@highflame/policy 2.2.5 → 2.2.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/_schemas/agent_ops/context.json +1676 -0
- package/_schemas/agent_ops/schema.cedarschema +666 -0
- package/_schemas/agent_ops/templates/defaults/baseline.cedar +21 -0
- package/_schemas/agent_ops/templates/templates.json +66 -0
- package/dist/agent_ops-context.gen.d.ts +146 -0
- package/dist/agent_ops-context.gen.js +280 -0
- package/dist/agent_ops-defaults.gen.d.ts +64 -0
- package/dist/agent_ops-defaults.gen.js +156 -0
- package/dist/agent_ops-entities.gen.d.ts +11 -0
- package/dist/agent_ops-entities.gen.js +37 -0
- package/dist/index.d.ts +5 -1
- package/dist/index.js +4 -1
- package/dist/service-schemas.gen.d.ts +10 -0
- package/dist/service-schemas.gen.js +1055 -1
- package/dist/types.d.ts +5 -1
- package/dist/types.js +4 -1
- package/package.json +1 -1
|
@@ -0,0 +1,1676 @@
|
|
|
1
|
+
{
|
|
2
|
+
"service": "agent_ops",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"description": "AgentOps unified agent guardrail policy enforcement — superset of Guardrails, Overwatch, and AI Gateway",
|
|
5
|
+
"shared": {
|
|
6
|
+
"session_keys": [
|
|
7
|
+
{
|
|
8
|
+
"key": "session_pii_detected",
|
|
9
|
+
"type": "boolean",
|
|
10
|
+
"required": false,
|
|
11
|
+
"description": "Whether PII was detected in any previous turn of the session"
|
|
12
|
+
},
|
|
13
|
+
{
|
|
14
|
+
"key": "session_pii_types",
|
|
15
|
+
"type": "array",
|
|
16
|
+
"required": false,
|
|
17
|
+
"description": "PII types detected across the session (accumulated)"
|
|
18
|
+
},
|
|
19
|
+
{
|
|
20
|
+
"key": "session_secrets_detected",
|
|
21
|
+
"type": "boolean",
|
|
22
|
+
"required": false,
|
|
23
|
+
"description": "Whether secrets were detected in any previous turn of the session"
|
|
24
|
+
},
|
|
25
|
+
{
|
|
26
|
+
"key": "session_secret_types",
|
|
27
|
+
"type": "array",
|
|
28
|
+
"required": false,
|
|
29
|
+
"description": "Secret types detected across the session (accumulated)"
|
|
30
|
+
},
|
|
31
|
+
{
|
|
32
|
+
"key": "session_injection_detected",
|
|
33
|
+
"type": "boolean",
|
|
34
|
+
"required": false,
|
|
35
|
+
"description": "Whether prompt injection was detected in any previous turn of the session"
|
|
36
|
+
},
|
|
37
|
+
{
|
|
38
|
+
"key": "session_command_injection",
|
|
39
|
+
"type": "boolean",
|
|
40
|
+
"required": false,
|
|
41
|
+
"description": "Whether command injection was detected in any previous turn of the session"
|
|
42
|
+
},
|
|
43
|
+
{
|
|
44
|
+
"key": "session_threat_turns",
|
|
45
|
+
"type": "number",
|
|
46
|
+
"required": false,
|
|
47
|
+
"description": "Number of turns in the session where threats were detected"
|
|
48
|
+
},
|
|
49
|
+
{
|
|
50
|
+
"key": "session_max_injection_score",
|
|
51
|
+
"type": "number",
|
|
52
|
+
"required": false,
|
|
53
|
+
"description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
|
|
54
|
+
"range": "0-100"
|
|
55
|
+
},
|
|
56
