, json, md or html.
version	latest	npm version or dist-tag of lv24-vigil to install. Pin 0.5.2 to match the action tag.

Outputs

Output	Description
sarif	Path to the generated report (SARIF by default).
report	Path to the generated report.
exit-code	Vigil exit code: 0 clean, 1 error, 2 findings at or above fail-on.
version	npm version or dist-tag installed by the action.

Links

• README
• CI guide
• Full changelog