Magdox v1.3.2

Magdox v1.3.2

The public download remains a lightweight launcher. Sign in with CLI-capable product access to install the signed private scanning engine, MCP server and integration bundle. No rules or private components are included in these public archives.

• AI-generated output is marked. JSON from scans and reviews carries ai.ai_generated: true on AI reviews and AI fixes, terminal lines start with "AI-generated review" or "AI-generated fix", and uploads carry the mark, so the dashboard labels them as AI-generated.
• Each release now ships a CycloneDX software bill of materials, magdox-sbom.cdx.json, listing the CLI's third-party modules, signed with cosign like the checksums (magdox-sbom.cdx.json.sig, magdox-sbom.cdx.json.pem).
• magdox login names the device "magdox CLI on /" instead of sending your computer's host name. magdox logout revokes its token through the API's POST endpoint.
• A folder the scanner may not read no longer stops the scan: it is listed as not scanned and the result is marked incomplete.
• MCP server: tool results stay within 64 KiB so agents can read them, errors name the argument or the magdox command that fixes them, magdox_check_code accepts tsx, jsx, yml and sh and needs a filename or a language, and each scan pass says why it is partial.
• Fewer false positives in the integer truncation, user-controlled regular expression, hard-coded credential, Composer, Kotlin logging, Ruby mass assignment, Dockerfile CA bundle, GitHub Actions ::add-mask:: and Terraform secret-output rules.
• Everything in v1.3.1 is included. Private components from v1.3.2 work with launchers 1.2.0 and later.

Full release notes: https://magdox.io/docs/release-notes/

Install or upgrade:

npm install -g @magdox/cli@1.3.2      # macOS, Linux, Windows; Node 18+
brew upgrade magdox/tap/magdox        # Homebrew

Verify downloads against checksums.txt, which is signed (checksums.txt.sig, checksums.txt.pem).

Magdox v1.3.1

Magdox v1.3.1

The public download remains a lightweight launcher. Sign in with CLI-capable product access to install the signed private scanning engine, MCP server and integration bundle. No rules or private components are included in these public archives.

• Offline licences in one step: magdox license request prints a single line (beginning mgdx_req1.) that an owner or admin pastes under Settings → Offline licences in the dashboard. magdox license import <file> installs the one file they download, which holds the licence and the encrypted rules and works only on the machine that printed the code. --json still prints the previous request form, and --package/--archive still import the two-file form.
• Everything in v1.3 is included: local risk assessment (scan --risk, risk assess), --repository, staged uploads, offline access that follows the plan (7, 30 or 90 days) and contract-bound Enterprise air-gapped licences.
• A new version number so Homebrew and npm upgrade existing 1.3.0 installs. Private components from v1.3 work with this launcher.

Install or upgrade:

npm install -g @magdox/cli@1.3.1      # macOS, Linux, Windows; Node 18+
brew upgrade magdox/tap/magdox        # Homebrew

Verify downloads against checksums.txt, which is signed (checksums.txt.sig, checksums.txt.pem).

Magdox v1.3

Magdox v1.3

The public download remains a lightweight launcher. Sign in with CLI-capable product access to install the signed private scanning engine, MCP server and integration bundle. No rules or private components are included in these public archives.

• Local risk assessment: magdox scan . --risk --risk-context context.json and magdox risk assess --scan scan.json --context context.json explain priorities offline, with baselines through --risk-baseline. Ordinary scans and severity gates are unchanged unless you opt in.
• --repository names the repository for uploads and evidence packages (magdox scan . --upload --repository my-app).
• Staged uploads and stricter input bounds; licence checks cover plan leases and lapses.
• Fixed HTML reports whose output could appear garbled.

Install or upgrade:

npm install -g @magdox/cli@1.3.0      # macOS, Linux, Windows; Node 18+
brew upgrade magdox/tap/magdox        # Homebrew

Verify downloads against checksums.txt, which is signed (checksums.txt.sig, checksums.txt.pem).

Magdox v1.2

Magdox v1.2

The public download is now a lightweight launcher. Sign in with CLI-capable product access to install the signed private scanning engine, MCP server and integration bundle. No rules or private components are included in these public archives.

• Live scan progress, severity-first terminal summaries and --details for expanded findings.
• Compact --full engine summaries, inventory counts and upload results.
• Offline HTML reports with severity counts, charts, grouping, filters and pagination.
• Explicit incomplete-analysis reasons. Exit codes: 1 for failure, 3 for incomplete coverage, 4 for a failed finding/policy threshold; 4 takes precedence over 3.
• Customer output omits private rule metadata. Review integrations that consume JSON, SARIF, CSV or XML when upgrading.
• Authenticated MCP installation includes the plugin bundle; no separate public plugin package.

Install

Choose one CLI package manager:

brew install magdox/tap/magdox
# or
npm install -g @magdox/cli@1.2.0

magdox login
magdox doctor
magdox scan .
magdox mcp install

Existing Homebrew users can run brew upgrade magdox/tap/magdox. The optional @magdox/mcp@1.2.0 package is a public forwarding shim, not the private MCP server.

Supported release binaries: macOS and Linux AMD64/ARM64, and Windows AMD64. Native Windows ARM64 binaries are not included. Automatic plugin hooks require macOS/Linux; only the Claude Code integration has recorded end-to-end host validation. Other host configurations remain experimental.

The release name is v1.2; npm and binary semantic versions are 1.2.0. Public checksum signatures identify the private CLI repository's reviewed release workflow at refs/tags/v1.2. Do not use public repository source archives as engine source or installation packages.

Installation and access documentation · AI integrations