v1.2.1 - OAuth Brand Alignment, Real User Identity Resolution, Root Go Install

What's Changed in v1.2.1

Brand Guidelines & OAuth Loopback Callback

• Replaced the legacy loopback callback HTML rendered on http://127.0.0.1:54321/callback to strictly adhere to official Lorikeet Security brand guidelines:
  • Deep dark theme (#0a1628), elevated container card (#142b49), and primary crimson brand accent (#db6574).
  • Integrated official Lorikeet Security brand logo header SVG matching the Talon authorization consent screen.

Identity & Authentication Security

• Eliminated all fallback mock developer credentials.
• Full PKCE token response parsing across user_email, email, company_name, org_name, and company_id.
• Real-time OAuth userinfo endpoint querying (/talon/mcp/oauth/userinfo) and fallback JWT claim resolution.
• Enforced strict session failure when user identity cannot be validated.

Go Module & Package Architecture

• Normalized Go module path to github.com/Lorikeet-Security/lory-cli.
• Added root main.go entry point enabling direct go install github.com/Lorikeet-Security/lory-cli@latest.
• Clean cross-platform distribution builds across Linux (amd64/arm64), macOS (amd64/arm64), and Windows (amd64).

Documentation & Brand Imagery

• Overhauled README with official Lorikeet Security brand assets, terminal workbench diagrams, MCP sidecar architecture schemas, and clean enterprise formatting.

Verification Checksums

3db6b0847d07c397f561c7515b1842cfc0ba574a0a7ff2732c1081747aaf8c14  lory-darwin-amd64
2c7ce39b78462048b75bf7e05c99fdd67770c61d697ee94a4660223a3503a86d  lory-darwin-arm64
05f01651e4cd907d2521fc26a3702279283d547f004b4401b4239a3e58dac58d  lory-linux-amd64
4a226eab90decf09921dab67892da033ae0ecddcce158039dec5c55160ac1b68  lory-linux-arm64
eda296df7bc2522dcac1c004543f7e00d1f178217bb72c93a9e994d662adf887  lory-windows-amd64.exe

v1.2.0 - Pure-Go Binary PDF Export, .loryignore, MCP Hardening & Complete Issue Resolution

Overview

Lorikeet Lory CLI v1.2.0 is a major milestone release delivering pure-Go binary PDF reporting, .loryignore support, flexible inline suppressions, Model Context Protocol (MCP) server security hardening, CLI argument reordering, and the complete resolution of all 19 initial GitHub issues and technical debt items across 24 pull requests (#20 through #44).

---

Key Highlights

1. Pure-Go Binary PDF 1.4 Export Engine (lory export --format pdf)

• Implemented a zero-dependency, pure-Go PDF 1.4 generator in pkg/export/pdf.go.
• Produces multi-page executive security and compliance audit reports with color-coded severity breakdowns (Critical, High, Medium, Low), detailed vulnerability disclosures, and remediation instructions.
• Requires no external CLI tools, headless browsers, or CGO bindings.

2. Flexible Suppressions & .loryignore File Support

• Added native .loryignore file parsing across pkg/analyzer, pkg/reviewer, and cmd/diff.
• Supports directory, wildcard, and glob patterns (e.g. *.min.js, vendor/, test/fixtures/).
• Added multi-syntax inline suppression comments across all supported languages:
  • // lory:ignore or /* lory:ignore */
  • # lory:suppress or <!-- lory:suppress -->
  • Multi-line block suppressions (lory:suppress-start ... lory:suppress-end) and whole-file ignore directives (lory:ignore-file).

3. MCP Server Hardening & Contextual Remediation (mcp serve)

• Added strict URL scheme validation (http/https) returning JSON-RPC error code -32602 for non-HTTP URI targets.
• Added contextual remediation guidance in lory_explain_finding tailored specifically to CWEs (CWE-89 SQLi, CWE-78 Command Injection, CWE-798 Hardcoded Secrets, CWE-918 SSRF, CWE-79 XSS, and CWE-311 Cleartext Transmission).
• Thread-safe response writing and token preservation during live web audits.

4. Git Diff & CLI Usability Improvements

• Added support for --cached and --staged flags in lory diff to review staged index changes.
• Flexible argument ordering: git revisions can precede flags (e.g., lory diff HEAD --fix, lory scan <target> --format json, lory badge <target> --theme dark).
• Automatically skips deleted files from diff reviews and avoids null JSON arrays for clean runs ("findings": []).

5. Precision SAST Route & Sink Attribution

• Replaced synthetic baseline finding injection with clean-pass semantics on secure codebases.
• Route correlation now precisely anchors sinks to the closest preceding enclosing route in the same source file (r.LineNumber <= wb.LineNumber).
• Non-route sinks (utility libraries, backend workers) are cleanly isolated as Route: "N/A" / Method: "N/A" with descriptive comment PoCs instead of arbitrary route inheritance.

