Skip to content

v0.5.0 - Four taxonomy lenses, MCP tool-drift, cascade blast-radius, SARIF security-severity

Choose a tag to compare

View all tags
@evkir evkir released this 30 Jun 21:28
· 218 commits to main since this release
v0.5.0
f43e241

Highlights:

  • SARIF rules now emit GitHub security-severity, so findings rank in the
    code-scanning Security tab by the real ABFP anomaly score (band-anchored
    on textual severity; non-scored MCP checks take band midpoint).
  • Four taxonomy lenses live across every surface: ASI/CWE, STRIDE, MITRE
    ATLAS (verified technique IDs only).
  • MCP tool-descriptor drift detection: post-approval rug-pull + tool
    shadowing via baseline digest (mcp scan --tool-baseline).
  • Cascade blast-radius: predictive downstream contamination reach per
    rogue finding over the live topic graph (JSON/HTML/SARIF).
  • Legacy purge: ~440 statements / 10+ dead modules removed; single
    supported pipeline (abfp.scoring + report convert over core.finding).
  • CI now uploads coverage to Codecov.

Full Changelog: v0.4.0...v0.5.0

Assets 5
Loading