v3.5.0

Overview

Cybermes v3.5.0 introduces security hardening across all Model Context Protocol (MCP) tool handlers, non-destructive diagnostic tooling for specialized targets, core engine performance optimizations, and standardized operational playbooks.

Security Hardening (MCP Server)

• Target Slug Sanitization: Enforced sanitizeSlug() across all MCP tool handlers (tools_recon, tools_reports, tools_fuzz, tools_nuclei) using regex [^a-z0-9]+ normalization. Prevents directory traversal attacks via untrusted target_slug inputs.
• URI and Port Normalization: Resolved Windows file URI escaping (file:///) and default port resolution (80/443) across scope validators and headless PDF export routines.
• Stream Filter Deduplication: Added target slug sanitization and case-insensitive stream deduplication in pkg/stream.

Diagnostic Tooling (scripts/)

• scripts/audit_ai_gateway_config.py: Non-destructive diagnostic utility auditing AI and LLM gateways against OWASP GenAI Top 10 recommendations (CORS reflection checks, unauthenticated /api/v1/models catalog exposure, token propagation validation).
• scripts/audit_exam_state_machine.py: Examination and learning management system payload auditor detecting premature answer key disclosure (correct_answer, kunci_jawaban) and verifying server-side epoch timestamp integrity.
• scripts/audit_firmware_fs.py: Static analysis utility for extracted router filesystems (SquashFS/JFFS2) inspecting weak password hashes, exposed private keys, and unauthenticated daemon launch scripts in /etc/init.d/.
• scripts/setup_mcp.py: Fixed fallback JSONC comment parsing and decoupled Hermes CLI configuration from IDE MCP clients.

Core Performance Optimizations

• Secret Scanner (pkg/secrets): Replaced linear pattern evaluation with O(1) hash map lookups and enforced a file size cap to prevent memory spikes on large minified assets.
• Knowledge Search (pkg/search): Introduced an in-memory index cache and fast-path scoring routine, reducing offline search latency below 10ms.

Skills and Playbooks

• Added academic-platform-audit skill module covering OWASP WSTG business logic and state machine test cases.
• Added embedded-router-firmware-audit skill module implementing the 9-stage Firmware Security Testing Methodology (FSTM).
• Standardized ai-api-gateway-security around split-plane (Control Plane vs Data Plane) architecture.
• Sanitized operational references to RFC 2606 reserved domains (example.com, example.edu).
• Added wordlists/custom_basic.txt for baseline web reconnaissance.

Contributors and Merged Pull Requests

Validated and merged community contributions included in this release:

• @Anai-Guo in #41: Fixed missing import re dependency in the JSONC fallback parser for MCP setup.
• @avp9-nexus in #34 and #23: Hardened Docker build pipeline with pipefail and APT mirror retries, and enabled CI pipeline execution on dev.
• @sizoune in #20: Implemented target-specific PDF report filename formatting.
• Issue #21: Fixed finding severity regex extraction on markdown files in report aggregator.
• Issue #22: Clarified private vulnerability reporting links in security guidelines.

Distribution and Ecosystem

• Published cybermes-mcp@3.5.0 to the NPM registry.
• Updated release build workflows to dynamic Go toolchain resolution (go-version-file: 'go.mod').
• Grouped monthly Dependabot dependency updates and hardened Dockerfile build stages.

v3.4.2

Release v3.4.2: Non-destructive installer guards, smart uninstaller d…

v3.4.1: Interactive Prompt UI Hotfix & Terminal Lifecycle Engine

Overview

Cybermes v3.4.1 is a critical patch release for cybermes-mcp resolving interactive CLI installer UI rendering artifacts, off-by-one cursor jumping, duplicated client entries, ghosting text on terminal redraws, and cursor visibility resets across Windows Terminal, PowerShell, CMD, macOS, and Linux consoles.

