v0.11.0 - Agents

The "Agents" release: your coding agent can now ask CodeDiag which API routes anyone can call, through an MCP server, an Agent Skill, or a Claude Code plugin.

/plugin install codediag --marketplace sabahattink/codediag

Highlights

• MCP server — codediag mcp: three read-only tools for any MCP client.

  • find_unprotected_routes: routes, form actions, and procedures with no recognizable auth check or input validation. Always offline.
  • scan_project: the 0–100 score and findings, most severe first. The dependency audit runs only when you ask for it.
  • explain_rule: what a rule detects and how to suppress it.

  Results are structured and schema-checked. The server adds no runtime dependencies, and a test runs it against the official MCP SDK client.

• Claude Code plugin: one install adds the server and a skill.

• Agent Skill: npx skills add sabahattink/codediag. It tells any agent where each framework runs auth, and to check a finding before calling a route vulnerable.

• MCP Registry: listed as io.github.sabahattink/codediag.

Setup for Claude Code, Cursor, VS Code, and Claude Desktop is in the AI agents guide. The changelog has the details.