v0.7.0

Cordon 0.7.0

Cordon offered to the AI agents that install things for you, an install guard in front of
pnpm, npm and pip, and npm malware measured at full scale.

   ┌──────────────────────────────────────────────────────────────────────────┐
   │  npm malware, blocked by reading the code     6,187 of 6,793    91.08%   │
   │  benign npm packages, blocked anyway            330 of 34,437    0.96%   │
   │                                                                          │
   │  Every release of both sets, on the release commit; the method and the   │
   │  counts behind them are in docs/08-ACCURACY.md.                          │
   └──────────────────────────────────────────────────────────────────────────┘

  Map of this release
  ├─ Install ................ pipx · the Action · the containers
  ├─ For AI agents .......... the MCP server, in every agent and both editor families
  ├─ Put it to work ......... eleven copy-paste implementations, laptop to organisation
  ├─ Added .................. rule files, provenance, images, notifications, Python 3.15
  ├─ Stricter ............... intel stale after a week, scan targets cannot blind the scan
  └─ Verify it .............. hashes, signatures, provenance

---

Install

   pipx install cordon-scanner==0.7.0          Python 3.11 to 3.15, no runtime dependencies

   GitHub Action   uses: Threx-code/cordon/action@v0.7.0   (pin the commit SHA the tag names)
   Container       ghcr.io/threx-code/cordon:0.7.0        amd64 and arm64; pin it by digest
   Runner          ghcr.io/threx-code/cordon-runner:0.7.0
   Bitbucket pipe  ghcr.io/threx-code/cordon-bitbucket-pipe:0.7.0

For AI agents

   cordon-scanner mcp            a Model Context Protocol server; every tool only reads
   cordon-scanner mcp config --client claude-code | cursor | codex | vscode | …   (eleven agents)

   before an agent …                      it asks
   runs an install command                check_install_command
   adds a package                         check_package, check_packages
   loads a skill / adds an MCP server     check_skill, check_mcp_server, check_mcp_tools
   follows an instruction file            check_agent_file

The VS Code extension registers the server with the editor's own agents; the JetBrains plugin
brings findings to IntelliJ-based IDEs. Tutorials 30 and 41.

Put it to work

   LEVEL 1  one machine        33 on your laptop · 34 guard pnpm, npm and pip installs
   LEVEL 2  every pipeline     35 GitHub Actions · 36 GitLab CI · 37 Jenkins, Azure,
                               Bitbucket, CircleCI, Buildkite, any shell · 38 images
   LEVEL 3  the organisation   39 rollout · 40 air-gapped · 41 AI agents · 42 Python API

Every command in them was run as shown, and a test runs every command the documentation shows
through the real CLI.

Added

   rule files        your own signatures (--rule-file), on cordon-rule, Cordon's own engine
   provenance        Bazel modules, Helm charts and Ansible collections; Sigstore with no
                     optional dependency
   images            scan pkg:docker/<image>: pulled, every blob checked against its digest
   release identity  a downloaded wheel or tarball is matched against the vulnerability
                     advisories for itself, not only the malware records
   air gap           advisories sync --bundle DIR: the signed bundle from a carried folder
   notifications     Slack, Teams and a signed webhook; --notify-on; notify test
   Python 3.15

Stricter

   intel             stale after 7 days without a feed (was 30): the scan says so and is
                     incomplete; an operator's own --config may choose longer
   scan targets      a repository's own cordon.yaml can no longer switch the staleness check
                     off by a long limit, as it already could not by 0
   incomplete        an incomplete scan never passes under --fail-on-incomplete, the
                     Action's default

The signed intel feed is not on in this release: no feed root is pinned, as in 0.6.0. Every
default scan still asks OSV what changed before it matches anything, and an offline site
installs the release's signed advisory bundle (advisories sync --bundle). The feed, with
Cordon's own advisories, comes in a release that pins its root once its host is live.

The full list, each fix with its test: CHANGELOG.

Verify it

   cordon-scanner verify --online     the installed files against the wheel's PyPI
                                      provenance, signed by Cordon's release workflow
   action/requirements.txt            the hashes the Action and every CI template install by
   docs/12-SIGNING-KEYS.md            the keys that sign the feed and the advisory bundle

No signed offline advisory bundle ships with this release. The advisory database's signing key is not configured yet, so offline installs sync only from what the wheel carries.