v4.1.0

sinewaveai/agent-security-scanner-mcpv4.1.0Mar 25, 2026by sinewaveai

AI Summary

Introduces a dedicated Security Analysis Mode for the cr-agent, utilizing specific LLM prompts and heuristic deduplication to reduce false positives.

Key Highlights

New '--mode security' for cr-agent
Dedicated security-focused LLM prompts
Carrier/sink deduplication using heuristic scoring
Cross-file security context summaries

New Features

Security Analysis Mode with sink localization
Post-filtering for non-security findings
Tiered guard recognition (strong/medium/weak)
Fixed multiple CLI and validation bugs

Full Release Notes

## What's New

### Security Analysis Mode for cr-agent (`--mode security`)

- **Dedicated security-focused LLM prompts** with sink localization instructions
- **Post-filtering** drops non-security findings unless they have CWE/OWASP mapping
- **Carrier/sink deduplication** using heuristic scoring (file path, language signals, CWE)
- **Tiered guard recognition** (strong/medium/weak) to reduce false positives on guarded code
- **Cross-file security context summaries** for better LLM analysis

### Usage

```bash
# Security-only mode — focused on exploitable vulnerabilities
npx cr-agent analyze ./path/to/project --mode security

# Shorthand
npx cr-agent analyze ./path/to/project --security-only

# SARIF output for CI (recommended with security mode)
npx cr-agent analyze ./path/to/project --format sarif --mode security
```

## Bug Fixes

- Fix crossFileDedup collapsing independent findings
- Fix Math.random() map key collision risk  
- Fix duplicate extractImports logic
- Fix double IO in context assembler
- Fix mode validation and fallback behavior
- Fix missing claude CLI flags (`-` stdin marker, `--no-session-persistence`)

## Tests

- 119 code-review-agent tests (30 new for postprocess, 11 for security-summary)
- 1404 total tests passing

---

**Full Changelog**: https://github.com/sinewaveai/agent-security-scanner-mcp/compare/v4.0.1...v4.1.0