@cdxgen/cdxgen 13.1.0 → 13.2.0

package/README.md

@@ -216,7 +216,7 @@ Common asset names:
 #### Linux
 
 ```bash
-VERSION="v13.1.0"
+VERSION="v13.2.0"
 ASSET="cdx-audit-linux-amd64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -230,7 +230,7 @@ chmod +x "${ASSET}"
 #### macOS
 
 ```bash
-VERSION="v13.1.0"
+VERSION="v13.2.0"
 ASSET="cdx-audit-darwin-arm64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -244,7 +244,7 @@ chmod +x "${ASSET}"
 #### Windows (PowerShell)
 
 ```powershell
-$Version = "v13.1.0"
+$Version = "v13.2.0"
 $Asset = "cdx-audit-windows-amd64.exe"
 $BaseUrl = "https://github.com/cdxgen/cdxgen/releases/download/$Version"
 
@@ -269,7 +269,7 @@ steps:
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
-      gh release download v13.1.0 \
+      gh release download v13.2.0 \
         --repo cdxgen/cdxgen \
         --pattern 'cdx-audit-linux-amd64' \
         --pattern 'cdx-audit-linux-amd64.sha256'
@@ -497,14 +497,13 @@ Use repeated `--component-type` values to include only selected CycloneDX compon
 cdxgen -t docker alpine:3.20 --spec-version 1.6 --component-type library --component-type data
 ```
 
-To generate SBOM for C or Python, ensure Java >= 21 is installed.
+To generate SBOM for C or Python, cdxgen uses the bundled atom companion. On linux-amd64, linux-arm64 (glibc), linux-amd64-musl, darwin-arm64, and windows-amd64, atom ships as a native binary and needs no JDK. Only the jar-based triples (darwin-amd64, windows-arm64, and linux-arm64-musl) run atom on the JVM.
 
 ```shell
-# Install java >= 21
 cdxgen -t c -o bom.json
 ```
 
-NOTE: cdxgen is known to freeze with Java 8 or 11, so ensure >= 21 is installed and JAVA_HOME environment variable is configured correctly. If in doubt, use the cdxgen container image.
+NOTE: On the jar-based triples, atom requires Java >= 23 and is known to freeze with Java 8 or 11, so ensure a suitable version is installed and the JAVA_HOME environment variable is configured correctly. If in doubt, use the cdxgen container image.
 
 ## Universal SBOM
 
@@ -788,6 +787,8 @@ pnpm dlx @cdxgen/cdxgen cdx-sign -i bom.json -k private.key
 
 For node.js projects, lock files are parsed initially, so the SBOM would include all dependencies, including dev ones. An AST parser powered by babel-parser is then used to detect packages that are imported and used by non-test code. Such imported packages would automatically set their scope property to `required` in the resulting SBOM. You can turn off this analysis by passing the argument `--no-babel`. Scope property would then be set based on the `dev` attribute in the lock file.
 
+Single-file component frameworks are handled natively by this analysis: `.vue` and `.svelte` templates are segmented position-preservingly so script imports recover with correct file and line evidence. For Svelte and SvelteKit, framework usage signals are additionally collected — SvelteKit virtual modules such as `$app/stores` are attributed to `@sveltejs/kit`, `$lib/*` imports resolve through `kit.alias`, `svelte.config.js` adapters and preprocessors, CSS preprocessor packages implied by `<style lang="...">` blocks together with their `@use`/`@import` package references, npm script executables such as `svelte-kit sync` and `svelte-check`, and rune usage (`$state`, `$derived`, ...) which marks `svelte` required even in components that never import it. This works in every installation; when the optional `@appthreat/atom-parsetools` package is present, template expressions also contribute usage occurrences.
+
 This attribute can be later used for various purposes. For example, [dep-scan][depscan-github] uses this attribute to prioritize vulnerabilities. Unfortunately, tools such as dependency track, do not include this feature and might over-report the CVEs.
 