---

🐛 Bug Fixes & Clarifications

1. Dynamic Frame Tracking Engine (npm/src/utils/prompt.js)

• Root Cause: Previously, promptCheckbox and promptRadio used hardcoded static line calculations (state.length + (subtitle ? 4 : 3) and options.length + 3), which overshot the prompt origin by +1 line on every keypress (off-by-one error).
• Fix: Replaced static line arithmetic with dynamic frame tracking (lastRenderedLineCount). The cursor now moves up by the exact rendered line count of the previous frame.

2. Universal Line Erasing (\x1b[2K\r)

• Root Cause: Redrawing lines without prior line-clearing left trailing characters from previous longer lines (e.g. Mode: NPX Command (npx -y cybermes-mcp)rmes MCP::).
• Fix: Implemented writeLine with ANSI sequence \x1b[2K\r to cleanly erase the full line before writing headers, subtitles, instructions, and client items.

3. Smart Path Truncation for Narrow Terminals

• Root Cause: Long configuration file paths (e.g., in VS Code extensions or AppData) exceeded terminal window width on narrow consoles (< 90 columns), triggering soft line-wrapping and desynchronizing cursor coordinates, which led to repeated printing of bottom items like Codex CLI.
• Fix: Added truncatePath with dynamic column width detection (process.stdout.columns) to cleanly abbreviate long paths (e.g. C:\Users\...\cline_mcp_settings.json) without line wraps.

4. Terminal Cursor Lifecycle & Safety Handlers

• Root Cause: The terminal blinking cursor remained active during interactive menus and left visual artifacts (| > [x]).
• Fix: Terminal cursor is now hidden (\x1b[?25l) on prompt initialization and restored (\x1b[?25h) upon completion, cancellation (Ctrl+C), and process exit hooks.

5. Automated Regression Test Suite (Test 13)

• Added comprehensive unit tests in npm/test.js covering path truncation, non-TTY execution fallbacks, and prompt calculations (13/13 test suites passing).

---

📦 Package Distribution

• NPM Package: Published cybermes-mcp@3.4.1 to npm registry.
• Run Immediately:

  npx -y cybermes-mcp@latest install

v3.4.0

Cybermes v3.4.0 Release

Core Features & Updates:
- Native PDF & HTML Report Generator: Added headless Chromium CDP integration and cybermes_generate_pdf tool.
- Modular NPM CLI Suite: Refactored cybermes-mcp into zero-dependency modules (doctor, status, tools, skills, config, help, install).
- Selective Global & NPX Installer: Added interactive radio execution mode selector and multi-select client checklist.
- Terminal UI Engine: Added Truecolor 24-bit RGB gradient banner and high-signal diagnostic status matrices.
- Test Coverage: Expanded test suites to 12 comprehensive unit and regression tests with 100% pass rate.

v3.3.0: Endpoint Fuzzing, Dual-Engine Subdomain Discovery, Stream Filtering & MCP Prompts

Overview

Cybermes v3.3.0 introduces native endpoint and parameter fuzzing, dual-engine subdomain discovery, token-optimized stream filtering, MCP resources and workflow prompts, and AI prompt injection assessment playbooks.

---

What's New

1. Endpoint & Parameter Fuzzing (cybermes_fuzz_endpoints)

• High-performance, rate-controlled HTTP fuzzer implemented in Go.
• Configurable concurrency, rate limiting, and HTTP status code filtering (-mc).
• Automatic fallback worker pool and built-in wordlist path resolution.

2. Dual-Engine Subdomain Discovery (cybermes_discover_subdomains)

• Multi-tiered subdomain enumeration engine.
• Leverages native DNS/certificate inspection with automated fallback to external binaries (subfinder).
• Output cleaning and deduplication pipeline.

3. Stream Filtering & Token Budgeting (cybermes_filter_stream)

• Stream output processor to prevent dumping large, low-signal outputs into LLM context windows.
• Line cleaning, entropy calculation, and signal-to-noise scoring.

