v1.2.1 — Developer Experience & CI Integration

What's New

Inline Suppression

• # guardianshield:ignore[rule1,rule2] comments to suppress specific findings
• Supports Python (#), JS/TS (//), and C-style (/* */) comment syntax
• Suppressed findings retain metadata["suppressed"] = True for auditability

Baseline Scanning (2 new MCP tools)

• save_baseline — snapshot current findings as a JSON baseline
• scan_with_baseline — scan and report only new findings not in baseline
• Uses SHA-256 fingerprinting consistent with dedup tracking

CI Quality Gates (1 new MCP tool)

• check_quality_gate — pass/fail/warn verdicts based on severity thresholds
• Configurable fail_on, warn_on, max_findings thresholds
• Exit codes: 0 (pass), 1 (fail), 2 (error)

Bulk APIs (2 new MCP tools)

• scan_files — scan multiple files in a single call
• scan_diff — parse unified diffs (git diff), scan only added lines

Stats

• 27 MCP tools (was 22)
• 1883 tests (was 1707)
• Zero dependencies (stdlib only)

Install / Upgrade

pip install --upgrade guardianshield

Full Changelog: v1.2.0...v1.2.1

v1.2.0 — SARIF 2.1.0 Export

What's New

SARIF 2.1.0 Export

GuardianShield findings can now be exported as SARIF 2.1.0 JSON — the standard format for static analysis results used by GitHub Code Scanning, VS Code SARIF Viewer, and CI pipelines.

• New MCP tool: export_sarif — scan code and return SARIF JSON in one call
• New Python API: findings_to_sarif() and findings_to_sarif_json() for programmatic use
• Compatible with gh code-scanning upload-sarif for GitHub Advanced Security integration
• Includes partialFingerprints for cross-commit finding tracking
• CWE taxonomies with rule relationships and security-severity scoring

Quick Start

from guardianshield import GuardianShield
from guardianshield.sarif import findings_to_sarif_json

shield = GuardianShield()
findings = shield.scan_code(code, file_path="app.py", language="python")
sarif = findings_to_sarif_json(findings, base_path="/project")

# Upload to GitHub Code Scanning:
# gh code-scanning upload-sarif --sarif=results.sarif

Stats

Metric	v1.1.1	v1.2.0
MCP Tools	21	22
Tests	1627	1707
Dependencies	0	0

Full Changelog: v1.1.1...v1.2.0

v1.1.1 — Docs, Triage Prompts & Roadmap

What's New

Documentation & Roadmap Release — No code behavior changes from v1.1.0.

Documentation

• Full docs for SemanticEngine, result pipeline, and CWE-specific triage prompts in the docs site (api.md, architecture.md, mcp-server.md, faq.md)
• triage-finding prompt added to server-card.json
• Fixed stale references across 10+ files (test counts, prompt counts, engine counts)

ROADMAP

• Complete rewrite as phased vision document (v1.2–v1.5)
• Incorporates strategic feedback from Gemini CLI + Codex CLI reviews

CHANGELOG

• Added v1.1.0 and v1.1.1 entries

Housekeeping

• AI instruction files (CLAUDE.md, AGENTS.md) removed from version control

Full Changelog: v1.1.0...v1.1.1

v1.1.0 — DeepEngine & Stable Release

What's New

DeepEngine — Cross-Line Data Flow Analysis

• Taint tracking from untrusted sources to dangerous sinks across multiple lines and function boundaries
• 5-phase analysis: assignment extraction, source identification, scope-aware propagation, sink detection, finding conversion
• Python: AST-based analysis with 19 source patterns and 12 sink patterns
• JavaScript/TypeScript: Regex-based analysis with 10 source patterns and 10 sink patterns
• Zero dependencies maintained — uses stdlib ast for Python, regex for JS/TS
• Confidence scoring: 0.70–0.90 based on taint kind and chain length
• Registered as deep engine alongside regex; enable with set_engine(engines=["regex", "deep"])

Documentation

• Full DeepEngine coverage across all doc pages: architecture, API reference, MCP server, landing page, getting started, and FAQ
• New comparison table row: Cross-line Analysis (17 categories)
• Test badge updated: 1463 passing

Version

• Promoted from 1.1.0b1 (beta) to 1.1.0 (stable)
• PyPI classifier: Production/Stable

Stats

• 21 MCP tools
• 108+ detection patterns across 7 languages
• 2 analysis engines (regex + deep)
• 1463 tests passing
• 0 dependencies

Install / Upgrade

pip install --upgrade guardianshield

Full Changelog: v1.1.0b1...v1.1.0

v1.1.0-beta.1

GuardianShield v1.1.0-beta.1

First beta release of the v1.1 series. Introduces the multi-engine analysis pipeline and several reliability improvements.