 With the argument `--required-only`, you can limit the SBOM only to include packages with the scope "required", commonly called production or non-dev dependencies. Combine with `--no-babel` to limit this list to only non-dev dependencies based on the `dev` attribute being false in the lock files.

package/bin/cdxgen.js

@@ -19,6 +19,7 @@ import { parse as _load } from "yaml";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
+import { getExactAiInventoryType } from "../lib/cli/bomAssembly.js";
 import {
   applyAdvancedOptions as applyAdvancedOptionsImpl,
   buildOptionsFromArgs,
@@ -123,7 +124,10 @@ import {
 } from "../lib/inventory/source.js";
 import { executeOsQuery } from "../lib/managers/binary.js";
 import { getBomWithOras } from "../lib/managers/oci.js";
-import { postProcess } from "../lib/stages/postgen/postgen.js";
+import {
+  applyEvidenceBasedFilter,
+  postProcess,
+} from "../lib/stages/postgen/postgen.js";
 import { convertCycloneDxToSpdx } from "../lib/stages/postgen/spdxConverter.js";
 import { auditEnvironment } from "../lib/stages/pregen/envAudit.js";
 import { prepareEnv } from "../lib/stages/pregen/pregen.js";
@@ -1601,7 +1605,14 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
   }
   let sourcePath = filePath;
   let purlResolution;
-  const directHuggingFaceSource = normalizeHuggingFaceReference(sourcePath);
+  // Direct HuggingFace interpretation of the source path is opt-in: bare
+  // `owner/repo`-shaped values are ordinary relative paths (eg: repotests/
+  // sveltejs-realworld) unless an AI inventory type such as `-t ai` is
+  // explicitly selected. Unambiguous purls and huggingface.co URLs always
+  // resolve.
+  const directHuggingFaceSource = normalizeHuggingFaceReference(sourcePath, {
+    explicitOnly: getExactAiInventoryType(options) !== "ai",
+  });
   if (isDryRun && directHuggingFaceSource) {
     recordActivity({
       kind: "read",
@@ -2075,7 +2086,9 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
           sliceArtefacts,
           evinseOptions,
         );
-        bomNSData.bomJson = evinseJson;
+        // The scope filter is deferred until here so the analyzers get to
+        // prove that an optional dependency is actually used.
+        bomNSData.bomJson = applyEvidenceBasedFilter(evinseJson, options);
         if (options.print && evinseJson) {
           printOccurrences(evinseJson);
           printCallStack(evinseJson);

package/bin/evinse.js

@@ -45,6 +45,8 @@ const args = yargs(hideBin(process.argv))
     choices: [
       "java",
       "jar",
+      "kotlin",
+      "kt",
       "js",
       "ts",
       "javascript",

