fix(039): skip scanners with missing Docker images + persist cache

Three fixes for scanner reliability:

1. resolveScanners() now checks ImageExists() before adding to run list.
   Scanners with non-existent Docker images (mcp-scan, cisco-mcp-scanner
   placeholders) are skipped with a warning log instead of failing at
   runtime with exit code 125.

2. Per-scanner cache directory persisted at ~/.mcpproxy/scanner-cache/<id>/
   mounted at /root/.cache in containers. Trivy DB (90MB) is now
   downloaded once and reused across runs instead of re-downloading
   every scan.

3. Fixed test to use nil docker runner for resolution logic tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

internal/security/scanner/docker.go

@@ -71,6 +71,7 @@ type ScannerRunConfig struct {
 	Env           map[string]string // Environment variables
 	SourceDir     string            // Host directory to mount at /scan/source (read-only)
 	ReportDir     string            // Host directory to mount at /scan/report (writable)
+	CacheDir      string            // Host directory for scanner cache (persists between runs)
 	NetworkMode   string            // "none", "bridge", or custom network name
 	Timeout       time.Duration     // Container execution timeout
 	ReadOnly      bool              // Read-only root filesystem
@@ -119,6 +120,11 @@ func (d *DockerRunner) RunScanner(ctx context.Context, cfg ScannerRunConfig) (st
 		args = append(args, "-v", cfg.ReportDir+":/scan/report:rw")
 	}
 
+	// Mount cache directory (persists scanner DB downloads between runs)
+	if cfg.CacheDir != "" {
+		args = append(args, "-v", cfg.CacheDir+":/root/.cache:rw")
+	}
+
 	// Environment variables
 	for k, v := range cfg.Env {
 		args = append(args, "-e", k+"="+v)

internal/security/scanner/engine.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"time"
@@ -166,10 +168,18 @@ func (e *Engine) resolveScanners(requestedIDs []string) ([]*ScannerPlugin, error
 		return result, nil
 	}
 
-	// Use all installed/configured scanners
+	// Use all installed/configured scanners whose Docker images exist locally
 	var result []*ScannerPlugin
 	for _, s := range all {
 		if s.Status == ScannerStatusInstalled || s.Status == ScannerStatusConfigured {
+			// Verify Docker image exists before adding to scan list
+			if e.docker != nil && !e.docker.ImageExists(context.Background(), s.DockerImage) {
+				e.logger.Warn("Skipping scanner: Docker image not found locally",
+					zap.String("scanner", s.ID),
+					zap.String("image", s.DockerImage),
+				)
+				continue
+			}
 			result = append(result, s)
 		}
 	}
@@ -300,6 +310,10 @@ func (e *Engine) runSingleScanner(ctx context.Context, s *ScannerPlugin, req Sca
 		networkMode = "bridge"
 	}
 
+	// Create per-scanner cache directory (persists DB downloads between runs)
+	cacheDir := filepath.Join(e.dataDir, "scanner-cache", s.ID)
+	os.MkdirAll(cacheDir, 0755)
+
 	// Run scanner container
 	cfg := ScannerRunConfig{
 		ContainerName: GenerateContainerName(s.ID, req.ServerName),
@@ -308,6 +322,7 @@ func (e *Engine) runSingleScanner(ctx context.Context, s *ScannerPlugin, req Sca
 		Env:           env,
 		SourceDir:     req.SourceDir,
 		ReportDir:     reportDir,
+		CacheDir:      cacheDir,
 		NetworkMode:   networkMode,
 		Timeout:       timeout,
 		ReadOnly:      false, // Scanner containers need to write cache/temp files

internal/security/scanner/engine_test.go

@@ -210,8 +210,8 @@ func TestEngineResolveScanners(t *testing.T) {
 	// Mark one scanner as installed
 	registry.scanners["mcp-scan"].Status = ScannerStatusInstalled
 
-	docker := NewDockerRunner(logger)
-	engine := NewEngine(docker, registry, dir, logger)
+	// Use nil docker to skip image existence checks in tests
+	engine := NewEngine(nil, registry, dir, logger)
 
 	// Resolve all installed
 	scanners, err := engine.resolveScanners(nil)