Skip to content

GuardianShield v1.0.0

Choose a tag to compare

View all tags
@sparkvibe-io sparkvibe-io released this 28 Feb 00:02
v1.0.0
7d438f8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GuardianShield v1.0.0 — Universal AI Security Layer

The first stable release of GuardianShield: a free, open-source MCP server that acts as a universal security layer for AI coding agents. Zero external dependencies, Python 3.9+.

What's New Since v0.2.0

Phase 1: Version-Aware CVE Matching

  • PEP 440 + semver version parsing for accurate vulnerability range filtering
  • OSV API pagination (next_page_token, max 10 pages per package)
  • Confidence scoring: 1.0 (confirmed affected) vs 0.7 (indeterminate)
  • Audit logging for all dependency scans via GuardianShield.check_dependencies()

Phase 2: Manifest Parsing & CVSS Improvements

  • manifest.py module: parse requirements.txt, package.json, pyproject.toml
  • parse_manifest MCP tool (15th tool): auto-detects format from filename
  • CVSS v2/v3/v4 fallback: severity preference order v3 > v4 > v2
  • Staleness-aware sync: is_stale() (24h TTL) before re-fetching from OSV.dev
  • Rate limiting: 0.1s inter-package delay, exponential backoff on 429/5xx

Phase 3: Ecosystem Expansion

  • 8 new parsers: package-lock.json, yarn.lock, pnpm-lock.yaml, Pipfile.lock, go.mod, go.sum, composer.json, composer.lock
  • Go + Packagist ecosystems added (4 total: PyPI, npm, Go, Packagist)
  • scan_dependencies MCP tool (16th tool): walks directories, finds manifests, scans all deps
  • Deduplication: same package across multiple manifests counted once

Phase 4: Polish & Hardening

  • MCP integration tests: TestParseManifest, TestDoubleInitialize, TestBrokenPipeError
  • Connection management: BrokenPipeError handling for clean disconnect, SIGTERM graceful shutdown
  • Documentation: all 9 doc pages synced to v1.0 with new tool sections
  • Version bump: classifier → "Production/Stable", GitHub URLs corrected

By the Numbers

Metric v0.2.0 v1.0.0
MCP Tools 14 16
Ecosystems 2 (PyPI, npm) 4 (+ Go, Packagist)
Manifest Formats 0 11
Tests 627 934
Dependencies 0 0

16 MCP Tools

Tool Description
scan_code Scan source code for vulnerabilities and hardcoded secrets
scan_file Scan a single file (auto-detects language)
scan_directory Recursively scan a directory with filtering and streaming
scan_input Check input for prompt injection attempts
scan_output Check AI output for PII leaks and content violations
check_secrets Dedicated secret/credential detection
check_dependencies Check packages for known CVEs (PyPI, npm, Go, Packagist)
sync_vulnerabilities Sync the local OSV vulnerability database
parse_manifest Parse any of 11 manifest formats into dependency objects
scan_dependencies Scan a directory for manifests and check all deps for CVEs
test_pattern Test a regex pattern against sample code
get_profile View current safety profile
set_profile Switch safety profiles (general/education/healthcare/finance/children)
audit_log Query the security audit log
get_findings Retrieve past findings with filters
shield_status Get health, capabilities, and configuration

Quick Start

pip install guardianshield

Add to your MCP client config:

{
  "mcpServers": {
    "guardianshield": {
      "command": "guardianshield-mcp"
    }
  }
}

Links

Assets 2
Loading