package/data/crypto-oid.json

@@ -40,11 +40,11 @@
     "description": "Korean SEED algorithm, CBC mode"
   },
   "seedOFB": {
-    "oid": "1.2.410.200004.1.5",
+    "oid": "1.2.410.200004.1.6",
     "description": "Korean SEED algorithm, OFB mode"
   },
   "seedCFB": {
-    "oid": "1.2.410.200004.1.6",
+    "oid": "1.2.410.200004.1.5",
     "description": "Korean SEED algorithm, CFB mode"
   },
   "seedMAC": {
@@ -233,11 +233,11 @@
   },
   "cryptoProECDH256": {
     "oid": "1.2.643.7.1.1.6.1",
-    "description": "CryptoPro ECC DH algorithm for GOST R 34.10-2012 256 bit key"
+    "description": "TC26 GOST R 34.10-2012 256-bit key agreement"
   },
   "cryptoProECDH512": {
     "oid": "1.2.643.7.1.1.6.2",
-    "description": "CryptoPro ECC DH algorithm for GOST R 34.10-2012 512 bit key"
+    "description": "TC26 GOST R 34.10-2012 512-bit key agreement"
   },
   "dsa": {
     "oid": "1.2.840.10040.4.1",
@@ -932,8 +932,8 @@
     "description": "Teletrust algorithm"
   },
   "rsaSignature": {
-    "oid": "1.3.36.3.3.1",
-    "description": "Teletrust signature algorithm"
+    "oid": "1.3.14.3.2.11",
+    "description": "RSA signature (OIW secsig)"
   },
   "rsaSignatureWithsha1": {
     "oid": "1.3.36.3.3.1.1",
@@ -1412,8 +1412,8 @@
     "description": "Novell encryption algorithm"
   },
   "sha-1": {
-    "oid": "2.16.840.1.113719.1.2.8.82",
-    "description": "Novell digest algorithm"
+    "oid": "1.3.14.3.2.26",
+    "description": "SHA-1 secure hash standard (OIW)"
   },
   "rc2BSafe1Cbc": {
     "oid": "2.16.840.1.113719.1.2.8.92",
@@ -1959,10 +1959,6 @@
     "oid": "1.2.156.10197.1.301.3",
     "description": "Chinese Cryptography Standardization Technology Committee (CCSTC)"
   },
-  "sm2sign_with_": {
-    "oid": "1.2.156.10197.1.501",
-    "description": "Chinese Cryptography Standardization Technology Committee (CCSTC)"
-  },
   "PBKDF2": {
     "oid": "1.2.840.113549.1.5.12",
     "description": "PBKDF2 key derivation algorithm"
@@ -1994,5 +1990,85 @@
   "pbeWithSHA1AndRC2-CBC": {
     "oid": "1.2.840.113549.1.5.11",
     "description": "Password Based Encryption Algorithm. Uses RC2 in Cipher Block Chaining Mode (RC2-CBC)."
+  },
+  "ml-dsa-44": {
+    "oid": "2.16.840.1.101.3.4.3.17",
+    "description": "ML-DSA-44 post-quantum signature (FIPS 204)"
+  },
+  "ml-dsa-65": {
+    "oid": "2.16.840.1.101.3.4.3.18",
+    "description": "ML-DSA-65 post-quantum signature (FIPS 204)"
+  },
+  "ml-dsa-87": {
+    "oid": "2.16.840.1.101.3.4.3.19",
+    "description": "ML-DSA-87 post-quantum signature (FIPS 204)"
+  },
+  "ml-kem-512": {
+    "oid": "2.16.840.1.101.3.4.4.1",
+    "description": "ML-KEM-512 post-quantum key encapsulation (FIPS 203)"
+  },
+  "ml-kem-768": {
+    "oid": "2.16.840.1.101.3.4.4.2",
+    "description": "ML-KEM-768 post-quantum key encapsulation (FIPS 203)"
+  },
+  "ml-kem-1024": {
+    "oid": "2.16.840.1.101.3.4.4.3",
+    "description": "ML-KEM-1024 post-quantum key encapsulation (FIPS 203)"
+  },
+  "x25519": {
+    "oid": "1.3.101.110",
+    "description": "X25519 Diffie-Hellman key agreement (RFC 7748)"
+  },
+  "slh-dsa-sha2-128s": {
+    "oid": "2.16.840.1.101.3.4.3.20",
+    "description": "SLH-DSA-SHA2-128s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-128f": {
+    "oid": "2.16.840.1.101.3.4.3.21",
+    "description": "SLH-DSA-SHA2-128f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-192s": {
+    "oid": "2.16.840.1.101.3.4.3.22",
+    "description": "SLH-DSA-SHA2-192s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-192f": {
+    "oid": "2.16.840.1.101.3.4.3.23",
+    "description": "SLH-DSA-SHA2-192f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-256s": {
+    "oid": "2.16.840.1.101.3.4.3.24",
+    "description": "SLH-DSA-SHA2-256s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-sha2-256f": {
+    "oid": "2.16.840.1.101.3.4.3.25",
+    "description": "SLH-DSA-SHA2-256f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-128s": {
+    "oid": "2.16.840.1.101.3.4.3.26",
+    "description": "SLH-DSA-SHAKE-128s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-128f": {
+    "oid": "2.16.840.1.101.3.4.3.27",
+    "description": "SLH-DSA-SHAKE-128f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-192s": {
+    "oid": "2.16.840.1.101.3.4.3.28",
+    "description": "SLH-DSA-SHAKE-192s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-192f": {
+    "oid": "2.16.840.1.101.3.4.3.29",
+    "description": "SLH-DSA-SHAKE-192f hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-256s": {
+    "oid": "2.16.840.1.101.3.4.3.30",
+    "description": "SLH-DSA-SHAKE-256s hash-based signature (FIPS 205)"
+  },
+  "slh-dsa-shake-256f": {
+    "oid": "2.16.840.1.101.3.4.3.31",
+    "description": "SLH-DSA-SHAKE-256f hash-based signature (FIPS 205)"
+  },
+  "sm2sign_with_sm3": {
+    "oid": "1.2.156.10197.1.501",
+    "description": "Chinese Cryptography Standardization Technology Committee (CCSTC)"
   }
 }

