sbom-vulnerability-scanner

{ "name": "sbom-vulnerability-scanner", "displayName": "%ext.displayName%", "description": "%ext.description%", "version": "9.1.0", "publisher": "masahirocom", "author": "masahiroid", "private": false, "license": "Apache-2.0", "repository": { "type": "git", "url": "https://github.com/masahiroid/sbom-vulnerability-scanner.git" }, "bugs": { "url": "https://github.com/masahiroid/sbom-vulnerability-scanner/issues" }, "homepage": "https://github.com/masahiroid/sbom-vulnerability-scanner#readme", "l10n": "./l10n", "keywords": [ "sbom", "cyclonedx", "spdx", "vulnerability", "trivy", "npm-audit" ], "engines": { "vscode": "^1.90.0" }, "categories": [ "Other", "Testing" ], "icon": "media/icon.png", "main": "./dist/extension.js", "bin": { "sbom-scanner-mcp": "./bin/mcp-server.js" }, "files": [ "bin/", "extension.js", "lib/", "media/", "l10n/", "package.nls.json", "package.nls.ja.json", "README.md", "README.ja.md", "LICENSE*", "package.json", "CHANGELOG.md", "CONTRIBUTING.md", "dist/**", "docs/USER_GUIDE.ja.md", "docs/TROUBLESHOOTING.ja.md" ], "contributes": { "viewsContainers": { "activitybar": [ { "id": "sbomScanner", "title": "%viewContainer.title%", "icon": "media/sbom.svg" } ] }, "views": { "sbomScanner": [ { "id": "sbomScanner.dashboard", "name": "%view.dashboard.name%", "type": "webview", "icon": "media/sbom.svg" } ] }, "commands": [ { "command": "sbomScanner.generateSbom", "title": "%command.generateSbom%" }, { "command": "sbomScanner.scanVulnerabilities", "title": "%command.scanVulnerabilities%" }, { "command": "sbomScanner.generateAndScan", "title": "%command.generateAndScan%" }, { "command": "sbomScanner.checkCurrentProject", "title": "%command.checkCurrentProject%" }, { "command": "sbomScanner.setScanner", "title": "%command.setScanner%" }, { "command": "sbomScanner.setSbomGenerator", "title": "%command.setSbomGenerator%" }, { "command": "sbomScanner.setUiLanguage", "title": "%command.setUiLanguage%" }, { "command": "sbomScanner.setResultOpenMode", "title": "%command.setResultOpenMode%" }, { "command": "sbomScanner.installTools", "title": "%command.installTools%" }, { "command": "sbomScanner.openLatestSbomReport", "title": "%command.openLatestSbomReport%" }, { "command": "sbomScanner.openLatestSbomExplorer", "title": "%command.openLatestSbomExplorer%" }, { "command": "sbomScanner.openLatestSbomLens", "title": "%command.openLatestSbomLens%" }, { "command": "sbomScanner.openLatestVulnerabilityReport", "title": "%command.openLatestVulnerabilityReport%" }, { "command": "sbomScanner.openLatestSbomJson", "title": "%command.openLatestSbomJson%" }, { "command": "sbomScanner.openLatestVulnerabilityJson", "title": "%command.openLatestVulnerabilityJson%" }, { "command": "sbomScanner.openOutputDirectory", "title": "%command.openOutputDirectory%" }, { "command": "sbomScanner.cleanOldResults", "title": "%command.cleanOldResults%" }, { "command": "sbomScanner.exportDocxReport", "title": "%command.exportDocxReport%" }, { "command": "sbomScanner.showLogs", "title": "%command.showLogs%" }, { "command": "sbomScanner.openUserGuide", "title": "%command.openUserGuide%" }, { "command": "sbomScanner.generateReport", "title": "%command.generateReport%" }, { "command": "sbomScanner.repairTools", "title": "%command.repairTools%" }, { "command": "sbomScanner.openSbomDocuments", "title": "%command.openSbomDocuments%" } ], "menus": { "view/title": [ { "command": "sbomScanner.generateAndScan", "when": "view == sbomScanner.dashboard", "group": "navigation" }, { "command": "sbomScanner.checkCurrentProject", "when": "view == sbomScanner.dashboard", "group": "navigation" } ] }, "configuration": { "title": "%config.title%", "properties": { "sbomTool.outputDirectory": { "type": "string", "default": "SBOM-Reports", "description": "%config.outputDirectory.description%" }, "sbomTool.defaultSbomFormat": { "type": "string", "enum": [ "cyclonedx-json", "spdx" ], "default": "cyclonedx-json", "description": "%config.defaultSbomFormat.description%" }, "sbomTool.vulnerabilityScanner": { "type": "string", "enum": [ "auto", "trivy", "npm-audit" ], "default": "auto", "description": "%config.vulnerabilityScanner.description%" }, "sbomTool.sbomGenerator": { "type": "string", "enum": [ "auto", "syft", "trivy", "manifest" ], "default": "auto", "description": "%config.sbomGenerator.description%" }, "sbomTool.uiLanguage": { "type": "string", "enum": [ "auto", "en", "ja" ], "default": "auto", "description": "%config.uiLanguage.description%" }, "sbomTool.resultOpenMode": { "type": "string", "enum": [ "vscode", "external" ], "default": "vscode", "description": "%config.resultOpenMode.description%" }, "sbomTool.reportCustomer": { "type": "string", "default": "", "description": "%config.reportCustomer.description%" }, "sbomTool.reportAuthor": { "type": "string", "default": "", "description": "%config.reportAuthor.description%" } } }, "chatParticipants": [ { "id": "sbomScanner.chatParticipant", "name": "sbom", "fullName": "SBOM & Security Scanner", "description": "Scan software bills of materials (SBOM), prioritize vulnerabilities with EPSS & CISA KEV, evaluate security policies, and generate VEX statements.", "isSticky": true, "commands": [ { "name": "scan", "description": "Generate SBOM and scan current workspace for vulnerabilities" }, { "name": "triage", "description": "Prioritize high-risk vulnerabilities by EPSS exploit score and CISA KEV" }, { "name": "policy", "description": "Evaluate security and compliance policies (.sbom-policy.json)" }, { "name": "vex", "description": "Formulate OpenVEX / CycloneDX VEX statements for non-affected vulnerabilities" } ] } ], "languageModelTools": [ { "name": "sbom_scan_workspace", "displayName": "Scan Workspace SBOM", "modelDescription": "Scans the current software workspace to generate an SBOM, detect vulnerable packages, and evaluate exploit prediction scores (EPSS) and CISA KEV status.", "inputSchema": { "type": "object", "properties": {} } }, { "name": "sbom_evaluate_policy", "displayName": "Evaluate Security Policy", "modelDescription": "Evaluates project compliance against .sbom-policy.json, checking for denied licenses, vulnerability severity thresholds, and CRA readiness gaps.", "inputSchema": { "type": "object", "properties": {} } }, { "name": "sbom_get_vulnerabilities", "displayName": "Get Workspace Vulnerabilities", "modelDescription": "Returns a list of vulnerable dependencies with their CVE, severity, EPSS exploit likelihood score, CISA KEV status, and recommended fix versions.", "inputSchema": { "type": "object", "properties": { "highExploitOnly": { "type": "boolean", "description": "Whether to return only vulnerabilities with high exploitation probability (EPSS >= 50% or CISA KEV)." } } } } ] }, "scripts": { "package": "vsce package", "package:release": "node scripts/package-release.js", "release:patch": "npm version patch --no-git-tag-version && npm run package:release", "publish:marketplace": "vsce publish", "publish:patch": "vsce publish patch", "publish:minor": "vsce publish minor", "publish:major": "vsce publish major", "typecheck": "tsc --noEmit", "test": "npm run typecheck && npm run build && node --test", "vscode:prepublish": "npm run lint && npm test", "lint": "eslint .", "build:brand": "node scripts/build-brand.js", "build": "npm run build:brand && node scripts/build-extension.js", "build:marketplace-images": "node scripts/build-marketplace-images.js", "deps:check": "npm outdated; npm audit", "deps:update": "npm update && npm audit fix && npm test" }, "overrides": { "@azure/msal-node": "^7.1.1" }, "devDependencies": { "@types/node": "^26.6.5", "@types/vscode": "^1.90.0", "@vscode/vsce": "^4.0.0", "esbuild": "^0.28.2", "eslint": "^10.13.0", "sharp": "^0.35.5", "typescript": "^7.0.2" }, "capabilities": { "untrustedWorkspaces": { "supported": false, "description": "Scanning runs local tools and requires a trusted workspace." }, "virtualWorkspaces": false }, "dependencies": { "docx": "^9.14.0" }, "activationEvents": [ "onCommand:sbomTool.generateSbom", "onCommand:sbomTool.scanVulnerabilities", "onCommand:sbomTool.generateAndScan", "onCommand:sbomTool.checkCurrentProject", "onCommand:sbomTool.setScanner", "onCommand:sbomTool.setSbomGenerator", "onCommand:sbomTool.setUiLanguage", "onCommand:sbomTool.setResultOpenMode", "onCommand:sbomTool.installTools", "onCommand:sbomTool.openLatestSbomReport", "onCommand:sbomTool.openLatestVulnerabilityReport", "onCommand:sbomTool.openLatestSbomJson", "onCommand:sbomTool.openLatestVulnerabilityJson", "onCommand:sbomTool.openOutputDirectory", "onCommand:sbomTool.cleanOldResults", "onCommand:sbomTool.exportDocxReport", "onCommand:sbomTool.showLogs", "onCommand:sbomTool.openUserGuide", "onCommand:sbomTool.generateReport" ] }