Magdox v1.3.2

Magdox v1.3.2

The public download remains a lightweight launcher. Sign in with CLI-capable product access to install the signed private scanning engine, MCP server and integration bundle. No rules or private components are included in these public archives.

• AI-generated output is marked. JSON from scans and reviews carries ai.ai_generated: true on AI reviews and AI fixes, terminal lines start with "AI-generated review" or "AI-generated fix", and uploads carry the mark, so the dashboard labels them as AI-generated.
• Each release now ships a CycloneDX software bill of materials, magdox-sbom.cdx.json, listing the CLI's third-party modules, signed with cosign like the checksums (magdox-sbom.cdx.json.sig, magdox-sbom.cdx.json.pem).
• magdox login names the device "magdox CLI on /" instead of sending your computer's host name. magdox logout revokes its token through the API's POST endpoint.
• A folder the scanner may not read no longer stops the scan: it is listed as not scanned and the result is marked incomplete.
• MCP server: tool results stay within 64 KiB so agents can read them, errors name the argument or the magdox command that fixes them, magdox_check_code accepts tsx, jsx, yml and sh and needs a filename or a language, and each scan pass says why it is partial.
• Fewer false positives in the integer truncation, user-controlled regular expression, hard-coded credential, Composer, Kotlin logging, Ruby mass assignment, Dockerfile CA bundle, GitHub Actions ::add-mask:: and Terraform secret-output rules.
• Everything in v1.3.1 is included. Private components from v1.3.2 work with launchers 1.2.0 and later.

Full release notes: https://magdox.io/docs/release-notes/

Install or upgrade:

npm install -g @magdox/cli@1.3.2      # macOS, Linux, Windows; Node 18+
brew upgrade magdox/tap/magdox        # Homebrew

Verify downloads against checksums.txt, which is signed (checksums.txt.sig, checksums.txt.pem).