package/data/remediations.json

@@ -905,6 +905,29 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=rust"
   },
+  "rust.cargo-metadata-unavailable": {
+    "ecosystem": "rust",
+    "kind": "command.failed",
+    "impact": "components",
+    "title": "cargo metadata could not be executed, so dependency kinds and platform gates were recovered from the manifests alone",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "{{cargo}} metadata --format-version 1 --locked"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-RS-001"
+      ],
+      "expectTier": "lockfile"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=rust"
+  },
   "php.composer.missing": {
     "ecosystem": "php",
     "kind": "evidence.degraded",

package/data/rules/ai-bom.yaml

@@ -266,3 +266,81 @@
       "parameterCount": $prop($, 'cdx:ai:parameterCount'),
       "source": $prop($, 'cdx:ai:source')
     }
+
+- id: AIS-003
+  name: "Model artifact uses unsafe pickle deserialization"
+  description: "PyTorch pickle model artifacts (.bin/.pt/.pth/.ckpt) execute arbitrary code when loaded, so an untrusted or unverified artifact can run attacker-controlled code in the loading process."
+  severity: high
+  category: ai-security
+  dry-run-support: full
+  attack:
+    tactics: [TA0002]
+    techniques: [T1059, T1195.002]
+  standards:
+    owasp-ai-top-10:
+      - "LLM05: Supply Chain Vulnerabilities"
+      - "LLM03:2025 Supply Chain"
+    owasp-agentic-top-10-2026:
+      - "Agentic Supply Chain"
+    eu-ai-act:
+      - "Accuracy, robustness and cybersecurity"
+      - "Technical documentation and traceability"
+    eu-cra:
+      - "Software supply chain visibility"
+      - "Protection against untrusted code execution"
+    nist-ai-rmf:
+      - "Map"
+      - "Manage"
+    nist-ssdf:
+      - "Verify provenance of model artifacts before loading"
+  condition: |
+    components[
+      type = 'machine-learning-model'
+      and $prop($, 'cdx:ai:unsafeDeserialization') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref"
+    }
+  message: "Model artifact '{{ name }}' loads via unsafe pickle deserialization"
+  mitigation: "Prefer safetensors over pickle checkpoints, or verify artifact provenance and load pickle models only from trusted sources in a sandbox."
+  evidence: |
+    {
+      "artifactFormat": $prop($, 'cdx:ai:artifactFormat'),
+      "source": $prop($, 'cdx:ai:source'),
+      "quantizationMethod": $prop($, 'cdx:ai:quantizationMethod')
+    }
+
+- id: AIS-004
+  name: "ONNX model artifact lacks exporter provenance"
+  description: "ONNX files record the exporting framework and opset versions in their protobuf header. An artifact without this metadata cannot be traced to the toolchain that produced it, which weakens provenance review and can hide compatibility or security-relevant export settings."
+  severity: low
+  category: ai-governance
+  dry-run-support: full
+  standards:
+    owasp-ai-top-10:
+      - "LLM05: Supply Chain Vulnerabilities"
+      - "LLM03:2025 Supply Chain"
+    eu-ai-act:
+      - "Technical documentation and traceability"
+    nist-ai-rmf:
+      - "Map"
+      - "Govern"
+  condition: |
+    components[
+      type = 'machine-learning-model'
+      and $prop($, 'cdx:ai:artifactFormat') = 'onnx'
+      and not $hasProp($, 'cdx:onnx:producer')
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref"
+    }
+  message: "ONNX model artifact '{{ name }}' carries no exporter provenance"
+  mitigation: "Re-export the model with a producer that records framework and opset metadata, or record the exporter and opset versions as component properties so the artifact remains traceable."
+  evidence: |
+    {
+      "artifactFormat": $prop($, 'cdx:ai:artifactFormat'),
+      "source": $prop($, 'cdx:ai:source'),
+      "modelId": $prop($, 'cdx:ai:modelId')
+    }

