Remove proprietary jxscout-pro-v2 material from MIT web-security capability (ADM-81) - #155
Merged
briangreunke merged 2 commits intoSep 23, 2026
Conversation
… capability (ADM-81) The jxscout-* skill docs carried license: proprietary frontmatter noting they were ported from jxscout-pro-v2's own agent skills, but lived inside the web-security capability, which declares license: MIT. Dreadnode does not have redistribution permission for that ported content, so it cannot ship under an MIT grant. Removes the 7 jxscout-* skills, the mcp/jxscout.py wrapper, its capability.yaml registration/check/keyword/description entries, its install_tools.sh block, and cross-references from other skill docs and the web-security agent file. A clean-licensed replacement (jsluice, MIT) is tracked separately in ENG-8672. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Removing the jxscout MCP server and 7 jxscout-* skills is a breaking change to the capability's public surface. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The reviewed changes consistently remove proprietary content and related references with no unresolved issues.
Review effort: Lite
Findings: None
What changed in this PR
Removes proprietary jxscout material and integrations from the MIT-licensed web-security capability.
Changes:
- Deletes seven jxscout skills and its MCP wrapper.
- Removes related installation, metadata, documentation, and cross-references.
- Bumps the capability version to
2.0.0and updates tests.
| File | Summary |
|---|---|
capabilities/web-security/tests/test_install_tools_offline.py |
Removes obsolete jxscout test coverage. |
capabilities/web-security/skills/kiterunner/SKILL.md |
Removes jxscout cross-reference. |
capabilities/web-security/skills/jxscout-static-analysis/SKILL.md |
Deletes proprietary skill. |
capabilities/web-security/skills/jxscout-security-research/SKILL.md |
Deletes proprietary skill. |
capabilities/web-security/skills/jxscout-repeater/SKILL.md |
Deletes proprietary skill. |
capabilities/web-security/skills/jxscout-relationships/SKILL.md |
Deletes proprietary skill. |
capabilities/web-security/skills/jxscout-findings/SKILL.md |
Deletes proprietary skill. |
capabilities/web-security/skills/jxscout-custom-analyzers/SKILL.md |
Deletes proprietary skill. |
capabilities/web-security/skills/jxscout-bookmarks/SKILL.md |
Deletes proprietary skill. |
capabilities/web-security/skills/dom-vulnerability-static-analysis/SKILL.md |
Removes jxscout cross-reference. |
capabilities/web-security/skills/dom-vulnerability-detection/SKILL.md |
Removes jxscout cross-reference. |
capabilities/web-security/skills/cspt-xss/SKILL.md |
Removes jxscout commands. |
capabilities/web-security/skills/csp-bypass/SKILL.md |
Removes jxscout commands. |
capabilities/web-security/scripts/install_tools.sh |
Removes jxscout installation logic. |
capabilities/web-security/mcp/jxscout.py |
Deletes the proprietary MCP wrapper. |
capabilities/web-security/docker/Dockerfile.runtime |
Removes jxscout runtime documentation. |
capabilities/web-security/capability.yaml |
Removes jxscout metadata and bumps the version. |
capabilities/web-security/agents/web-security.md |
Removes jxscout guidance. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
web-securitycapability declareslicense: MIT, but 7jxscout-*skill docs carriedlicense: proprietaryfrontmatter stating they were ported fromjxscout-pro-v2's own agent skills — content Dreadnode does not have permission to redistribute.jxscout-*skills, themcp/jxscout.pywrapper, and every reference to jxscout incapability.yaml(MCP server registration,checksentry,keywords,description),scripts/install_tools.sh,docker/Dockerfile.runtime, theweb-securityagent file, and cross-references in other skill docs (csp-bypass,cspt-xss,dom-vulnerability-detection,dom-vulnerability-static-analysis,kiterunner).web-securityto2.0.0— removing skills and an MCP server is a breaking change to the capability's public surface.jsluice, MIT, BishopFox) is tracked separately in ENG-8672.Test plan
just validate—web-securityvalidates with 0 failures (remaining warnings are pre-existing missing-binary warnings in this sandbox, unrelated to this change)pytest capabilities/web-security/tests/test_install_tools_offline.py— 21 passedpre-commit run --files <changed files>— all hooks passgrep -rni jxscout .— no remaining references anywhere in the repoCloses ADM-81.
🤖 Generated with Claude Code