pyproject.toml

[build-system]
requires = ["setuptools>=68.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "depfence"
version = "0.8.0"
description = "AI-aware dependency security scanner. 56 scanners: prompt injection detection, slopsquatting defense, MCP auditing, agent skill attack detection, fabricated-pin resolution, AI model security (pickle/GGUF SSTI/ONNX/TFLite), AI-BOM generation, build-time code execution (Rust/Go/PHP/Python/Maven/Gradle/SPM/CocoaPods), supply chain attack detection, SBOM (CycloneDX/SPDX/SARIF), and policy-as-code for npm, PyPI, Cargo, Go, Maven, NuGet, RubyGems, Composer, Swift/SPM, Dart/Flutter, Docker, HuggingFace, and MCP ecosystems."
readme = "README.md"
license = "Apache-2.0"
requires-python = ">=3.10"
authors = [
    {name = "Eric Rihm"}
]
keywords = ["security", "dependencies", "supply-chain", "npm", "pypi", "scanner", "sbom", "prompt-injection", "mcp", "ai-safety", "slopsquatting"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Security",
    "Topic :: Software Development :: Quality Assurance",
]

dependencies = [
    "click>=8.1",
    "rich>=13.0",
    "httpx>=0.27",
    "tomli>=2.0; python_version < '3.11'",
    "packaging>=24.0",
    "pyyaml>=6.0",
]

[project.optional-dependencies]
dev = [
    "pytest>=8.0",
    "pytest-asyncio>=0.23",
    "ruff>=0.4",
    "mypy>=1.10",
]
ml = [
    "scikit-learn>=1.5",
    "numpy>=1.26",
]
all = ["depfence[dev,ml]"]

[project.scripts]
depfence = "depfence.cli.main:cli"
depfence-mcp = "depfence.mcp.server:main"

[project.entry-points."depfence.scanners"]
npm_advisory = "depfence.scanners.npm_advisory:NpmAdvisoryScanner"
pypi_advisory = "depfence.scanners.pypi_advisory:PypiAdvisoryScanner"
behavioral = "depfence.scanners.behavioral:BehavioralScanner"
reputation = "depfence.scanners.reputation:ReputationScanner"
slopsquat = "depfence.scanners.slopsquat:SlopsquatScanner"
mcp_scanner = "depfence.scanners.mcp_scanner:McpScanner"
gha_scanner = "depfence.scanners.gha_scanner:GhaScanner"
mcp_fingerprint = "depfence.scanners.mcp_fingerprint:McpFingerprintScanner"
dep_confusion = "depfence.scanners.depconfusion:DepConfusionScanner"
preinstall = "depfence.scanners.preinstall:PreinstallScanner"
provenance = "depfence.scanners.provenance:ProvenanceScanner"
model_scanner = "depfence.scanners.model_scanner:ModelScanner"
ci_secrets = "depfence.scanners.ci_secrets:CiSecretsScanner"
license_scanner = "depfence.scanners.license_scanner:LicenseScanner"
reachability = "depfence.scanners.reachability:ReachabilityScanner"
ownership = "depfence.scanners.ownership_scanner:OwnershipScanner"
scope_squatting = "depfence.scanners.scope_scanner:ScopeScanner"
dockerfile = "depfence.scanners.dockerfile_scanner:DockerfileScanner"
gha_workflow = "depfence.scanners.gha_workflow_scanner:GhaWorkflowScanner"
freshness = "depfence.scanners.freshness_scanner:FreshnessScanner"
secrets = "depfence.scanners.secrets_scanner:SecretsScanner"
terraform = "depfence.scanners.terraform_scanner:TerraformScanner"
pinning = "depfence.scanners.pinning_scanner:PinningScanner"
osv = "depfence.scanners.osv_scanner:OsvScanner"
obfuscation = "depfence.scanners.obfuscation:ObfuscationScanner"
network = "depfence.scanners.network_scanner:NetworkScanner"
phantom_deps = "depfence.scanners.phantom_deps:PhantomDepsScanner"
ai_vulns = "depfence.scanners.ai_vulns:AiVulnScanner"
model_integrity = "depfence.scanners.model_integrity:ModelIntegrityScanner"
provenance_checker = "depfence.scanners.provenance_checker:ProvenanceChecker"
prompt_injection = "depfence.scanners.prompt_injection_scanner:PromptInjectionScanner"
git_message = "depfence.scanners.git_message_scanner:GitMessageScanner"
ci_ai_bot = "depfence.scanners.ci_ai_bot_scanner:CiAiBotScanner"
docker_layer = "depfence.scanners.docker_layer_scanner:DockerLayerScanner"
ai_bom = "depfence.scanners.ai_bom_generator:AiBomGenerator"
version_existence = "depfence.scanners.version_existence_scanner:VersionExistenceScanner"
editor_config = "depfence.scanners.editor_config_scanner:EditorConfigScanner"
binding_gyp = "depfence.scanners.binding_gyp_scanner:BindingGypScanner"
model_format = "depfence.scanners.model_format_scanner:ModelFormatScanner"
payload_behavior = "depfence.scanners.payload_behavior_scanner:PayloadBehaviorScanner"
resolve_existence = "depfence.scanners.resolve_existence_scanner:ResolveExistenceScanner"
ruby_lifecycle = "depfence.scanners.ruby_lifecycle_scanner:RubyLifecycleScanner"
protestware = "depfence.scanners.protestware_scanner:ProtestwareScanner"
android_manifest = "depfence.scanners.android_manifest_scanner:AndroidManifestScanner"
gradle_plugin = "depfence.scanners.gradle_plugin_scanner:GradlePluginScanner"
cocoapods_hook = "depfence.scanners.cocoapods_hook_scanner:CocoaPodsHookScanner"
flutter_pubspec = "depfence.scanners.flutter_pubspec_scanner:FlutterPubspecScanner"
spm_plugin = "depfence.scanners.spm_plugin_scanner:SpmPluginScanner"
rust_build = "depfence.scanners.rust_build_scanner:RustBuildScanner"
go_generate = "depfence.scanners.go_generate_scanner:GoGenerateScanner"
composer_script = "depfence.scanners.composer_script_scanner:ComposerScriptScanner"
python_build = "depfence.scanners.python_build_scanner:PythonBuildScanner"
maven_plugin = "depfence.scanners.maven_plugin_scanner:MavenPluginScanner"