|
+
{
|
|
57
|
+
"key": "session_max_jailbreak_score",
|
|
58
|
+
"type": "number",
|
|
59
|
+
"required": false,
|
|
60
|
+
"description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
|
|
61
|
+
"range": "0-100"
|
|
62
|
+
},
|
|
63
|
+
{
|
|
64
|
+
"key": "session_max_command_injection_score",
|
|
65
|
+
"type": "number",
|
|
66
|
+
"required": false,
|
|
67
|
+
"description": "Highest command injection score seen in any turn of the session (0-100)",
|
|
68
|
+
"range": "0-100"
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"key": "session_max_pii_score",
|
|
72
|
+
"type": "number",
|
|
73
|
+
"required": false,
|
|
74
|
+
"description": "Highest PII risk score seen in any turn of the session (0-100)",
|
|
75
|
+
"range": "0-100"
|
|
76
|
+
},
|
|
77
|
+
{
|
|
78
|
+
"key": "session_max_secret_score",
|
|
79
|
+
"type": "number",
|
|
80
|
+
"required": false,
|
|
81
|
+
"description": "Highest secret detection score seen in any turn of the session (0-100)",
|
|
82
|
+
"range": "0-100"
|
|
83
|
+
},
|
|
84
|
+
{
|
|
85
|
+
"key": "session_cumulative_risk_score",
|
|
86
|
+
"type": "number",
|
|
87
|
+
"required": false,
|
|
88
|
+
"description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
|
|
89
|
+
},
|
|
90
|
+
{
|
|
91
|
+
"key": "session_max_sensitivity",
|
|
92
|
+
"type": "string",
|
|
93
|
+
"required": false,
|
|
94
|
+
"description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted')"
|
|
95
|
+
},
|
|
96
|
+
{
|
|
97
|
+
"key": "session_original_request",
|
|
98
|
+
"type": "string",
|
|
99
|
+
"required": false,
|
|
100
|
+
"description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
|
|
101
|
+
}
|
|
102
|
+
],
|
|
103
|
+
"agent_identity_keys": [
|
|
104
|
+
{
|
|
105
|
+
"key": "agent_id",
|
|
106
|
+
"type": "string",
|
|
107
|
+
"required": false,
|
|
108
|
+
"description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests."
|
|
109
|
+
},
|
|
110
|
+
{
|
|
111
|
+
"key": "agent_type",
|
|
112
|
+
"type": "string",
|
|
113
|
+
"required": false,
|
|
114
|
+
"description": "Type of the authenticated agent: 'orchestrator', 'autonomous', 'tool_agent', or 'human_proxy'. Empty string for human users."
|
|
115
|
+
},
|
|
116
|
+
{
|
|
117
|
+
"key": "agent_trust_level",
|
|
118
|
+
"type": "string",
|
|
119
|
+
"required": false,
|
|
120
|
+
"description": "Trust level of the authenticated agent: 'first_party', 'verified_third_party', or 'unverified'."
|
|
121
|
+
},
|
|
122
|
+
{
|
|
123
|
+
"key": "agent_framework",
|
|
124
|
+
"type": "string",
|
|
125
|
+
"required": false,
|
|
126
|
+
"description": "Framework or SDK the agent is built with (e.g., 'claude-code', 'langchain', 'crewai', 'autogen')."
|
|
127
|
+
},
|
|
128
|
+
{
|
|
129
|
+
"key": "agent_publisher",
|
|
130
|
+
"type": "string",
|
|
131
|
+
"required": false,
|
|
132
|
+
"description": "Organization that published the agent (e.g., 'anthropic', 'internal', 'acme-corp')."
