compliance-scanner-agent

7 Commits

Include renames

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	54cf39383c	feat(oscal): emit unmapped findings as-is + MCP oscal_assessment tool CI / Check (push) Skipped CI / Check (pull_request) Successful in 5m50s Details CI / Detect Changes (pull_request) Skipped Details CI / Deploy Agent (pull_request) Skipped Details CI / Deploy Dashboard (pull_request) Skipped Details CI / Deploy Docs (pull_request) Skipped Details CI / Deploy MCP (pull_request) Skipped Details The OSCAL emitter now reports EVERY non-false-positive finding: mapped findings (via their stamped control_refs) target their controls; UNMAPPED findings are emitted as standalone observations, reported as-is (cwe/tool/severity props) so nothing is lost — they can be mapped later as the LUT / master-controls grow. assess() keys off Finding.control_refs now, not the CWE linker. New compliance-mcp `oscal_assessment` tool serves this OSCAL over MCP — what breakpilot's scanner_mcp_client pulls. Assess endpoint simplified to match. Emitter tests cover mapped / unmapped-as-is / false-positive-excluded. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 11:33:09 +02:00
sharang	a3a96fe2cc	feat(m7.3): MCP tenant-scoped bearer tokens (#92 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 5s Details CI / Deploy Agent (push) Successful in 8m13s Details CI / Deploy Dashboard (push) Successful in 7m3s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Successful in 1m50s Details MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.	2026-06-30 15:27:21 +00:00
sharang Sharang Parnerkar Sharang Parnerkar	745ad8a441	fix: check Gitea API response status and fallback for PR reviews (#47 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Successful in 2s Details CI / Deploy Dashboard (push) Successful in 2s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Successful in 2s Details ## Summary - Add HTTP response status checking to all Gitea tracker methods that were silently swallowing errors - Add fallback in create_pr_review: if inline comments fail, retry as plain PR comment ## Test plan - [ ] Deploy and trigger a PR review, check logs for actual error details - [ ] Verify fallback posts summary comment when inline comments fail Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #47	2026-03-25 16:26:09 +00:00
sharang	3bb690e5bb	refactor: modularize codebase and add 404 unit tests (#13 ) CI / Format (push) Successful in 4s Details CI / Clippy (push) Successful in 4m19s Details CI / Detect Changes (push) Successful in 5s Details CI / Tests (push) Successful in 5m15s Details CI / Deploy Agent (push) Successful in 2s Details CI / Deploy Dashboard (push) Successful in 2s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Successful in 2s Details CI / Security Audit (push) Successful in 1m44s Details	2026-03-13 08:03:45 +00:00
sharang	acc5b86aa4	feat: AI-driven automated penetration testing (#12 ) CI / Clippy (push) Failing after 1m51s Details CI / Security Audit (push) Successful in 2m1s Details CI / Tests (push) Has been skipped Details CI / Detect Changes (push) Has been skipped Details CI / Deploy Agent (push) Has been skipped Details CI / Deploy Dashboard (push) Has been skipped Details CI / Deploy Docs (push) Has been skipped Details CI / Format (push) Failing after 42s Details CI / Deploy MCP (push) Has been skipped Details	2026-03-12 14:42:54 +00:00
sharang	46bf9de549	feat: findings refinement, new scanners, and deployment tooling (#6 ) CI / Format (push) Successful in 3s Details CI / Clippy (push) Successful in 4m3s Details CI / Tests (push) Successful in 4m44s Details CI / Detect Changes (push) Successful in 2s Details CI / Deploy Agent (push) Successful in 2s Details CI / Deploy Dashboard (push) Successful in 2s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Failing after 2s Details CI / Security Audit (push) Successful in 1m38s Details	2026-03-09 12:53:12 +00:00
sharangandSharang Parnerkar	32e5fc21e7	feat: add MCP server for exposing compliance data to LLMs (#5 ) CI / Format (push) Successful in 3s Details CI / Clippy (push) Successful in 4m4s Details CI / Security Audit (push) Successful in 1m42s Details CI / Tests (push) Successful in 4m38s Details CI / Deploy Agent (push) Successful in 2s Details CI / Deploy Dashboard (push) Successful in 1s Details CI / Deploy MCP (push) Failing after 2s Details CI / Detect Changes (push) Successful in 7s Details CI / Deploy Docs (push) Successful in 2s Details New `compliance-mcp` crate providing a Model Context Protocol server with 7 tools: list/get/summarize findings, list SBOM packages, SBOM vulnerability report, list DAST findings, and DAST scan summary. Supports stdio (local dev) and Streamable HTTP (deployment via MCP_PORT). Includes Dockerfile, CI clippy check, and Coolify deploy job. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #5	2026-03-09 08:21:04 +00:00