Skip to content

v3.20.0

Choose a tag to compare

View all tags
@sinewaveai sinewaveai released this 15 Mar 12:51
v3.20.0
4048a29

New Features

AIVSS v2 Scoring Engine

  • OWASP AI Vulnerability Scoring System implementation with per-finding scores (0-10)
  • Deterministic formula: AIVSS = (0.25 × Base) + (0.45 × AI-Specific) + (0.30 × Impact)
  • Heuristic auto-mapping from finding attributes (severity, category, confidence) to AIVSS metrics
  • Manual override support for authoritative scoring
  • Aggregate posture score with worst-case weighting

AIUC-1 Compliance Controls

  • 16 controls (9 security, 7 safety) from the AIUC-1 framework
  • Structured pass/partial/fail/not_evaluated evaluation per control
  • Evidence requirements linking to specific scanner tools
  • OWASP LLM Top 10 crosswalk for each control

New MCP Tools

  • score_aivss — Score findings using OWASP AIVSS v2
  • get_compliance_controls — Look up AIUC-1 compliance controls

Report CLI Extension

  • --threat-model --json flag produces AIVSS posture + compliance output
  • Threat model results saved to scan history for trend tracking

Finding Normalizer

  • Unifies 6 different tool output shapes into consistent internal format
  • Category inference from ruleId segments
  • Severity mapping and confidence normalization

Bug Fixes

  • Fixed path to test_ast_engine.py in CI workflow

Test Coverage

  • 79 new tests across 4 test files
  • 1404 total tests pass

Install

npm install -g agent-security-scanner-mcp@3.20.0

Usage

# JSON report with threat model
node index.js report <dir> --threat-model --json

# Score findings via MCP tool
# (accepts output from any scanner tool)

# Look up compliance controls via MCP tool
# (returns structured evaluation criteria)

See docs/threat-model.md for full documentation.

Assets 2
Loading