New Features

• Multi-Engine Analysis Pipeline — Pluggable AnalysisEngine protocol with RegexEngine wrapper and EngineRegistry
• 2 new MCP tools: list_engines and set_engine for runtime engine management
• scan_code engine override — Pass engines=["regex"] to select specific engines per scan

Bug Fixes & Hardening

• Graceful audit degradation — Scans succeed even when SQLite audit DB is unwritable
• scan_dependencies race condition — Eliminated fragile get_audit_log(limit=1) round-trip
• Richer MCP error responses — Error messages now include [ExceptionType] details
• Docs parameter fixes — Corrected set_profile param name, removed non-existent min_severity

Stats

• 21 MCP tools (up from 19)
• 1396 tests passing
• 108+ detection patterns across 7 languages
• Zero external dependencies

Install

pip install guardianshield==1.1.0b1

Full Changelog

v1.0.2...v1.1.0b1

v1.0.2

Bug Fixes

• CVSS vector parsing: OSV API returns CVSS vector strings, not numeric scores — all vulnerabilities were incorrectly mapped to LOW severity
• Stale version in status(): core.py hardcoded "0.2.0" instead of using __version__
• Double audit logging: scan_dependencies_in_directory logged twice
• Silent file/manifest skipping: Added logging for files and manifests skipped during directory scans
• Notification callback errors: Wrapped MCP notification callbacks to prevent scan aborts on broken pipes
• Overly broad exception handling: Narrowed bare except Exception blocks in osv.py and manifest.py

Added

• MCP registry ownership tag (mcp-name) in README for Official MCP Registry validation
• dependencies and directory_dependencies to audit_log scan_type enum

Full Changelog: v1.0.1...v1.0.2

v1.0.1

GuardianShield v1.0.1

Registry preparation and CI/CD for distribution across 8 channels.

What's New

Added

• CI workflow: Python 3.9/3.11/3.13 matrix with ruff linting and pytest
• PyPI publish workflow: Trusted publisher via OIDC on GitHub release
• Registry configs: smithery.yaml, glama.json, server.json, .well-known/mcp/server-card.json
• CHANGELOG.md: Full version history from v0.1.0 → v1.0.0 → v1.0.1
• Logo: 400×400 PNG for marketplace submissions

Changed

• README: Expanded tool table from 9→16, grouped by category, added badges, features section, and configuration reference
• Docs workflow: Copies .well-known into site output for MCP autodiscovery
• .gitignore: Excludes research/vision/critique files

Install

pip install guardianshield

Full Changelog

v1.0.0...v1.0.1

GuardianShield v1.0.0

GuardianShield v1.0.0 — Universal AI Security Layer

The first stable release of GuardianShield: a free, open-source MCP server that acts as a universal security layer for AI coding agents. Zero external dependencies, Python 3.9+.

What's New Since v0.2.0

Phase 1: Version-Aware CVE Matching

• PEP 440 + semver version parsing for accurate vulnerability range filtering
• OSV API pagination (next_page_token, max 10 pages per package)
• Confidence scoring: 1.0 (confirmed affected) vs 0.7 (indeterminate)
• Audit logging for all dependency scans via GuardianShield.check_dependencies()

Phase 2: Manifest Parsing & CVSS Improvements

• manifest.py module: parse requirements.txt, package.json, pyproject.toml
• parse_manifest MCP tool (15th tool): auto-detects format from filename
• CVSS v2/v3/v4 fallback: severity preference order v3 > v4 > v2
• Staleness-aware sync: is_stale() (24h TTL) before re-fetching from OSV.dev
• Rate limiting: 0.1s inter-package delay, exponential backoff on 429/5xx

Phase 3: Ecosystem Expansion

• 8 new parsers: package-lock.json, yarn.lock, pnpm-lock.yaml, Pipfile.lock, go.mod, go.sum, composer.json, composer.lock
• Go + Packagist ecosystems added (4 total: PyPI, npm, Go, Packagist)
• scan_dependencies MCP tool (16th tool): walks directories, finds manifests, scans all deps
• Deduplication: same package across multiple manifests counted once

Phase 4: Polish & Hardening

• MCP integration tests: TestParseManifest, TestDoubleInitialize, TestBrokenPipeError
• Connection management: BrokenPipeError handling for clean disconnect, SIGTERM graceful shutdown
• Documentation: all 9 doc pages synced to v1.0 with new tool sections
• Version bump: classifier → "Production/Stable", GitHub URLs corrected

By the Numbers

Metric	v0.2.0	v1.0.0
MCP Tools	14	16
Ecosystems	2 (PyPI, npm)	4 (+ Go, Packagist)
Manifest Formats	0	11
Tests	627	934
Dependencies	0	0

16 MCP Tools

Tool	Description
scan_code	Scan source code for vulnerabilities and hardcoded secrets
scan_file	Scan a single file (auto-detects language)
scan_directory	Recursively scan a directory with filtering and streaming
scan_input	Check input for prompt injection attempts
scan_output	Check AI output for PII leaks and content violations
check_secrets	Dedicated secret/credential detection
check_dependencies	Check packages for known CVEs (PyPI, npm, Go, Packagist)
sync_vulnerabilities	Sync the local OSV vulnerability database
parse_manifest	Parse any of 11 manifest formats into dependency objects
scan_dependencies	Scan a directory for manifests and check all deps for CVEs
test_pattern	Test a regex pattern against sample code
get_profile	View current safety profile
set_profile	Switch safety profiles (general/education/healthcare/finance/children)
audit_log	Query the security audit log
get_findings	Retrieve past findings with filters
shield_status	Get health, capabilities, and configuration

Quick Start

pip install guardianshield

Add to your MCP client config:

{
  "mcpServers": {
    "guardianshield": {
      "command": "guardianshield-mcp"
    }
  }
}

Links

• Documentation
• PyPI (coming soon)
• Issues