package/data/rules/cargo-rust.yaml

@@ -0,0 +1,132 @@
+# Cargo and Rust Rules
+# Categories: cargo-security, cargo-compliance
+# Evaluates the cdx:cargo:* properties cdxgen emits for Rust projects, with the
+# native-library rules keyed on the `links` evidence that only `--deep` can
+# produce.
+
+- id: CARGO-SEC-001
+  name: "Statically linked native library has no resolvable version"
+  description: "A -sys crate compiles a C library into the artifact, but nothing in the build states which version, so no advisory can be matched against it"
+  severity: medium
+  category: cargo-security
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:cargo:linkage') = 'static'
+      and ($not($exists(version)) or version = '')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Native library '{{ name }}' is compiled into the artifact by '{{ $prop($, 'cdx:cargo:providedBy') }}' with no resolvable version"
+  mitigation: "Pin the library version explicitly, or build against a crate release whose version encodes the upstream version as build metadata. Until the version is known, the bundled library has to be reviewed by hand: a vulnerability scanner matching on purl cannot see it"
+  evidence: |
+    {
+      "nativeLibrary": $prop($, 'cdx:cargo:nativeLibrary'),
+      "providedBy": $prop($, 'cdx:cargo:providedBy'),
+      "linkageEvidence": $prop($, 'cdx:cargo:linkageEvidence'),
+      "versionCandidates": $prop($, 'cdx:cargo:upstreamVersionCandidates')
+    }
+
+- id: CARGO-SEC-002
+  name: "Native C library is vendored into the Rust artifact"
+  description: "The resolver enabled a vendoring feature, so the library's own advisories and license obligations travel with the binary rather than with the host"
+  severity: low
+  category: cargo-security
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:cargo:linkage') = 'static'
+      and $exists(version)
+      and version != ''
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Native library '{{ name }}' version '{{ version }}' is compiled into the artifact by '{{ $prop($, 'cdx:cargo:providedBy') }}'"
+  mitigation: "Track this library's advisories directly; the cargo dependency graph will not report them. Confirm that updating the -sys crate is enough to pick up a library fix, and that the vendored build is rebuilt when the library is patched"
+  evidence: |
+    {
+      "nativeLibrary": $prop($, 'cdx:cargo:nativeLibrary'),
+      "providedBy": $prop($, 'cdx:cargo:providedBy'),
+      "linkageEvidence": $prop($, 'cdx:cargo:linkageEvidence'),
+      "upstreamVersionSource": $prop($, 'cdx:cargo:upstreamVersionSource')
+    }
+
+- id: CARGO-SEC-003
+  name: "Rust artifact links a native library the environment must provide"
+  description: "A -sys crate links a C library dynamically, so the deployed artifact depends on a library version this BOM cannot state"
+  severity: low
+  category: cargo-security
+  dry-run-support: full
+  condition: |
+    components[$prop($, 'cdx:cargo:linkage') = 'dynamic']
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Native library '{{ name }}' is linked dynamically by '{{ $prop($, 'cdx:cargo:providedBy') }}' and has to be present and patched on the deployment host"
