INNER CODE UNIT · TypeScript

generateFindingsReport

PentesterFlow/agent · src/cli/index.ts:727

  const generateFindingsReport = (format: 'markdown' | 'sarif') =>
    findingsStore.writeReport(format);
  if (flags.burp) {
    try {
      const result = await startBurpBridge(flags.burpPort);
      process.stderr.write(
        `PentesterFlow Burp bridge listening at ${result.url}\nPentesterFlow Burp bridge token: ${result.token}\nSet both values in the Burp plugin.\n`,
      );
    } catch (err) {
      process.stderr.write(
        `warning: --burp failed to start on :${flags.burpPort}: ${(err as Error).message}\n`,
      );
    }
  }

  // Every other risky primitive (shell, http, file write) is gated through
  // the Prompter before it runs; MCP servers previously spawned unconditionally
  // at startup with no consent step at all — a poisoned mcp_servers entry in

View source record →