Semgrep rules catching the OAuth, OIDC, JWT, and MCP security bugs that AI coding tools produce.

A Common Weakness Enumeration (CWE) Node.js SDK compliant with MITRE / CAPEC

AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.

AI-powered app test automation MCP server - scenario generation, execution, detection, and auto-fixing

Local-first governed tool execution gateway for AI agents. Read/write classification, policy evaluation, signed execution receipts, multi-key rotation with cross-signed chain snapshots, per-capability rate limits, threshold-based escalation, file/webhook

This package implements common security checks. The checks can be used separatelly, or through a function called `useSecurity()`. This function returns an object with two functions:

Autonomous DevSecOps AI Engine. Combines OWASP SAST and OSV SCA dependency scanning with AI reasoning to eliminate false positives.

Convert Sarif format to body text

Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking

A simple Node.js module that fetches and parses the latest Common Weakness Enumeration (CWE) list

MCP (Model Context Protocol) server exposing fetch-cwe-list tools for LLM agents. Experimental/alpha — APIs may change.

Converts application/x-www-form-urlencoded keys to plain JS object

Clovnet plugin developer CLI — create, dev-loop (hot reload + live logs), lifecycle-test and publish plugins against a Clovnet runtime.

L2 introduction protocol — Briar-faithful intro crypto (X25519+HKDF+AEAD), JSON+Zod wire codec, and Signal-style safety numbers. Fixes CWE-208 timing oracle in sessionId redundancy check. EXPERIMENTAL (0.1.0).

AegisQ-CodeShield security rules — OWASP Top 10, OWASP LLM Top 10, CISA Secure by Design, CWE mappings

SARIF SDK for Node.js: open-typed object model, region/snippet resolution, AI ruleId convention, and serialization helpers. Native TypeScript; no CLR dependency.

Convert JSON output from `snyk test --json` into a static HTML report

Pairwise X25519+HKDF+AEAD primitives, XChaCha20-Poly1305, PQXDH hybrid KEM, MessageEnvelope v2 codec (authenticated binding transcript), and timing-safe comparison helpers for oxpulse-chat.

Scaffold a Clovnet plugin — thin alias for `clovnet-plugin create` (use via `pnpm create clovnet-plugin <name>`).

A command line CWE discovery tool based on OWASP / CAPSEC database of Common Weakness Enumeration.