+  mitigation: "Record the library version the deployment environment provides, through a container or host inventory. Where the artifact must be self-contained, enable the crate's vendoring feature so the version becomes part of this BOM"
+  evidence: |
+    {
+      "nativeLibrary": $prop($, 'cdx:cargo:nativeLibrary'),
+      "providedBy": $prop($, 'cdx:cargo:providedBy')
+    }
+
+- id: CARGO-COMP-001
+  name: "Vendored library version is ambiguous between shipped variants"
+  description: "The crate ships several variants of the library and the enabled features do not say which one is compiled, so the version was left unstated"
+  severity: medium
+  category: cargo-compliance
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:cargo:upstreamVersionCandidates') != null
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Native library '{{ name }}' could be any of '{{ $prop($, 'cdx:cargo:upstreamVersionCandidates') }}' depending on which variant '{{ $prop($, 'cdx:cargo:providedBy') }}' compiles"
+  mitigation: "Read the crate's build script to see which variant the enabled features select, then record the version. The variants can carry different licenses, so a license review cannot be completed from this BOM alone"
+  evidence: |
+    {
+      "versionCandidates": $prop($, 'cdx:cargo:upstreamVersionCandidates'),
+      "providedBy": $prop($, 'cdx:cargo:providedBy'),
+      "resolvedFeatures": $prop($, 'cdx:cargo:resolvedFeatures')
+    }
+
+- id: CARGO-SEC-004
+  name: "Crate resolved from a registry other than crates.io"
+  description: "A crate came from an alternative or private registry, which can publish any name and version, including ones that also exist on crates.io"
+  severity: medium
+  category: cargo-security
+  dry-run-support: full
+  condition: |
+    $append(components, formulation.components)[
+      $prop($, 'cdx:cargo:alternateRegistry') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Crate '{{ name }}' was resolved from '{{ $prop($, 'cdx:cargo:sourceUrl') }}' rather than crates.io"
+  mitigation: "Confirm the registry is one your organisation operates and that the crate name is not also claimed on crates.io, which would let a resolver change pull a different crate. Verify the registry authenticates publishers and serves checksums"
+  evidence: |
+    {
+      "sourceKind": $prop($, 'cdx:cargo:sourceKind'),
+      "sourceUrl": $prop($, 'cdx:cargo:sourceUrl')
+    }
+
+- id: CARGO-SEC-005
+  name: "Procedural macro crate executes during compilation"
+  description: "A proc-macro crate runs arbitrary code in the compiler on the build host, before any of the project's own code runs"
+  severity: low
+  category: cargo-security
+  dry-run-support: full
+  condition: |
+    $append(components, formulation.components)[
+      $prop($, 'cdx:cargo:procMacro') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Crate '{{ name }}' is a procedural macro and runs in the compiler on every build"
+  mitigation: "Treat this crate's compromise as equivalent to build-host compromise. Review its publisher and release history, pin it, and confirm the build host has no credentials a compile-time macro should not reach"
+  evidence: |
+    {
+      "dependencyKind": $prop($, 'cdx:cargo:dependencyKind'),
+      "publisher": $prop($, 'cdx:cargo:publisher'),
+      "resolvedFeatures": $prop($, 'cdx:cargo:resolvedFeatures')
+    }

