v0.8.3

Fixed

• Dockerfile.full failed to build — TRIVY_VERSION was pinned to 0.55.0,
  a release tag that doesn't exist for aquasecurity/trivy, so the install
  script 404'd and the full (9-scanner) image build failed in CI on every
  v0.8.2 run. Bumped to 0.71.2.

v0.8.2

Added

• Published container images — GHCR workflow builds and pushes both the
  minimal and full (9-scanner) images on every release (ghcr.io/skyrxin/ sast-mcp-server:full / :minimal), and builds them on every PR so the
  Dockerfiles can't silently rot. Added a docker-compose.yml for one-command
  HTTP deployment.
• [scanners] pip extra — pip install "sast-mcp-server[scanners]" installs
  the pip-based scanners (bandit, njsscan, semgrep, checkov) in one step.
• Startup scanner-availability log — the server logs Scanners available: N/11 (...) at boot (stderr) so it's immediately clear what's usable.
• Reliability evidence — Codecov coverage badge/upload in CI; a self-scan CI
  job that publishes the SARIF + summary as artifacts (snapshot in
  examples/self-scan/); and scripts/loadtest.py with a CI smoke job that
  load-tests the HTTP transport and ops endpoints. New tests/test_ops.py
  covers the /health /ready /metrics routes and the concurrency cap.
• End-to-end engagement evidence — a full SAST engagement against OWASP crAPI
  driven entirely through the server (full-repo scan benchmarks, closed-loop
  remediation FAIL/PASS verdicts, and a CI policy gate). Published separately as
  a write-up rather than committed to the repo.

Changed

• README install story now leads with the batteries-included container and
  a scanner-availability matrix.

Fixed

• /ready performance — the readiness probe cached its scanner inventory
  (15s TTL) instead of spawning a subprocess per scanner on every request,
  which under load tanked latency (p95 ~9s → ~290ms in the load test).
• compare_baseline now accepts scanner_name="scan_all" — it previously
  rejected the aggregated form that save_baseline and
  evaluate_policy(fail_on_new=True) already accept, making a scan_all
  baseline impossible to diff. Covered by new regression tests.
• Bandit JSON parsing on Linux — added -q so bandit's progress/metric
  lines (emitted to stdout on some platforms) no longer corrupt the JSON output
  we parse.

v0.8.1

Fixed

• Corrected the mcp-name ownership marker and server.json namespace to the
  exact GitHub username case (io.github.Skyrxin/...) so publishing to the
  official MCP Registry passes PyPI ownership validation.

v0.8.0

Added

• Closed-loop remediation — remediate_and_verify applies an agent-generated
  patch, re-scans the affected file, and confirms the finding's hash is gone (and
  that no equal/higher-severity regression appeared), rolling the patch back on
  failure. Turns "suggest a fix" into "prove the fix worked."
• SARIF ingestion — import_sarif pulls any external SARIF (Snyk, Veracode,
  CodeQL, CI jobs) into the normalized finding pipeline (dedup, baseline,
  dashboards), making the server a vendor-neutral aggregation hub.
• Triage & VEX — triage_finding returns an exploitability/false-positive
  assessment prompt or records a CycloneDX VEX statement; suppressing dispositions
  add the finding to the ignore-list with justification.
• Container image scanning — scan_image scans an image reference with Trivy
  or the new Grype scanner (Anchore). Grype also scans directories/SBOMs.
• Real SBOM + SPDX — export_sbom gains format="cyclonedx"|"spdx" (SPDX 2.3);
  when Syft is installed the CycloneDX component inventory is the full dependency
  list, not just vulnerable packages.
• Enterprise reporting — generate_report gains format="pdf" (optional
  [pdf] extra, reportlab); new compliance_report maps findings to OWASP Top 10,
  SANS CWE Top 25, PCI DSS, or CIS.
• Production endpoints — HTTP transports expose /health, /ready
  (scanner availability), and /metrics (Prometheus text).
• Rate limiting & concurrency — optional per-client token-bucket rate limiting
  (SAST_MCP_RATE_LIMIT_PER_MIN) and a global subprocess-scanner concurrency cap
  (SAST_MCP_MAX_CONCURRENT_SCANS), plus per-scanner timeout overrides
  (SAST_MCP_SCANNER_TIMEOUTS).
• Incremental scans — scan_vulnerabilities/scan_all accept use_cache=True
  to reuse the last scan when the target's files are unchanged (file-fingerprint).

