# Changelog

All notable changes to the CodeSlick MCP Server will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.5.0] - 2026-03-21

### Added
- 17 MCP-specific behavioral security checks now active on the CodeSlick backend:
  - MCP-JS-011: Financial API call without authorization guard (Stripe, PayPal, Braintree, Square)
  - MCP-JS-012: System persistence write (.bashrc, .zshrc, cron, systemd, LaunchAgents)
  - MCP-JS-013: Unverifiable dependency execution (curl|bash, npm install URL, eval+fetch)
  - MCP-PY-005: Prompt injection via dynamic prompt construction (f-string, += into system_prompt)
  - MCP-PY-006: System persistence write — Python (open() to shell init files, subprocess crontab)
  - Plus 12 structural checks from v1.4.x (MCP-JS-001–010, MCP-PY-001–004)
- Total security checks: 323 (306 general + 17 MCP-specific)

### Notes
- Behavioral checks are scoped to MCP server files only (isMcpServer() gate)
- Zero false positives on standard non-MCP codebases
- 88 test cases across all 17 MCP checks

## [1.0.0] - 2026-02-05

### Added
- Initial release of CodeSlick MCP Server
- `analyze_code` tool - Comprehensive security analysis for 7 languages (JavaScript, TypeScript, Python, Java, Go, Terraform, Kubernetes)
- `scan_dependencies` tool - Placeholder for dependency vulnerability scanning (requires CLI JSON support)
- `generate_sbom` tool - Placeholder for SBOM generation (requires CLI JSON support)
- `detect_secrets` tool - Placeholder for secrets detection (requires CLI JSON support)
- Integration with CodeSlick CLI for security analysis
- OWASP 2025 compliance (95% coverage)
- CVSS 3.1 scoring (3.1-9.8 range)
- AI code detection with 150 signals
- Supports 248 security checks across multiple languages
- MIT License

### Documentation
- Comprehensive README.md with examples
- PUBLISHING_CHECKLIST.md for npm/marketplace submission
- MCP_SERVER_IMPLEMENTATION.md technical documentation

### Features
- **analyze_code**: ✅ Fully functional
  - 248 security checks
  - OWASP/CWE/PCI-DSS mappings
  - Detailed vulnerability reports
  - Remediation guidance

- **scan_dependencies**: ⚠️ Placeholder (awaiting CLI JSON support)
  - Will support npm, pip, Maven, Gradle, Go modules
  - Known CVE detection
  - Malicious package detection

- **generate_sbom**: ⚠️ Placeholder (awaiting CLI JSON support)
  - Will support SPDX 2.3 and CycloneDX 1.4
  - Component metadata
  - License information

- **detect_secrets**: ⚠️ Placeholder (awaiting CLI JSON support)
  - Will detect 38 secret patterns
  - API keys, passwords, tokens, certificates

## [Unreleased]

### Planned for v1.1.0
- Full implementation of `scan_dependencies` tool
- Full implementation of `generate_sbom` tool
- Full implementation of `detect_secrets` tool
- CLI JSON output support for all features
- Comprehensive integration tests

### Planned for v1.2.0
- `fix_code` tool for AI-powered automatic fixes
- `explain_vulnerability` tool for security education
- `bulk_analyze` tool for multi-file analysis
- `custom_rules` tool for user-defined security rules

---

[1.0.0]: https://github.com/VitorLourenco/codeslick2/releases/tag/mcp-server-v1.0.0