[project.entry-points."depfence.analyzers"]
ast_analyzer = "depfence.analyzers.ast_analysis:AstAnalyzer"
install_script = "depfence.analyzers.install_script:InstallScriptAnalyzer"

[project.entry-points."depfence.reporters"]
json_reporter = "depfence.reporters.json_out:JsonReporter"
table_reporter = "depfence.reporters.table_out:TableReporter"
sarif_reporter = "depfence.reporters.sarif_out:SarifReporter"
cyclonedx_reporter = "depfence.reporters.cyclonedx:generate_sbom"
spdx_reporter = "depfence.reporters.spdx_out:generate_spdx"
compliance_reporter = "depfence.reporters.compliance_report:generate_compliance_report"
html_reporter = "depfence.core.html_report:generate_html_report"

[project.urls]
Homepage = "https://github.com/ericrihm/depfence"
Repository = "https://github.com/ericrihm/depfence"
Issues = "https://github.com/ericrihm/depfence/issues"
Changelog = "https://github.com/ericrihm/depfence/releases"

[tool.setuptools.packages.find]
include = ["depfence*"]
exclude = ["depfence._private*", "tests*"]

[tool.setuptools.package-data]
depfence = ["data/*.json"]

[tool.ruff]
target-version = "py310"
line-length = 100

[tool.ruff.lint]
select = ["E", "F", "W", "I", "N", "UP", "S", "B"]
ignore = [
    "E402", "E501", "E741",
    "N803", "N806", "N814",
    "S101", "S106", "S110", "S112", "S314", "S603", "S607", "S608",
    "B005", "B007", "B905",
]

[tool.ruff.lint.per-file-ignores]
"tests/**" = ["S101", "S105", "S106", "S108", "E501"]
"depfence/scanners/*.py" = ["E501", "S603", "S607", "S112"]
"depfence/core/models.py" = ["S105"]
"depfence/reporters/*.py" = ["E501"]
"depfence/cli/*.py" = ["E501"]
"depfence/mcp/*.py" = ["E501"]
"depfence/analyzers/*.py" = ["E501"]
"depfence/core/*.py" = ["E501"]
"depfence/simulate/*.py" = ["E501"]

[tool.mypy]
python_version = "3.10"
warn_return_any = true
warn_unused_configs = true
ignore_missing_imports = true

[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"