|
|
133
|
+
}
|
|
134
|
+
]
|
|
135
|
+
},
|
|
136
|
+
"actions": [
|
|
137
|
+
{
|
|
138
|
+
"name": "process_prompt",
|
|
139
|
+
"description": "Analyze user prompts and AI responses for security threats, PII, and content violations",
|
|
140
|
+
"context_attributes": [
|
|
141
|
+
{
|
|
142
|
+
"key": "role",
|
|
143
|
+
"type": "string",
|
|
144
|
+
"required": false,
|
|
145
|
+
"description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011)"
|
|
146
|
+
},
|
|
147
|
+
{
|
|
148
|
+
"key": "privilege_scope",
|
|
149
|
+
"type": "array",
|
|
150
|
+
"required": false,
|
|
151
|
+
"description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011)"
|
|
152
|
+
},
|
|
153
|
+
{
|
|
154
|
+
"key": "identity_type",
|
|
155
|
+
"type": "string",
|
|
156
|
+
"required": false,
|
|
157
|
+
"description": "Principal identity class projected from the token: 'human', 'agent', 'service', or 'mcp_server'"
|
|
158
|
+
},
|
|
159
|
+
{
|
|
160
|
+
"key": "principal",
|
|
161
|
+
"type": "string",
|
|
162
|
+
"required": false,
|
|
163
|
+
"description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id)"
|
|
164
|
+
},
|
|
165
|
+
{
|
|
166
|
+
"key": "request_id",
|
|
167
|
+
"type": "string",
|
|
168
|
+
"required": true,
|
|
169
|
+
"description": "Unique identifier for this request, useful for audit trails and debugging"
|
|
170
|
+
},
|
|
171
|
+
{
|
|
172
|
+
"key": "timestamp",
|
|
173
|
+
"type": "number",
|
|
174
|
+
"required": true,
|
|
175
|
+
"description": "Unix timestamp in milliseconds when the request was processed"
|
|
176
|
+
},
|
|
177
|
+
{
|
|
178
|
+
"key": "direction",
|
|
179
|
+
"type": "string",
|
|
180
|
+
"required": true,
|
|
181
|
+
"description": "Content flow direction: 'input' for user prompts, 'output' for AI responses"
|
|
182
|
+
},
|
|
183
|
+
{
|
|
184
|
+
"key": "content_type",
|
|
185
|
+
"type": "string",
|
|
186
|
+
"required": true,
|
|
187
|
+
"description": "Type of content being analyzed: 'prompt', 'response', 'tool_call', 'file', or 'clipboard'"
|
|
188
|
+
},
|
|
189
|
+
{
|
|
190
|
+
"key": "detector_count",
|
|
191
|
+
"type": "number",
|
|
192
|
+
"required": true,
|
|
193
|
+
"description": "Number of detectors that were executed for this request"
|
|
194
|
+
},
|
|
195
|
+
{
|
|
196
|
+
"key": "source",
|
|
197
|
+
"type": "string",
|
|
198
|
+
"required": false,
|
|
199
|
+
"description": "Traffic origin: 'ide' | 'cli' | 'api' | 'browser'. Present for Overwatch/code-agent traffic."
|
|
200
|
+
},
|
|
201
|
+
{
|
|
202
|
+
"key": "event",
|
|
203
|
+
"type": "string",
|
|
204
|
+
"required": false,
|
|
205
|
+
"description": "Event type: 'prompt' | 'tool_call' | 'file_read' | 'file_write' | 'connect_server'. Present for Overwatch traffic."
|
|
206
|
+
},
|
|
207
|
+
{
|
|
208
|
+
"key": "user_email",
|
|
209
|
+
"type": "string",
|
|
210
|
+
"required": false,
|
|
211
|
+
"description": "Human operator email (IDE sessions)"
|
|
212
|
+
},
|
|
213
|
+
{
|
|
214
|
+
"key": "cwd",
|
|
215
|
+
"type": "string",
|
|
216
|
+
"required": false,
|
|
217
|
+
"description": "Current working directory (IDE sessions)"
|
|
218
|
+
},
|
|
219
|
+
{
|
|
220
|
+
"key": "workspace_root",
|
|
221
|
+
"type": "string",
|
|
222
|
+
"required": false,
|
|
223
|
+
"description": "IDE workspace root path"
|
|
224
|
+
},
|
|
225
|
+
{
|
|
226
|
+
"key": "model_name",
|
|
227
|
+
"type": "string",
|
|
228
|
+
"required": false,
|
|
229
|
+
"description": "LLM model name: 'claude-3-5-sonnet', 'gpt-4o', etc. Present for AI Gateway traffic."
