v3.5.0

Overview

Cybermes v3.5.0 introduces security hardening across all Model Context Protocol (MCP) tool handlers, non-destructive diagnostic tooling for specialized targets, core engine performance optimizations, and standardized operational playbooks.

Security Hardening (MCP Server)

• Target Slug Sanitization: Enforced sanitizeSlug() across all MCP tool handlers (tools_recon, tools_reports, tools_fuzz, tools_nuclei) using regex [^a-z0-9]+ normalization. Prevents directory traversal attacks via untrusted target_slug inputs.
• URI and Port Normalization: Resolved Windows file URI escaping (file:///) and default port resolution (80/443) across scope validators and headless PDF export routines.
• Stream Filter Deduplication: Added target slug sanitization and case-insensitive stream deduplication in pkg/stream.

Diagnostic Tooling (scripts/)

• scripts/audit_ai_gateway_config.py: Non-destructive diagnostic utility auditing AI and LLM gateways against OWASP GenAI Top 10 recommendations (CORS reflection checks, unauthenticated /api/v1/models catalog exposure, token propagation validation).
• scripts/audit_exam_state_machine.py: Examination and learning management system payload auditor detecting premature answer key disclosure (correct_answer, kunci_jawaban) and verifying server-side epoch timestamp integrity.
• scripts/audit_firmware_fs.py: Static analysis utility for extracted router filesystems (SquashFS/JFFS2) inspecting weak password hashes, exposed private keys, and unauthenticated daemon launch scripts in /etc/init.d/.
• scripts/setup_mcp.py: Fixed fallback JSONC comment parsing and decoupled Hermes CLI configuration from IDE MCP clients.

Core Performance Optimizations

• Secret Scanner (pkg/secrets): Replaced linear pattern evaluation with O(1) hash map lookups and enforced a file size cap to prevent memory spikes on large minified assets.
• Knowledge Search (pkg/search): Introduced an in-memory index cache and fast-path scoring routine, reducing offline search latency below 10ms.

Skills and Playbooks

• Added academic-platform-audit skill module covering OWASP WSTG business logic and state machine test cases.
• Added embedded-router-firmware-audit skill module implementing the 9-stage Firmware Security Testing Methodology (FSTM).
• Standardized ai-api-gateway-security around split-plane (Control Plane vs Data Plane) architecture.
• Sanitized operational references to RFC 2606 reserved domains (example.com, example.edu).
• Added wordlists/custom_basic.txt for baseline web reconnaissance.

Contributors and Merged Pull Requests

Validated and merged community contributions included in this release:

• @Anai-Guo in #41: Fixed missing import re dependency in the JSONC fallback parser for MCP setup.
• @avp9-nexus in #34 and #23: Hardened Docker build pipeline with pipefail and APT mirror retries, and enabled CI pipeline execution on dev.
• @sizoune in #20: Implemented target-specific PDF report filename formatting.
• Issue #21: Fixed finding severity regex extraction on markdown files in report aggregator.
• Issue #22: Clarified private vulnerability reporting links in security guidelines.

Distribution and Ecosystem

• Published cybermes-mcp@3.5.0 to the NPM registry.
• Updated release build workflows to dynamic Go toolchain resolution (go-version-file: 'go.mod').
• Grouped monthly Dependabot dependency updates and hardened Dockerfile build stages.