🛡️ Scankii v1.3.0: Runtime Defense & Entropy Engine

🛡️ Scankii v1.3.0: Runtime Defense & Entropy Engine

This is a massive release that moves Scankii from being just a static analyzer (SAST) to a comprehensive AI agent security toolkit by introducing active runtime defense and eliminating AI-generated false positives.

🔥 Key Features

1. Runtime Security Layer (scankii.runtime)

We added drop-in components to protect agent workflows at execution time:

• @tool_guard: A decorator/context manager that intercepts agent tool-calls and scans arguments for credentials before execution. Supports three policies: block (prevent execution), redact (sanitize and continue), and warn.
• EnvIsolator: A context manager that strips long-lived credential variables from os.environ before spawning agent subprocesses to prevent secret inheritance.
• SafeLogger & safe_format_dict(): Helpers to redact credentials from agent logs and argument dictionaries automatically.

2. Entropy-Based False Positive Filter

AI coding assistants generate a lot of placeholder secrets (like sk-xxxx-placeholder). Naive scanners flag these, causing alert fatigue.

• Shannon Entropy Engine: Scankii now calculates the entropy of every detected string. Strings falling below 3.5 bits/char are automatically demoted to DEFER.
• Placeholder Allowlist: 70+ regex patterns added to automatically catch and ignore common LLM-generated placeholders.
• Findings now export a confidence percentage and is_likely_placeholder flag in JSON/SARIF.

3. Remediation Advisor

The CLI now automatically suggests provider-specific, short-lived token alternatives. For example, if an AWS long-lived IAM key is detected, it recommends (and links to docs for) switching to STS AssumeRole 1-hour session tokens.

4. CLI & CI/CD Polish

• --severity-threshold: Easily configure what severity level breaks your CI or pre-commit hook (e.g., --severity-threshold HIGH).
• --output: Explicitly set paths for JSON and SARIF reports.
• Configurable pre-commit hook via SCANKII_SEVERITY_THRESHOLD environment variable.

🧪 Tests & Stability

178 tests now passing, testing all three policies of @tool_guard, environment restoration safety in EnvIsolator, and cross-modal AST correlation.

Full Changelog: v1.2.3...v1.3.0