4. MCP Static Resources & Workflow Prompts

• Static resources API exposing internal guidelines, directives, and configuration schemas.
• Pre-defined MCP prompt templates for end-to-end security assessment workflows.

5. Authenticated Probing & Crawling

• Probing (pkg/probe) and crawling (pkg/crawl) engines now support custom authentication headers and session cookies.

6. AI Prompt Injection Playbooks

• Added structured testing playbooks and prompt execution guidelines for auditing LLM applications and AI agents.

---

Multi-Client Support & NPM

• Published cybermes-mcp@3.3.0 to the NPM registry.
• Auto-installer updated to register and auto-approve new tools across supported clients (Claude Desktop, Cursor, OpenCode, Windsurf, Cline, Roo Code, etc.).

---

Verification & Testing

• 100% test pass rate across all Go unit test suites (pkg/crawl, pkg/fuzz, pkg/mcp, pkg/probe, pkg/subdomain, pkg/scope, pkg/secrets, pkg/stream).
• All 7 NPM CLI test suites verified.

v3.2.0: Dynamic Workspace Auto-Discovery, Smart Synonym Search & Build Automation

🚀 What's New in Cybermes v3.2.0

1. 🔍 Dynamic Multi-Tiered Workspace Auto-Discovery

• Enhanced FindProjectRoot across the MCP Server and Go toolchain with multi-tiered resolution (CLI parameter, environment variables CYBERMES_ROOT, binary location os.Executable(), and CWD parent traversal).
• Zero configuration required: Works seamlessly across all AI clients (Google Antigravity / Gemini, Cursor, Claude Desktop, Windsurf, Cline, Roo Code, Kilo, Zed) on Windows, macOS, Linux, and Docker.

2. 🧠 Smart Security Synonym & Acronym Keyword Expansion

• Added in-memory offensive security acronym mapping (synonymMap) covering IDOR/BOLA, SQLi, XSS, RCE, SSRF, JWT, CSRF, LFI, and CORS.
• Shorthand queries like 'IDOR' now instantly match and rank 'Insecure Direct Object References' documentation and playbooks.

3. 🔨 Unified Cross-Platform Build Utility

• Added 1-click build script (go run scripts/build_tools.go) to compile all 5 Go tools (smart_pipe, secret_scan, search_knowledge, �ggregate_reports, cybermes-mcp) directly into ools/bin/.

4. 🛡️ Enhanced MCP & Antivirus Documentation

• Updated docs/MCP_SETUP.md with comprehensive installer commands and Windows Defender exclusion guidance for security research environments.

---

🧪 Test Suite & Quality Assurance

• Go Unit Tests: 100% PASS across all 8 packages.
• NPM Package Tests: 6/6 test suites passed.

Full Changelog: v3.1.2...v3.2.0

v3.1.2: URL-Safe JSON/JSONC Parser & Cross-Platform Config Fix

🚀 What's New in v3.1.2

• 🛡️ URL-Safe JSON/JSONC Parser: Fixed regex comment stripper in \cybermes-mcp\ and \setup_mcp.py\ to preserve URLs (e.g. \https://...) within JSON string literals, resolving \Bad control character in string literal\ syntax errors across OpenCode Interpreter and Claude Code CLI.
• ⚡ Fast-Path Native Parsing: Config files are now parsed via native \JSON.parse\ first, falling back to quote-aware comment stripping for JSONC only when necessary.
• 🧪 Comprehensive Test Coverage: Added regression tests verifying URL preservation, multi-line/single-line comments, and trailing commas.
• 📦 Multi-Platform Binaries: Precompiled multi-architecture standalone binaries for Windows (\�md64), Linux (\�md64, \�rm64), and macOS (\�md64, \�rm64).

v3.1.1

fix(mcp): resolve binary directory path check, add JSONC support and …

v3.1.0: Provider Routing Flags, Local Optimizer & CI/CD Automation

Cybermes v3.1.0 Release Notes

Cybermes v3.1.0 expands the Model Context Protocol (MCP) toolchain with direct provider routing flags, a zero-latency global execution mode, interactive cross-platform local management tooling, on-demand vulnerability diagnostic tools, and automated regression test suites.