|
|
230
|
+
},
|
|
231
|
+
{
|
|
232
|
+
"key": "model_provider",
|
|
233
|
+
"type": "string",
|
|
234
|
+
"required": false,
|
|
235
|
+
"description": "Model provider: 'anthropic' | 'openai' | 'google' | 'meta'. Present for AI Gateway traffic."
|
|
236
|
+
},
|
|
237
|
+
{
|
|
238
|
+
"key": "injection_score",
|
|
239
|
+
"type": "number",
|
|
240
|
+
"required": false,
|
|
241
|
+
"description": "Combined prompt injection confidence (0-100). MAX of all detector scores.",
|
|
242
|
+
"range": "0-100"
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"key": "jailbreak_score",
|
|
246
|
+
"type": "number",
|
|
247
|
+
"required": false,
|
|
248
|
+
"description": "Combined jailbreak detection confidence (0-100). MAX of all detector scores.",
|
|
249
|
+
"range": "0-100"
|
|
250
|
+
},
|
|
251
|
+
{
|
|
252
|
+
"key": "injection_pulse_score",
|
|
253
|
+
"type": "number",
|
|
254
|
+
"required": false,
|
|
255
|
+
"description": "Highflame single-turn classifier score for prompt injection (0-100).",
|
|
256
|
+
"range": "0-100"
|
|
257
|
+
},
|
|
258
|
+
{
|
|
259
|
+
"key": "injection_deep_context_score",
|
|
260
|
+
"type": "number",
|
|
261
|
+
"required": false,
|
|
262
|
+
"description": "DeepContext multi-turn analyzer score for prompt injection (0-100).",
|
|
263
|
+
"range": "0-100"
|
|
264
|
+
},
|
|
265
|
+
{
|
|
266
|
+
"key": "jailbreak_pulse_score",
|
|
267
|
+
"type": "number",
|
|
268
|
+
"required": false,
|
|
269
|
+
"description": "Highflame single-turn classifier score for jailbreak attempts (0-100).",
|
|
270
|
+
"range": "0-100"
|
|
271
|
+
},
|
|
272
|
+
{
|
|
273
|
+
"key": "jailbreak_deep_context_score",
|
|
274
|
+
"type": "number",
|
|
275
|
+
"required": false,
|
|
276
|
+
"description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100).",
|
|
277
|
+
"range": "0-100"
|
|
278
|
+
},
|
|
279
|
+
{
|
|
280
|
+
"key": "injection_type",
|
|
281
|
+
"type": "string",
|
|
282
|
+
"required": false,
|
|
283
|
+
"description": "Type of injection detected: 'prompt', 'sql', 'command', or 'none'"
|
|
284
|
+
},
|
|
285
|
+
{
|
|
286
|
+
"key": "indirect_injection_score",
|
|
287
|
+
"type": "number",
|
|
288
|
+
"required": false,
|
|
289
|
+
"description": "Indirect prompt injection risk score (0-100) — injection via tool outputs, retrieved documents, or external content.",
|
|
290
|
+
"range": "0-100"
|
|
291
|
+
},
|
|
292
|
+
{
|
|
293
|
+
"key": "indirect_injection_type",
|
|
294
|
+
"type": "string",
|
|
295
|
+
"required": false,
|
|
296
|
+
"description": "Type of indirect injection detected in content (e.g., instruction override, authority hijack)"
|
|
297
|
+
},
|
|
298
|
+
{
|
|
299
|
+
"key": "secrets_detected",
|
|
300
|
+
"type": "boolean",
|
|
301
|
+
"required": false,
|
|
302
|
+
"description": "Whether any API keys, tokens, passwords, or credentials were detected"
