Versioned, reproducible set of representative targets so every scan path can
be exercised repeatably and the nightly regression (#188) has a baseline.
- fixtures/demo-targets/targets.json: 5 targets — PlcSps composite
(pump_station.st + pump_fbd.xml + optional Modbus live URL + optional
firmware image), PlcSps pure (conveyor.xml + traffic_light.st), plain git
SAST (sharang/cra-vuln-demo, pinned), WebApp (juice-shop v19.2.1 + live
URL), FirmwareRtos (zephyr example-application, pinned). Each carries an
`expect` golden baseline (min_findings, sast_rule_ids, cwes, control_refs,
min_sbom_components, scans_offered, pentest_supported, detected_facts).
- compliance-agent::fixtures: typed loader (DemoTargets/DemoTarget/
DemoArtifact/Expect) + lib tests that keep the manifest well-formed and
assert the PLC baselines offline by running analyze_tree over the checked-in
fixtures (runs in the normal --lib CI job).
- scripts/seed-demo-targets.sh: curl+jq seeder over the public onboarding API
(create → upload → detect → optional --scan), --only, --reset (deletes only
the "Demo · " prefix), env overrides for infra-dependent artifacts.
- docs/guide/demo-targets.md + sidebar entry.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv
New `compliance-mcp` crate providing a Model Context Protocol server
with 7 tools: list/get/summarize findings, list SBOM packages, SBOM
vulnerability report, list DAST findings, and DAST scan summary.
Supports stdio (local dev) and Streamable HTTP (deployment via MCP_PORT).
Includes Dockerfile, CI clippy check, and Coolify deploy job.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com>
Reviewed-on: https://gitea.meghsakha.com/sharang/compliance-scanner-agent/pulls/5
sharang