---

Key Changes & Technical Improvements

1. Provider-Specific CLI Injection Flags

Added direct provider flags to cybermes-mcp CLI for targeted configuration without manual JSON editing or long argument strings:

• --gemini, --antigravity: Targets Google Antigravity / Gemini configuration (~/.gemini/config/mcp_config.json).
• --kilo, --kilo-code: Targets Kilo Code configuration (~/.kilo/mcp.json).
• --cursor: Targets Cursor configuration (~/.cursor/mcp.json).
• --claude, --claude-code: Targets Claude Desktop and Claude Code CLI.
• --windsurf, --cline, --roo, --opencode, --zed, --continue, --hermes, --codex.

2. Global Execution Mode (--global, -g)

Introduced --global flag during installer execution to configure clients to spawn cybermes-mcp directly from system $PATH, bypassing npx cold-start overhead and runtime package resolution.

3. Native Security Toolchain Expansions (pkg/mcp)

• cybermes_nuclei_scan: Added on-demand Nuclei scanner integration with rate-limiting constraints and missing-dependency handling.
• cybermes_check_environment: Added runtime toolchain and package manager discovery for security binaries.
• cybermes_record_evidence: Structured reconnaissance and negative testing evidence logger adhering to target workspace layout.

4. Cross-Platform Local MCP Manager (scripts/mcp.py)

• Python standard library utility (zero external dependencies) supporting:
  • Live stdio JSON-RPC latency probing and handshake diagnostics.
  • Server ON/OFF toggling to conserve RAM and LLM context token consumption.
  • Startup optimization via global package pre-caching.
  • Snapshot backup and rollback engine (.bak-YYYYMMDD-HHMMSS).
• Added platform wrappers: mcp.bat (Windows CMD), mcp.ps1 (PowerShell), and mcp.sh (POSIX Bash).

5. Automated CI/CD & Regression Testing

• Added npm/test.js covering CLI syntax, client discovery matrix, provider flag resolution, global configuration generation, and isolated temp sandbox injection.
• Integrated Node.js test validation into GitHub Actions workflow pipelines.

---

Pre-compiled Binaries & Integrity Checksums

Asset	SHA-256 Checksum
cybermes-mcp-v3.1.0-darwin-amd64	e24111363f655d67d45e44b520d0edc4dd8847bfe40eb35cf8e09eeeefa40473
cybermes-mcp-v3.1.0-darwin-arm64	e11f0834a8049108dd6e3ab4aaa997a13de07bd0a7858ee84bb336fee3758698
cybermes-mcp-v3.1.0-linux-amd64	f27d4ab3feb25571806acd863cc75730622f1d636c7d6314176fe04bb988cd1e
cybermes-mcp-v3.1.0-linux-arm64	b9c7d4b4d6a0786682ed88d901e3daf9b2656e10fb7ae3cc4fcb9578502827f5
cybermes-mcp-v3.1.0-windows-amd64.exe	6bfd4920402fc65d1f59667f57a41555940a9c919be9d6cd5271b44bb21a9bf2

---

Usage

# Universal auto-install for all detected clients:
npx -y cybermes-mcp install

# Target specific clients:
npx -y cybermes-mcp install --gemini --cursor
npx -y cybermes-mcp install --kilo

# Configure with global binary execution:
npm install -g cybermes-mcp
cybermes-mcp install --global

# Local manager diagnostics:
python scripts/mcp.py status

v3.0.0: Go-Native MCP Server, Scope Guard, SPA Crawler & Zero-Go NPX Distribution

🛡️ Cybermes Engine v3.0.0 Release Notes

Cybermes v3.0.0 introduces a ground-up paradigm shift with a standalone Go-native Model Context Protocol (MCP) Server, Zero-Go NPX Distribution, Universal Multi-Client Auto-Injector, and high-performance reconnaissance engines (Scope Guard, Dual-Engine HTTP Prober, and SPA Crawler).