|
|
303
|
+
},
|
|
304
|
+
{
|
|
305
|
+
"key": "secret_count",
|
|
306
|
+
"type": "number",
|
|
307
|
+
"required": false,
|
|
308
|
+
"description": "Total number of secret matches found"
|
|
309
|
+
},
|
|
310
|
+
{
|
|
311
|
+
"key": "secret_types",
|
|
312
|
+
"type": "array",
|
|
313
|
+
"required": false,
|
|
314
|
+
"description": "Array of secret types found (e.g., ['aws_access_key', 'github_token'])"
|
|
315
|
+
},
|
|
316
|
+
{
|
|
317
|
+
"key": "pii_detected",
|
|
318
|
+
"type": "boolean",
|
|
319
|
+
"required": false,
|
|
320
|
+
"description": "Whether personally identifiable information (PII) was found"
|
|
321
|
+
},
|
|
322
|
+
{
|
|
323
|
+
"key": "pii_count",
|
|
324
|
+
"type": "number",
|
|
325
|
+
"required": false,
|
|
326
|
+
"description": "Total number of PII matches found"
|
|
327
|
+
},
|
|
328
|
+
{
|
|
329
|
+
"key": "pii_types",
|
|
330
|
+
"type": "array",
|
|
331
|
+
"required": false,
|
|
332
|
+
"description": "Array of PII types detected (e.g., ['email', 'phone', 'ssn', 'credit_card'])"
|
|
333
|
+
},
|
|
334
|
+
{
|
|
335
|
+
"key": "pii_score",
|
|
336
|
+
"type": "number",
|
|
337
|
+
"required": false,
|
|
338
|
+
"description": "PII detection ML classifier confidence (0-100).",
|
|
339
|
+
"range": "0-100"
|
|
340
|
+
},
|
|
341
|
+
{
|
|
342
|
+
"key": "highest_severity",
|
|
343
|
+
"type": "string",
|
|
344
|
+
"required": false,
|
|
345
|
+
"description": "Highest severity level: 'critical', 'high', 'medium', 'low', or 'none'"
|
|
346
|
+
},
|
|
347
|
+
{
|
|
348
|
+
"key": "threat_count",
|
|
349
|
+
"type": "number",
|
|
350
|
+
"required": false,
|
|
351
|
+
"description": "Total number of threats detected across all detectors"
|
|
352
|
+
},
|
|
353
|
+
{
|
|
354
|
+
"key": "threat_categories",
|
|
355
|
+
"type": "array",
|
|
356
|
+
"required": false,
|
|
357
|
+
"description": "Array of threat category names detected (e.g., ['injection', 'pii', 'secrets'])"
|
|
358
|
+
},
|
|
359
|
+
{
|
|
360
|
+
"key": "detected_threats",
|
|
361
|
+
"type": "array",
|
|
362
|
+
"required": false,
|
|
363
|
+
"description": "Array of specific threat names detected"
|
|
364
|
+
},
|
|
365
|
+
{
|
|
366
|
+
"key": "violence_score",
|
|
367
|
+
"type": "number",
|
|
368
|
+
"required": false,
|
|
369
|
+
"description": "ML-based score for violent content references (0-100).",
|
|
370
|
+
"range": "0-100"
|
|
371
|
+
},
|
|
372
|
+
{
|
|
373
|
+
"key": "hate_speech_score",
|
|
374
|
+
"type": "number",
|
|
375
|
+
"required": false,
|
|
376
|
+
"description": "ML-based score for hate speech or discriminatory language (0-100).",
|
|
377
|
+
"range": "0-100"
|
|
378
|
+
},
|
|
379
|
+
{
|
|
380
|
+
"key": "sexual_score",
|
|
381
|
+
"type": "number",
|
|
382
|
+
"required": false,
|
|
383
|
+
"description": "ML-based score for sexual or adult content (0-100).",