Changed

• In-process metrics are recorded for every tool call and scan via the existing
  @audited wrapper and the aggregator.
• Compliance framework category lists are now shared between prompts.py and the
  new reporting/compliance.py (single source of truth).

v0.7.0

Added

• Enforced authentication & audit logging: every MCP tool is now scope-gated
  (scan:read / scan:write / config:write / admin) via a new @audited
  wrapper and auth.authorize(); each call emits a structured JSON audit record
  to stderr. Tokens are validated (incl. expiry) for HTTP transports; stdio keeps
  the local trust model.
• Machine-readable output: scan_vulnerabilities, scan_all, and
  scan_git_history accept output_format="json" for agents/CI.
• evaluate_policy tool: runs all scanners and returns an explicit PASS/FAIL
  CI verdict from severity thresholds and an optional "no new vs. baseline" rule.
  save_baseline now accepts scanner_name="scan_all" for aggregate baselines.
• Enterprise finding metadata: Finding now carries cwe, cvss_score,
  cvss_vector, owasp_category, references, and remediation, populated from
  Semgrep, Trivy, OSV-Scanner, Checkov, and Bandit. SARIF export emits a CWE
  taxonomy + taxa and security-severity; dedup merges metadata across scanners.
• Reporting: export_sbom (CycloneDX 1.5 SBOM/VDR) and generate_report
  (standalone HTML executive report) tools and a new reporting/ package.
• New integrations: GitLab MR comments, Slack & Microsoft Teams webhooks,
  and Jira issue creation, plus GitHub PR comments. New tools comment_on_pr,
  notify_slack, notify_teams, create_jira_issue. All credentials are
  environment-only.
• Central config (config.py): one validated Settings object replaces
  scattered os.getenv reads; new SAST_MCP_HTTP_RETRIES, SAST_MCP_HTTP_TIMEOUT,
  SAST_MCP_CACHE_MAX_SCANS knobs.
• Scanner version detection surfaced in list_scanners (get_version()).
• Infra: enforced mypy + coverage floor + self-scan ("dogfood") in CI,
  Dependabot, a CodeQL workflow, a multi-stage Dockerfile.full bundling all CLI
  scanners, and new SECURITY.md / CONTRIBUTING.md / ARCHITECTURE.md.

Changed

• Outbound integrations now share integrations/_http.py with retry, exponential
  backoff, and a configurable timeout.
• The scan cache writes atomically and self-prunes (TTL expiry + size cap).

v0.6.0 - Integrations, AI Patching, and more

v0.6.0 — Integrations, AI-Assisted Patching, and Remote Auth (2026-06-12)

Production release adding external dashboard integrations and AI-assisted vulnerability remediation.

Added

• DefectDojo integration: upload_to_defectdojo imports SARIF exports into a DefectDojo engagement via /api/v2/import-scan/ (configured via DEFECTDOJO_URL / DEFECTDOJO_API_KEY).
• GitHub Code Scanning integration: upload_to_github pushes gzipped and base64-encoded SARIF reports to GitHub's code-scanning API (configured via GITHUB_TOKEN).
• AI-assisted remediation: generate_fix_prompt packages a cached finding's vulnerable code and context into an LLM-ready prompt requesting a strict unified diff; apply_patch applies the resulting diff via git apply, rejecting paths that escape the target directory.
• ScanCache.find_finding_by_hash() to recover full finding details by hash.

Changed

• Standardized scanner naming via a name class attribute on BaseScanner.
• Added httpx as an explicit runtime dependency.
• The fix_vulnerability MCP prompt now drives the generate_fix_prompt to apply_patch workflow.

Fixed

• Resolved all ruff lint violations across scanner modules; cleaned up dead CVSS-parsing code in the OSV scanner with an accurate database_specific.severity mapping.
• Aligned scanner scan() signatures with the base class (modified_files: set[str] | None).
• Eliminated "coroutine was never awaited" warnings in the scanner test suite.

Installation

```bash
pip install sast-mcp-server
```

---

Full Changelog: https://github.com/Skyrxin/sast-mcp-server/commits/v0.6.0