---

🚀 Major Highlights & Features

1. Native Model Context Protocol (MCP) Server (pkg/mcp & cmd/cybermes-mcp)

   • High-throughput Go-native MCP server running over standard stdio JSON-RPC.
   • 10 Core Security Tools:
     • cybermes_search_knowledge: Sub-50ms offline wiki, playbook & payload queries.
     • cybermes_list_skills & cybermes_get_skill: Direct offensive playbook catalog access.
     • cybermes_scan_secrets: 48-pattern credential discovery engine with concurrency.
     • cybermes_validate_scope: Strict target validation against defined scope boundaries.
     • cybermes_http_probe: Native dual-engine TLS & HTTP technology fingerprinting.
     • cybermes_recon_crawl: Single-page app (SPA) endpoint miner.
     • cybermes_record_finding, cybermes_aggregate_report, cybermes_list_findings: Structured deliverables orchestration.
   • MCP Resources: Direct access to playbook SOPs (skills://), reports (reports://), and target scope.
   • Curated Prompts: cybermes_hunt, cybermes_triage.

2. Universal Multi-Client Auto-Injector (scripts/setup_mcp.py & npx -y cybermes-mcp install)

   • Automated 1-click configuration injector supporting Cursor, Claude Desktop, Windsurf, OpenCode, VS Code / Cline, Roo Code, Claude Code CLI, Continue.dev, Zed, Kilo Code, Hermes, and Codex.
   • Atomic file writes, timestamped backups (.bak), and cross-platform path normalization.

3. Official NPM Package & Zero-Go NPX Launcher (cybermes-mcp)

   • Official package live on NPM: 👉 https://www.npmjs.com/package/cybermes-mcp
   • Instant execution with npx -y cybermes-mcp or npx -y cybermes-mcp install.
   • Smart platform-aware release binary downloader with SHA-256 integrity verification.

4. Scope Guard Engine (pkg/scope)

   • Boundary enforcement supporting wildcard domain rules (*.target.com), exact hosts, and IPv4/IPv6 CIDR subnets.

5. Dual-Engine HTTP Inspector (pkg/probe)

   • High-speed web prober with TLS cipher analysis and 250+ technology signatures.

6. SPA Endpoint Crawler (pkg/crawl)

   • JavaScript/SPA-aware endpoint extractor with Smart Pipe token budgeting.

---

📦 Pre-compiled Binaries & Integrity Checksums

Asset	SHA-256 Checksum
cybermes-mcp-v3.0.0-darwin-amd64	9218df7bd94cff77515c6361fc4c5263142978ce9a2ccae63b90dc49da4dc3fa
cybermes-mcp-v3.0.0-darwin-arm64	2c7dc678a08cc0e23797df76ae07dd4c95242429fc80f6ad99905f2989e46bb8
cybermes-mcp-v3.0.0-linux-amd64	1a253ae206643ac971cb70ea4dda66a97e233f91f1bb91ec98b040dd05870c4f
cybermes-mcp-v3.0.0-linux-arm64	339a238d4a311cea0cf82b6a1b75a700152616dac1dbdea0fc993d8f69d7031d
cybermes-mcp-v3.0.0-windows-amd64.exe	7b048ddad39e19dca45031feb2e786d2bdab77e2c91cc3a25ba46645a12b6b3a

---

⚡ Quickstart

# 1-Click NPX Auto-Injector for all AI IDEs:
npx -y cybermes-mcp install

# Check status of configured AI clients:
npx -y cybermes-mcp status

# Or run MCP server directly over stdio:
npx -y cybermes-mcp