v0.1.7

A third language, a second lens over MCP, and two TypeScript front-end defects found by pointing the benchmark at real packages.

Added

• Java front-end — modscan detect --language java. Java maps onto the model more directly than any front-end so far: class/interface/abstract class are already its vocabulary, extends/implements are bases, annotations play the decorator role, and visibility comes from the explicit public modifier. Generic bases are reduced to their bare name, annotation arguments dropped, and nested classes deliberately not emitted as top-level seams. Optional: pip install modscan[java].
• The security lens over MCP — modscan-mcp gains audit_attack_surface beside detect_extension_points, returning exactly the payload modscan-audit --json emits so the non-coverage disclaimer travels with the data.
• The security lens covers TypeScript/JavaScript — modscan-audit --language typescript maps eval, Function, the vm module, child_process, dynamic require/import and string-bodied timers. Modelled on eslint-plugin-security: a computed require(name) is a sink, a literal require('fs') is not.
• More process sinks, and shell=True raises severity — os.popen, os.startfile, the os.exec*/os.spawn* family and commands.getoutput, found by cross-checking the lens against Bandit. A subprocess.* call passing a literal shell=True now rates high.

Fixed

• CommonJS exports are recognised. The TS/JS front-end marked symbols public only from the ESM export keyword, so every CommonJS file — most of npm — reported zero public symbols and contributed no extension points at all.
• .d.ts declaration files are no longer scanned. A declaration file declares types for code defined elsewhere, so scanning it produced a phantom copy of every symbol and let declaration-only option bags outrank the classes a project's documentation tells you to subclass.

Note

A modscan upgrade that adds catalogue entries can make the attack-surface gate report sinks that were always in the code — new to the detector, not to the codebase. Pin the Action's modscan-version for a baseline that only moves when you choose.

Full diff: v0.1.6...v0.1.7