Skip to content

v0.6.0 - Integrations, AI Patching, and more

Choose a tag to compare

View all tags
@Skyrxin Skyrxin released this 14 Jun 15:52
v0.6.0
4629bad

v0.6.0 — Integrations, AI-Assisted Patching, and Remote Auth (2026-06-12)

Production release adding external dashboard integrations and AI-assisted vulnerability remediation.

Added

  • DefectDojo integration: upload_to_defectdojo imports SARIF exports into a DefectDojo engagement via /api/v2/import-scan/ (configured via DEFECTDOJO_URL / DEFECTDOJO_API_KEY).
  • GitHub Code Scanning integration: upload_to_github pushes gzipped and base64-encoded SARIF reports to GitHub's code-scanning API (configured via GITHUB_TOKEN).
  • AI-assisted remediation: generate_fix_prompt packages a cached finding's vulnerable code and context into an LLM-ready prompt requesting a strict unified diff; apply_patch applies the resulting diff via git apply, rejecting paths that escape the target directory.
  • ScanCache.find_finding_by_hash() to recover full finding details by hash.

Changed

  • Standardized scanner naming via a name class attribute on BaseScanner.
  • Added httpx as an explicit runtime dependency.
  • The fix_vulnerability MCP prompt now drives the generate_fix_prompt to apply_patch workflow.

Fixed

  • Resolved all ruff lint violations across scanner modules; cleaned up dead CVSS-parsing code in the OSV scanner with an accurate database_specific.severity mapping.
  • Aligned scanner scan() signatures with the base class (modified_files: set[str] | None).
  • Eliminated "coroutine was never awaited" warnings in the scanner test suite.

Installation

```bash
pip install sast-mcp-server
```

Full Changelog: https://github.com/Skyrxin/sast-mcp-server/commits/v0.6.0

Assets 2
Loading