Skip to content

SecuLens 1.1.0 - Supply Chain Protection & Model Context Protocol (MCP) Server

Choose a tag to compare

View all tags
@masahiroid masahiroid released this 25 Oct 15:53
· 3 commits to main since this release
v1.1.0
836f976

What's Changed in SecuLens 1.1.0

🛡️ Supply Chain Threat Protection

  • Lifecycle Script Detection (SC-LIFECYCLE-SCRIPT): Scans package.json, package-lock.json, and composer.json for install scripts (preinstall, install, postinstall, etc.) to prevent arbitrary execution during dependency installation.
  • Supply-Chain AST Static Analysis: Detects hazardous patterns including dynamic process spawning (child_process / subprocess), environment variable enumeration (process.env, os.environ, $_ENV), and sensitive path references (~/.ssh, id_rsa, ~/.aws).

🤖 Model Context Protocol (MCP) stdio Server

  • Introduces seculens mcp command across TypeScript, Python, and PHP implementations with zero external dependencies.
  • Fully compatible with Claude Desktop, Cursor, Antigravity, and other AI agents.
  • Exposes tools: seculens_scan, seculens_analyze, seculens_check_license, and seculens_generate_report.

🔍 Lockfile Integrity & Cool-off Checks

  • Lockfile Integrity Verification: Flags hash mismatches between SBOM and lockfiles (SC-INTEGRITY-MISMATCH) and insecure HTTP resolution URLs (SC-INSECURE-REGISTRY-URL).
  • Release Age (Cool-off) Check (--cool-off): Flags packages released within a specified threshold (e.g. 7 days) to guard against zero-day compromised releases.
  • Transitive Dependency Depth: Automatically calculates and assigns depth levels to dependency components.

⚙️ Automation & Security

  • Added weekly Dependabot automated dependency update configuration.
  • Added GitHub Actions pull request dependency review workflow.
  • Reinforced .gitignore across all ecosystems.
Assets 2
Loading