v4.0.0

sinewaveai/agent-security-scanner-mcpv4.0.0Mar 21, 2026by sinewaveai

AI Summary

A major release renaming the package to `prooflayer-agent-security` and introducing a new LLM-powered code review agent based on intent profiling.

Key Highlights

  • Package renamed from `agent-security-scanner-mcp` to `prooflayer-agent-security`
  • New LLM-powered code review agent with intent profiling
  • Support for 3 output formats (terminal, JSON, SARIF)
  • Dynamic chunking for large files

Breaking Changes

  • Package renamed from `agent-security-scanner-mcp` to `prooflayer-agent-security`

New Features

  • Intent profiling for semantic security analysis
  • LLM-powered semantic code review
  • Prompt injection defense in system prompts
  • Claude CLI support (no API key required)

Full Release Notes

## 🚀 Major Release: Package Renamed & LLM-Powered Code Review

**Package renamed:** `agent-security-scanner-mcp` → `prooflayer-agent-security`

> The old package name continues to work for backwards compatibility.

### What's New

#### 🤖 LLM-Powered Code Review Agent

New `code-review-agent/` module for semantic security analysis using **intent profiling** to distinguish safe patterns from dangerous ones based on project context.

**The key differentiator:** Same code, different verdicts:

| Pattern | Build Tool | E-Commerce App |
|---------|------------|----------------|
| `subprocess.run()` with hardcoded commands | ✅ Expected | ⚠️ Suspicious |
| `eval(req.query.filter)` | ⚠️ Suspicious | ❌ Dangerous |
| `os.remove()` | ✅ Expected for file organizer | ❌ Dangerous for auth service |

#### Features

- **Intent Profiling** — Reads README, dependencies, and structure to understand project purpose
- **3 LLM Providers** — Anthropic API, OpenAI API, Claude CLI (no API key needed!)
- **3 Output Formats** — Colored terminal text, JSON, SARIF 2.1.0
- **Dynamic Chunking** — Large files split based on token budget, not hardcoded line limits
- **Prompt Injection Defense** — System prompts mark repo content as untrusted
- **58 tests**, 17 source files, 4 test fixture projects

### Quick Start

```bash
# Install
npm install -g prooflayer-agent-security

# Initialize for Claude Code
npx prooflayer-agent-security init claude-code

# Use LLM-powered code review (no API key needed!)
cd code-review-agent
npm install && npm run build
npx tsx bin/cr-agent.ts analyze ../path/to/project -p claude-cli -v
```

### Migration Guide

**No action required** — the old package name `agent-security-scanner-mcp` continues to work:

```bash
# Both work:
npx prooflayer-agent-security init claude-code
npx agent-security-scanner-mcp init claude-code
```

### Full Changelog

- **BREAKING:** Package renamed from `agent-security-scanner-mcp` to `prooflayer-agent-security`
- **feat:** Add LLM-powered semantic code review agent with intent profiling
- **feat:** Include code-review-agent in npm package
- **docs:** Add comprehensive code-review-agent documentation to README
- **chore:** Update all CLI commands, hooks, and internal references