---

Pull Request & Issue Resolution Index

Pull Request	Scope / Resolved Issue
#20	Remove synthetic baseline finding injection on clean repositories (Fixes #1)
#21	Return error on connection failures and unreachable hosts during retest (Fixes #2)
#22	Dynamically construct replay vectors from finding registry (Fixes #3)
#23	Ignore regex definitions and test files in SAST sink analysis (Fixes #4)
#24	Correlate findings with routes declared in same source file (Fixes #5)
#25	Scan target argument positioning for review flag parsing (Fixes #6)
#26	Review command formatted JSON array output (Fixes #7)
#27	Filter findings by exact status matching (Fixes #8)
#28	Improve web target detection heuristic (Fixes #9)
#29	Retain auth token during MCP lory_scan_target execution (Fixes #10)
#30	Load token from credentials.json in GetToken fallback (Fixes #11)
#31	Support all recognized language extensions in repository analyzer (Fixes #12)
#32	Filter findings by --min-severity threshold (Fixes #13)
#33	Skip deleted files from git diff review list (Fixes #14)
#34	Parse review flags and forward to RunReview in diff (Fixes #15)
#35	Allow target argument to precede flags in lory badge (Fixes #16)
#36	Validate target URL scheme and provide CWE-specific advice in MCP (Fixes #17)
#37	Deduplicate SARIF driver rules and update driver version to 1.1.1 (Fixes #18)
#38	Tech debt rollup: Shorthand scan, binary PDF export, user-agent update (Fixes #19)
#39	Enclosing route attribution & non-route sink isolation
#40	Support --cached/--staged flags and reorder diff arguments
#41	Partition scan arguments, initialize empty findings array, and sync help flags
#42	Native .loryignore file, flexible suppressions, and documentation sync
#43	Unify .loryignore wildcard filtering across review and diff commands
#44	Bump version to 1.2.0 across CLI, packages, tests, and documentation

---

Installation

One-line Install (Linux & macOS)

curl -fsSL https://lorikeetsecurity.com/install.sh | bash

Direct Downloads

Platform	Architecture	Binary
Linux	x86_64 (amd64)	lory-linux-amd64
Linux	AArch64 (arm64)	lory-linux-arm64
macOS	Intel (amd64)	lory-darwin-amd64
macOS	Apple Silicon (arm64)	lory-darwin-arm64
Windows	x86_64 (amd64)	lory-windows-amd64.exe

Verification Checksums

All binary assets are cryptographically verified in checksums.txt.

v1.1.1 - Documentation Suite, Official Talon Shield, and User Profile Parsing

Overview

Lorikeet Lory CLI v1.1.1 introduces a comprehensive documentation suite, the official Lorikeet Security Talon Claw dual-tone brand mark, dynamic user profile resolution from Talon OAuth, and version bumps across all tool chains.

Key Highlights

• Comprehensive Documentation Suite: 8 in-depth technical guides in docs/ covering Architecture, Talon OAuth PKCE Authentication, AI Code Review, PTaaS Web Target Auditing, Trust Badges, MCP Integration, and CI/CD pipelines.
• Official Talon Shield Mark: Replaced browser callback artwork with the official Lorikeet Security Talon Claw dual-tone shield SVG mark in Deep Navy (#0A1628 / #142B49) and Crimson/Rose (#BA5663 / #DB6574).
• Dynamic User Profile Resolution: Replaced hardcoded fallback credentials with dynamic token parsing for user_email, company_name, and company_id. Added live user profile query fallback via /talon/api/whoami and /talon/mcp/oauth/userinfo, and authenticated subject fallback.
• Model Context Protocol (MCP): Updated server protocol version to 1.1.1 with support for Claude Code, Cursor, and IDE sidecars.

---

Installation

One-line Install (Linux & macOS)

curl -fsSL https://lorikeetsecurity.com/install.sh | bash

Direct Downloads

Platform	Architecture	Binary
Linux	x86_64 (amd64)	lory-linux-amd64
Linux	AArch64 (arm64)	lory-linux-arm64
macOS	Intel (amd64)	lory-darwin-amd64
macOS	Apple Silicon (arm64)	lory-darwin-arm64
Windows	x86_64 (amd64)	lory-windows-amd64.exe

Verification Checksums

All binary assets are cryptographically verified in checksums.txt.

v1.1.0 - Lorikeet Lory CLI & Security Scanner

Overview

Lorikeet Lory CLI v1.1.0 introduces major enhancements across identity, AI-assisted code security, automated penetration testing (PTaaS), Trust reporting, and AI agent integration.

Key Highlights

• Talon SSO & PKCE OAuth Login: Seamless, browser-based secure authentication (lory login) via Lorikeet Talon SSO with loopback redirect handling and token refresh.
• Streaming SSE AI Code Review: Real-time streaming AI code security reviews with interactive in-place fixes (lory review) for detected vulnerabilities.
• PTaaS Web Target Scanning: Native remote penetration testing and security scanning (lory scan) integrated directly with the Lorikeet platform scan API.
• Trust Badge Generation: Generate verified repository trust badges and compliance reports (lory badge).
• Model Context Protocol (MCP) Server: Run Lory as an MCP server (lory mcp) to integrate security scanning tools and workflows directly into AI IDEs and agents (Cursor, Claude Desktop, Antigravity).

---

Installation

One-line Install (Linux & macOS)

curl -fsSL https://lorikeetsecurity.com/install.sh | bash

---

Direct Downloads

Platform	Architecture	Binary	SHA256 Checksum
Linux	x86_64 (amd64)	lory-linux-amd64	dd503a988d85b9210eb0a94158a3e02d042e015cf2a90fad6aa6911d4450bdd5
Linux	AArch64 (arm64)	lory-linux-arm64	dd875370baf779592b9b8d52dc82ee75cdfb1eae76c9fd2fc9d6a7479b16fe00
macOS	Intel (amd64)	lory-darwin-amd64	6f99ed51c312a1eee401db97a55937fa816cc0e257c323f447cc268f17e0dee9
macOS	Apple Silicon (arm64)	lory-darwin-arm64	ba56b866e574030e522dd47f4ca86d8de1419964e9277c6578c10c5ad07356eb
Windows	x86_64 (amd64)	lory-windows-amd64.exe	84ee64d9338dbeaeaf19ec3d75ca05fd3e262b6ab12cb4dd26cc2ddb601ba61f

Checksums

Verification checksums are available in checksums.txt.