package/data/rules/mcp-servers.yaml

@@ -386,3 +386,125 @@
       "configuredServiceCount": $prop($, 'cdx:mcp:configuredServiceCount'),
       "configuredServiceNames": $prop($, 'cdx:mcp:configuredServiceNames')
     }
+
+- id: MCP-009
+  name: "MCP configuration relies on deprecated protocol features"
+  description: "The MCP 2026-07-28 specification deprecates the legacy HTTP+SSE transport, dynamic client registration, sampling, logging, and roots. Configurations that still depend on these features need a migration plan before the deprecation window closes."
+  severity: medium
+  category: mcp-server
+  dry-run-support: full
+  standards:
+    owasp-ai-top-10:
+      - "LLM05: Supply Chain Vulnerabilities"
+      - "LLM03:2025 Supply Chain"
+    owasp-agentic-top-10-2026:
+      - "Agentic Supply Chain"
+    eu-ai-act:
+      - "Technical documentation and traceability"
+    eu-cra:
+      - "Technical documentation for software components"
+    nist-ai-rmf:
+      - "Govern"
+      - "Map"
+    nist-ssdf:
+      - "Plan migration away from deprecated protocol features"
+  condition: |
+    $auditServices($)[
+      $nullSafeProp($, 'cdx:mcp:deprecatedFeatures') != ''
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "MCP service '{{ name }}' uses deprecated protocol features"
+  mitigation: "Migrate off legacy SSE transport, dynamic client registration, sampling, logging, and roots to the MCP 2026-07-28 replacements within the deprecation window."
+  evidence: |
+    {
+      "protocolVersion": $prop($, 'cdx:mcp:protocolVersion'),
+      "deprecatedFeatures": $prop($, 'cdx:mcp:deprecatedFeatures'),
+      "transport": $prop($, 'cdx:mcp:transport')
+    }
+
+- id: MCP-010
+  name: "MCP bundle declares secret configuration fields"
+  description: "MCPB/DXT bundles that declare secret-typed user_config fields have those values injected into the bundled server's environment on launch. Declaring such a field is the correct way to build a bundle, so this is an inventory disclosure to aid credential-handling review rather than a defect."
+  severity: low
+  category: mcp-server
+  dry-run-support: full
+  standards:
+    owasp-ai-top-10:
+      - "LLM05: Supply Chain Vulnerabilities"
+      - "LLM03:2025 Supply Chain"
+    owasp-agentic-top-10-2026:
+      - "Agentic Supply Chain"
+    eu-ai-act:
+      - "Technical documentation and traceability"
+    eu-cra:
+      - "Software supply chain visibility"
+    nist-ai-rmf:
+      - "Govern"
+    nist-ssdf:
+      - "Review secret handling in installable AI extensions"
+  condition: |
+    components[
+      $prop($, 'cdx:file:kind') = 'mcp-bundle'
+      and $prop($, 'cdx:mcpb:injectsSecretEnv') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "MCP bundle '{{ name }}' declares secret configuration fields injected as environment variables"
+  mitigation: "Review the declared secret fields and prefer runtime secret stores or references over values captured through the extension manifest."
+  evidence: |
+    {
+      "serverType": $prop($, 'cdx:mcpb:serverType'),
+      "secretFieldCount": $prop($, 'cdx:mcpb:secretFieldCount'),
+      "platformBinaryCount": $prop($, 'cdx:mcpb:platformBinaryCount')
+    }
+
+- id: MCP-011
+  name: "MCP bundle ships precompiled platform binaries"
+  description: "MCPB/DXT bundles that ship precompiled per-platform binaries execute vendor-provided native code on the host with no build-from-source step. These binaries deserve provenance and signing review before a bundle is installed."
+  severity: medium
+  category: mcp-server
+  dry-run-support: full
+  attack:
+    tactics: [TA0002]
+    techniques: [T1195.002]
+  standards:
+    owasp-ai-top-10:
+      - "LLM05: Supply Chain Vulnerabilities"
+      - "LLM03:2025 Supply Chain"
+    owasp-agentic-top-10-2026:
+      - "Agentic Supply Chain"
+    eu-ai-act:
+      - "Technical documentation and traceability"
+      - "Accuracy, robustness and cybersecurity"
+    eu-cra:
+      - "Software supply chain visibility"
+      - "Protection against untrusted code execution"
+    nist-ai-rmf:
+      - "Map"
+      - "Manage"
+    nist-ssdf:
+      - "Verify provenance of precompiled binaries before execution"
+  condition: |
+    components[
+      $prop($, 'cdx:file:kind') = 'mcp-bundle'
+      and $number($nullSafeProp($, 'cdx:mcpb:platformBinaryCount')) > 0
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "MCP bundle '{{ name }}' ships precompiled platform binaries"
+  mitigation: "Verify the provenance and signatures of the bundled platform binaries, or prefer a bundle that builds from source, before installing."
+  evidence: |
+    {
+      "serverType": $prop($, 'cdx:mcpb:serverType'),
+      "platformBinaryCount": $prop($, 'cdx:mcpb:platformBinaryCount')
+    }

package/lib/audit/targets.js

@@ -465,8 +465,13 @@ export async function enrichInputBomsWithRegistryMetadata(inputBoms) {
   process.env.CDXGEN_FETCH_PKG_METADATA = "true";
   try {
     const enrichedCandidates = [
+      // The audit scores publisher drift, ownership and release cadence, none
+      // of which the local Cargo registry records: it knows when a version was
+      // published but not by whom. This path pays the registry's rate limit
+      // deliberately rather than audit against metadata that cannot answer the
+      // questions the rules ask.
       ...(cargoCandidates.length
-        ? await getCratesMetadata(cargoCandidates)
+        ? await getCratesMetadata(cargoCandidates, { preferLocalCache: false })
         : []),
       ...(npmCandidates.length ? await getNpmMetadata(npmCandidates) : []),
       ...(pypiCandidates.length