Metadata-Version: 2.3
Name: aevrin-scanner-core
Version: 0.1.7
Summary: Shared scanning engine for Aevrin: models, OWASP MCP Top 10 mapping, scoring, and containerized scanner adapters. Imported by apps/api and packages/cli so findings never drift into different vocabularies.
Requires-Dist: mcp==1.28.1
Requires-Dist: pydantic>=2.9
Requires-Python: >=3.10
Description-Content-Type: text/markdown

# Aevrin Scanner Core

The shared scanning engine used by the Aevrin API and CLI. It runs the same
version-pinned scanner adapters, normalizes their output into one finding
model, maps findings to the OWASP MCP Top 10, records per-stage coverage, and
computes the report score.

This package is primarily an internal runtime dependency. Most users should
install the [`aevrin`](https://pypi.org/project/aevrin/) CLI instead.

## Development

```bash
uv sync
uv run ruff check .
uv run mypy src
uv run pytest
```

Scanner execution defaults to isolated Docker containers. The production API
uses `AEVRIN_EXECUTOR=subprocess` with the same pinned binaries baked into its
non-root container because Railway does not provide Docker-in-Docker.

## Security model

- Scanner subprocesses receive an allowlisted environment, not application or
  database credentials.
- Remote MCP inspection accepts only public HTTPS endpoints and never executes
  submitted stdio commands.
- A stage is marked incomplete when required tools fail; missing coverage is
  never presented as a clean scan.
- Prompt injection through live tool responses (MCP08) remains explicitly
  outside static-scan coverage.
