HarnessReport converts CI security findings into SARIF, GitHub, and GitLab formats

·2 views

HarnessReport is an open-source adapter tool that converts HarnessDelta's redacted JSON security findings into three standard CI formats: SARIF 2.1.0, GitHub Actions workflow annotations, and GitLab Code Quality JSON. HarnessDelta detects semantic risks in AI coding-agent configurations such as Codex and Claude Code, while HarnessReport handles only the format conversion without rescanning repositories or reinterpreting findings. The tool maps finding severity levels to native CI equivalents and supports a configurable failure threshold to optionally block pipelines on high-severity results. Version 0.3.0 is MIT licensed, has zero runtime dependencies, runs entirely offline, and passes 14 tests across all supported output formats. The tool is maintained as part of the Nekoautomata Miki open-source portfolio and is available via a Codeberg npm registry.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Vibe-Coding-Universal Replaces Vague 'Old Version' Label With Explicit 'v1.0' Tag

A recent commit in the open-source vibe-coding-universal project replaced the ambiguous label 'Old Version' with the explicit identifier 'v1.0' in its feature comparison tables. The original tables listed the earliest release using a generic descriptive term while all later releases carried precise version numbers, creating an inconsistency that forced users to consult external changelogs. The single-line fix brings the first release in line with semantic versioning conventions, ensuring all table entries use machine-readable, referenceable labels. With consistent versioning across the table, users can now clearly trace the feature progression from v1.0 to v2.0 without ambiguity. The change also aligns human-facing documentation with official git tags and package repository entries, reducing long-term drift between documentation and the project's versioning scheme.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fuse v4.2 Open Source Tool Brings Faster C# Feedback to Claude Code via MCP

Fuse is an open source .NET global tool, now at version 4.2, designed to speed up AI coding agents like Claude Code when working on C# codebases. It uses MSBuild and Roslyn to index a solution locally, enabling fast symbol lookup, dependency injection tracing, and task-scoped source selection without redundant file reads. A key feature called fuse_check validates proposed C# file changes against captured compiler state before they are written to disk, giving agents earlier feedback on type errors and missing members. On a benchmark using the NodaTime codebase with over 14,000 symbols, median symbol lookup took 1.8 milliseconds, and a separate test of 1,000 generated edits recorded zero false positives or false negatives. Fuse operates as either an MCP server or a CLI tool and is intended to complement, not replace, existing language servers and the final build-and-test cycle.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds open-source safety gate to limit AI agent actions

A developer has released agent-gate, a lightweight open-source Python library designed to prevent AI agents from executing harmful or unintended actions autonomously. The tool sits between an AI model's output and any real-world action, requiring a one-time deterministic token before execution can proceed. Key safeguards include prompt-injection rejection, single-use request-bound tokens, automatic file backups for rollback, and mandatory human approval for high-risk operations like deletions or payments. A tamper-evident, hash-chained audit log records every step, breaking the chain if any entry is altered. The project requires no external dependencies and is released under the MIT license, aiming to address a critical gap in how most AI agent pipelines are currently built.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Laravel 11 SSE Streaming Makes AI Chatbot Responses Feel 10x Faster

A Laravel developer tutorial demonstrates how to upgrade an AI chatbot to stream responses using Server-Sent Events (SSE), a feature built into Laravel 11 via response()->eventStream(). Instead of waiting up to five seconds for a full AI response, streaming begins displaying text to users in roughly 300 milliseconds by forwarding tokens as they are generated. The approach uses the openai-php client's createStreamed() method, which returns a PHP Generator that forwards chunks to the browser without holding the entire response in memory. Unlike WebSockets, SSE requires no additional infrastructure such as Reverb or Pusher, as it only needs a one-way server-to-browser connection for the duration of a single request. The tutorial also highlights a critical session-locking issue where failing to call session()->save() before streaming can block all other requests from the same user until the stream completes.

0 comments Read more at DEV Community