v4.1.0

tremorlabs/tremorv4.1.0Mar 25, 2026by sinewaveai

AI Summary

This release introduces a dedicated security analysis mode for the cr-agent, utilizing specialized LLM prompts and filtering mechanisms to identify vulnerabilities like CWEs and OWASP mappings.

Key Highlights

Security Analysis Mode with dedicated prompts and sink localization
Post-filtering to drop non-security findings
Carrier/sink deduplication using heuristic scoring
Tiered guard recognition to reduce false positives

New Features

Dedicated security-focused LLM prompts
Post-filtering drops non-security findings
Carrier/sink deduplication using heuristic scoring
Tiered guard recognition
Cross-file security context summaries

Full Release Notes

## What's New

### Security Analysis Mode for cr-agent (`--mode security`)

- **Dedicated security-focused LLM prompts** with sink localization instructions
- **Post-filtering** drops non-security findings unless they have CWE/OWASP mapping
- **Carrier/sink deduplication** using heuristic scoring (file path, language signals, CWE)
- **Tiered guard recognition** (strong/medium/weak) to reduce false positives on guarded code
- **Cross-file security context summaries** for better LLM analysis

### Usage

```bash
# Security-only mode — focused on exploitable vulnerabilities
npx cr-agent analyze ./path/to/project --mode security

# Shorthand
npx cr-agent analyze ./path/to/project --security-only

# SARIF output for CI (recommended with security mode)
npx cr-agent analyze ./path/to/project --format sarif --mode security
```

## Bug Fixes

- Fix crossFileDedup collapsing independent findings
- Fix Math.random() map key collision risk  
- Fix duplicate extractImports logic
- Fix double IO in context assembler
- Fix mode validation and fallback behavior
- Fix missing claude CLI flags (`-` stdin marker, `--no-session-persistence`)

## Tests

- 119 code-review-agent tests (30 new for postprocess, 11 for security-summary)
- 1404 total tests passing

---

**Full Changelog**: https://github.com/sinewaveai/agent-security-scanner-mcp/compare/v4.0.1...v4.1.0