Skip to content

v2.6.0

Choose a tag to compare

View all tags
@Synvoya Synvoya released this 22 Aug 10:35
· 3 commits to master since this release
v2.6.0
This tag was signed with the committer’s verified signature.
Synvoya Synvoya
SSH Key Fingerprint: k+H95W+vdF3kckXYqNA2BuQN2CTW0V1iKiihoKcbKGA
Verified
Learn about vigilant mode.
fdfddda
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CodeInspectus 2.6.0 makes complete local scanning easier for nontechnical users without weakening the project's consent, integrity, or zero-egress boundaries.

What’s new

  • Guided first-use setup. Interactive npx codeinspectus and codeinspectus setup explain what each external engine checks, its license, its current state, and the exact platform-specific download size before asking for approval.
  • MCP-native setup. MCP clients can use codeinspectus_setup to plan first, present the choices, and install only after explicit confirmation. Declined choices are remembered locally and can be reset.
  • Automatic verified Cosign bootstrap. When required and approved, CodeInspectus installs its pinned Cosign 3.1.2 verifier before validating Opengrep and Trivy publisher signatures.
  • No unnecessary downloads. Healthy engines and databases remain no-download no-ops. Missing or incompatible components are reported explicitly.
  • Safer engine runtime state. Opengrep caches and transient files remain under CodeInspectus-managed paths, and unsupported runtime combinations are blocked before download.
  • Direct-file Supabase fix. Scanning an individual file no longer misreports project-level Supabase Edge analysis as an unreadable-directory failure.

Boundaries retained

  • npm installation has no executable-downloading lifecycle script.
  • Engine downloads require explicit approval and are installed only under ~/.codeinspectus.
  • Scans remain local and offline.
  • Opengrep, Gitleaks, Trivy, and Cosign remain separately licensed upstream tools and are not bundled in the npm package.
  • Node.js 22 or later is required.

The detection catalog remains 94 curated rules. The aggregate native engine is now 5.20.0, while the package, CLI, SDK, MCP server, and Registry manifest are synchronized at 2.6.0.

See the full changelog for details.

Assets 2
Loading