Skip to content

kit 1.18.0

Choose a tag to compare

View all tags
@sandstream sandstream released this 24 Jul 22:22
v1.18.0
d550532
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Agent / MCP / hook auditing (kit agent-audit). A kit-native baseline over the coding-agent supply-chain surface: scans agent/MCP configs (.claude.json, .mcp.json, .cursor/mcp.json, .vscode/mcp.json, .claude/settings*.json) for plaintext secrets (reuses findSecrets — the .claude.json sk_live leak class) and cleartext http:// MCP servers, and git hooks (.git/hooks, .githooks, .husky) for malware-shaped lines (pipe-to-shell, base64-decode-to-shell, /dev/tcp reverse shell, eval of a command substitution). Pure analyzers fixture-tested; read-only, fail-open per file. (#47)

Full changelog: https://github.com/sandstream/kit/blob/v1.18.0/CHANGELOG.md

Verify this release:

git tag -v v1.18.0
npm audit signatures
Assets 4
Loading