@highflame/policy 2.2.23 → 2.2.25

package/_schemas/ai_gateway/context.json

@@ -353,7 +353,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -365,13 +366,76 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
           "type": "boolean",
           "required": false,
           "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy"
+        },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the tool-call arguments contain a recognized package install command (pip, npm, cargo, go get, etc.)"
+        },
+        {
+          "key": "packages_checked",
+          "type": "number",
+          "required": false,
+          "description": "Number of unique packages checked against osv.dev for this tool call"
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any referenced package has a known-malicious (MAL-) OSV advisory. Use to block supply-chain attacks at install time"
+        },
+        {
+          "key": "malicious_package_score",
+          "type": "number",
+          "required": false,
+          "description": "100 when a malicious package was detected, 0 otherwise",
+          "range": "0-100"
+        },
+        {
+          "key": "malicious_packages",
+          "type": "array",
+          "required": false,
+          "description": "Malicious packages as ecosystem/name[@version] strings (e.g. 'PyPI/evil-pkg@1.0.0')"
+        },
+        {
+          "key": "package_names",
+          "type": "array",
+          "required": false,
+          "description": "Names of all packages parsed from the install command (without ecosystem prefix). Available even when the osv.dev lookup fails."
+        },
+        {
+          "key": "package_ecosystems",
+          "type": "array",
+          "required": false,
+          "description": "Unique package ecosystems seen in this tool call, e.g. ['PyPI', 'npm']. Useful for policies that restrict which ecosystems are permitted."
+        },
+        {
+          "key": "package_advisory_count",
+          "type": "number",
+          "required": false,
+          "description": "Total non-malicious OSV advisories (GHSA- / CVE-) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected."
+        },
+        {
+          "key": "package_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory count for advisory-only packages; 0 when all packages are clean.",
+          "range": "0-100"
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed and packages could not be verified (fail-open). Combine with package_install_detected to fail closed."
         }
       ]
     },
@@ -599,7 +663,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -611,13 +676,76 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
           "type": "boolean",
           "required": false,
           "description": "Whether the TPM limit has been exceeded. Use this to enforce token rate limits via Cedar policy"
+        },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the server-connect arguments contain a recognized package install command"
+        },
+        {
+          "key": "packages_checked",
+          "type": "number",
+          "required": false,
+          "description": "Number of unique packages checked against osv.dev for this connection event"
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any referenced package has a known-malicious (MAL-) OSV advisory"
+        },
+        {
+          "key": "malicious_package_score",
+          "type": "number",
+          "required": false,
+          "description": "100 when a malicious package was detected, 0 otherwise",
+          "range": "0-100"
+        },
+        {
+          "key": "malicious_packages",
+          "type": "array",
+          "required": false,
+          "description": "Malicious packages as ecosystem/name[@version] strings"
+        },
+        {
+          "key": "package_names",
+          "type": "array",
+          "required": false,
+          "description": "Names of all packages parsed from install commands (without ecosystem prefix)"
+        },
+        {
+          "key": "package_ecosystems",
+          "type": "array",
+          "required": false,
+          "description": "Unique package ecosystems seen in this connection event"
+        },
+        {
+          "key": "package_advisory_count",
+          "type": "number",
+          "required": false,
+          "description": "Total non-malicious OSV advisories found across all checked packages"
+        },
+        {
+          "key": "package_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Graduated supply-chain risk score (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed (fail-open)"
         }
       ]
     },
@@ -875,7 +1003,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -887,7 +1016,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -1079,7 +1209,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -1091,7 +1222,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",
@@ -1283,7 +1415,8 @@
           "key": "rpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining RPM (requests per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "rpm_exceeded",
@@ -1295,7 +1428,8 @@
           "key": "tpm_remaining_pct",
           "type": "number",
           "required": false,
-          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)"
+          "description": "Remaining TPM (tokens per minute) as percentage (0-100). Gateway-metered, Shield-decided (ADR 0014)",
+          "range": "0-100"
         },
         {
           "key": "tpm_exceeded",

package/_schemas/ai_gateway/templates/defaults/malicious_package.cedar

@@ -0,0 +1,59 @@
+// =============================================================================
+// Malicious Package (Default)
+// =============================================================================
+// Blocks tool calls that install or download packages flagged as malicious
+// by the osv.dev database (OpenSSF MAL- advisories). The malicious_package
+// detector (Shield, Tier Slow) parses package-manager invocations (pip, npm,
+// yarn, pnpm, bun, uv, gem, cargo, go, composer) out of tool-call arguments
+// and checks each referenced package against the OSV batch API.
+//
+// Context keys consumed:
+//   - malicious_package_detected: Bool
+//   - package_install_detected:   Bool
+//   - package_check_status:       String ("" | "degraded")
+//
+// Compliance:
+//   - OWASP LLM03 (Supply Chain), OWASP ASI02
+//
+// Category:  agent-security
+// Namespace: AIGateway
+// =============================================================================
+
+@id("agent-security.block-malicious-package")
+@name("Block malicious package installs")
+@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@severity("critical")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
+forbid (
+    principal,
+    action == AIGateway::Action::"call_tool",
+    resource
+)
+when {
+    context has malicious_package_detected &&
+    context.malicious_package_detected == true
+};
+
+// Alternative (fail-closed): the detector fails OPEN by design — when the
+// OSV lookup is unavailable, installs proceed with package_check_status set
+// to "degraded". Uncomment to block package installs whenever they cannot be
+// verified, trading install availability for supply-chain certainty.
+//
+// @id("agent-security.block-unverified-package")
+// @name("Block unverified package installs")
+// @description("Blocks call_tool package installs when the malicious-package lookup is degraded.")
+// @severity("medium")
+// @tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03")
+// @reject_message("Package install blocked: the package could not be verified against the malicious-package database.")
+// forbid (
+//     principal,
+//     action == AIGateway::Action::"call_tool",
+//     resource
+// )
+// when {
+//     context has package_install_detected &&
+//     context.package_install_detected == true &&
+//     context has package_check_status &&
+//     context.package_check_status == "degraded"
+// };

package/_schemas/ai_gateway/templates/templates.json

@@ -103,6 +103,20 @@
         "owasp:asi04"
       ]
     },
+    {
+      "id": "agent-security.malicious-package",
+      "name": "Malicious Package",
+      "description": "Block package installs (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer) flagged as malicious.",
+      "category": "agent-security",
+      "file": "defaults/malicious_package.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:supply-chain",
+        "owasp:llm03",
+        "owasp:asi02"
+      ]
+    },
     {
       "id": "tools.mcp-server-allowlist",
       "name": "MCP Server Allowlist",