v0.8.0

Added

• Closed-loop remediation — remediate_and_verify applies an agent-generated
  patch, re-scans the affected file, and confirms the finding's hash is gone (and
  that no equal/higher-severity regression appeared), rolling the patch back on
  failure. Turns "suggest a fix" into "prove the fix worked."
• SARIF ingestion — import_sarif pulls any external SARIF (Snyk, Veracode,
  CodeQL, CI jobs) into the normalized finding pipeline (dedup, baseline,
  dashboards), making the server a vendor-neutral aggregation hub.
• Triage & VEX — triage_finding returns an exploitability/false-positive
  assessment prompt or records a CycloneDX VEX statement; suppressing dispositions
  add the finding to the ignore-list with justification.
• Container image scanning — scan_image scans an image reference with Trivy
  or the new Grype scanner (Anchore). Grype also scans directories/SBOMs.
• Real SBOM + SPDX — export_sbom gains format="cyclonedx"|"spdx" (SPDX 2.3);
  when Syft is installed the CycloneDX component inventory is the full dependency
  list, not just vulnerable packages.
• Enterprise reporting — generate_report gains format="pdf" (optional
  [pdf] extra, reportlab); new compliance_report maps findings to OWASP Top 10,
  SANS CWE Top 25, PCI DSS, or CIS.
• Production endpoints — HTTP transports expose /health, /ready
  (scanner availability), and /metrics (Prometheus text).
• Rate limiting & concurrency — optional per-client token-bucket rate limiting
  (SAST_MCP_RATE_LIMIT_PER_MIN) and a global subprocess-scanner concurrency cap
  (SAST_MCP_MAX_CONCURRENT_SCANS), plus per-scanner timeout overrides
  (SAST_MCP_SCANNER_TIMEOUTS).
• Incremental scans — scan_vulnerabilities/scan_all accept use_cache=True
  to reuse the last scan when the target's files are unchanged (file-fingerprint).

Changed

• In-process metrics are recorded for every tool call and scan via the existing
  @audited wrapper and the aggregator.
• Compliance framework category lists are now shared between prompts.py and the
  new reporting/compliance.py (single source of truth).