Security fork of [email protected] with the CWE-772 memory leak fixed: queued callbacks are no longer dropped when one throws, and the in-flight entry is always released. Version 2.x deliberately sits ABOVE upstream's highest published version (1.0.6) so SCA

A Common Weakness Enumeration (CWE) Node.js SDK compliant with MITRE / CAPEC

Local-first governed tool execution gateway for AI agents. Read/write classification, policy evaluation, signed execution receipts, multi-key rotation with cross-signed chain snapshots, per-capability rate limits, threshold-based escalation, file/webhook

This package implements common security checks. The checks can be used separatelly, or through a function called `useSecurity()`. This function returns an object with two functions:

Convert Sarif format to body text

Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking

A simple Node.js module that fetches and parses the latest Common Weakness Enumeration (CWE) list

Semgrep rules catching the OAuth, OIDC, JWT, and MCP security bugs that AI coding tools produce.

MCP (Model Context Protocol) server exposing fetch-cwe-list tools for LLM agents. Experimental/alpha — APIs may change.

Converts application/x-www-form-urlencoded keys to plain JS object

Clovnet plugin developer CLI — create, dev-loop (hot reload + live logs), lifecycle-test and publish plugins against a Clovnet runtime.

L2 introduction protocol — Briar-faithful intro crypto (X25519+HKDF+AEAD), JSON+Zod wire codec, and Signal-style safety numbers. Fixes CWE-208 timing oracle in sessionId redundancy check. EXPERIMENTAL (0.1.0).

Convert JSON output from `snyk test --json` into a static HTML report

SARIF SDK for Node.js: open-typed object model, region/snippet resolution, AI ruleId convention, and serialization helpers. Native TypeScript; no CLR dependency.

Pairwise X25519+HKDF+AEAD primitives, XChaCha20-Poly1305, PQXDH hybrid KEM, MessageEnvelope v2 codec (authenticated binding transcript), and timing-safe comparison helpers for oxpulse-chat.

A command line CWE discovery tool based on OWASP / CAPSEC database of Common Weakness Enumeration.

A Javascript library for generating and performing common operations on Linked Data cryptographic key pairs.

Scaffold a Clovnet plugin — thin alias for `clovnet-plugin create` (use via `pnpm create clovnet-plugin <name>`).

Angular security rules for TSLint

Security-focused negative API testing from one working cURL