mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

2.3 KiB

Raw Blame History

SCA Dependency Scanning with Snyk - API Reference

Snyk CLI Commands

snyk test

Scans project dependencies for known vulnerabilities.

snyk test --json --severity-threshold=high
snyk test --json --all-projects          # Monorepo support
snyk test --json --file=package-lock.json

Exit codes:

0: No vulnerabilities found
1: Vulnerabilities found
2: Failure (missing manifest, auth error)

snyk monitor

Creates a project snapshot for continuous monitoring on snyk.io.

snyk monitor --json --project-name="my-app"

snyk auth

Authenticate with Snyk API token.

snyk auth <API_TOKEN>
export SNYK_TOKEN=<API_TOKEN>

JSON Output Structure

Test Result Fields

Field	Type	Description
`vulnerabilities`	array	List of vulnerability objects
`ok`	boolean	True if no vulns found
`dependencyCount`	int	Total dependencies scanned
`packageManager`	string	npm, pip, maven, etc.
`uniqueCount`	int	Unique vulnerability count

Vulnerability Object

Field	Type	Description
`id`	string	Snyk vulnerability ID (e.g., `SNYK-JS-LODASH-590103`)
`title`	string	Human-readable title
`severity`	string	critical, high, medium, low
`cvssScore`	float	CVSS v3.1 score (0-10)
`packageName`	string	Affected package name
`version`	string	Installed version
`fixedIn`	array	Versions with fix available
`exploit`	string	Exploit maturity: Mature, Proof of Concept, Not Defined
`isUpgradable`	boolean	Can be fixed by upgrading direct dependency
`isPatchable`	boolean	Snyk patch available
`from`	array	Dependency path from root

SARIF Integration

Snyk results can be converted to SARIF 2.1.0 for GitHub Code Scanning. The SARIF schema is at: https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json

Severity Mapping

Snyk Severity	CVSS Range	SARIF Level
critical	9.0 - 10.0	error
high	7.0 - 8.9	error
medium	4.0 - 6.9	warning
low	0.1 - 3.9	warning

CLI Usage

python agent.py --project /app --severity high --max-critical 0 --max-high 5 --output report.json

2.3 KiB Raw Blame History