|
|
384
|
+
"range": "0-100"
|
|
385
|
+
},
|
|
386
|
+
{
|
|
387
|
+
"key": "weapons_score",
|
|
388
|
+
"type": "number",
|
|
389
|
+
"required": false,
|
|
390
|
+
"description": "ML-based score for weapons references (0-100).",
|
|
391
|
+
"range": "0-100"
|
|
392
|
+
},
|
|
393
|
+
{
|
|
394
|
+
"key": "crime_score",
|
|
395
|
+
"type": "number",
|
|
396
|
+
"required": false,
|
|
397
|
+
"description": "ML-based score for criminal activity discussions (0-100).",
|
|
398
|
+
"range": "0-100"
|
|
399
|
+
},
|
|
400
|
+
{
|
|
401
|
+
"key": "profanity_score",
|
|
402
|
+
"type": "number",
|
|
403
|
+
"required": false,
|
|
404
|
+
"description": "ML-based score for profanity and vulgar language (0-100).",
|
|
405
|
+
"range": "0-100"
|
|
406
|
+
},
|
|
407
|
+
{
|
|
408
|
+
"key": "content_topics",
|
|
409
|
+
"type": "array",
|
|
410
|
+
"required": false,
|
|
411
|
+
"description": "Semantic topics detected in content (e.g., ['controlled_substances', 'weapons_manufacturing'])"
|
|
412
|
+
},
|
|
413
|
+
{
|
|
414
|
+
"key": "topic_confidence",
|
|
415
|
+
"type": "number",
|
|
416
|
+
"required": false,
|
|
417
|
+
"description": "Confidence score from topic classifier (0-100).",
|
|
418
|
+
"range": "0-100"
|
|
419
|
+
},
|
|
420
|
+
{
|
|
421
|
+
"key": "invisible_chars_detected",
|
|
422
|
+
"type": "boolean",
|
|
423
|
+
"required": false,
|
|
424
|
+
"description": "Whether invisible Unicode characters were detected in the content"
|
|
425
|
+
},
|
|
426
|
+
{
|
|
427
|
+
"key": "invisible_chars_score",
|
|
428
|
+
"type": "number",
|
|
429
|
+
"required": false,
|
|
430
|
+
"description": "Density score for invisible characters (0-100).",
|
|
431
|
+
"range": "0-100"
|
|
432
|
+
},
|
|
433
|
+
{
|
|
434
|
+
"key": "command_injection_detected",
|
|
435
|
+
"type": "boolean",
|
|
436
|
+
"required": false,
|
|
437
|
+
"description": "Whether command injection patterns were detected"
|
|
438
|
+
},
|
|
439
|
+
{
|
|
440
|
+
"key": "command_injection_type",
|
|
441
|
+
"type": "string",
|
|
442
|
+
"required": false,
|
|
443
|
+
"description": "Type of command injection: 'reverse_shell', 'privilege_escalation', 'code_execution', 'destructive_command', or 'data_exfiltration'"
|
|
444
|
+
},
|
|
445
|
+
{
|
|
446
|
+
"key": "command_injection_score",
|
|
447
|
+
"type": "number",
|
|
448
|
+
"required": false,
|
|
449
|
+
"description": "Confidence score for command injection detection (0-100).",
|
|
450
|
+
"range": "0-100"
|
|
451
|
+
},
|
|
452
|
+
{
|
|
453
|
+
"key": "path_traversal_detected",
|
|
454
|
+
"type": "boolean",
|
|
455
|
+
"required": false,
|
|
456
|
+
"description": "Whether path traversal patterns were detected"
|
|
457
|
+
},
|
|
458
|
+
{
|
|
459
|
+
"key": "path_traversal_severity",
|
|
460
|
+
"type": "string",
|
|
461
|
+
"required": false,
|
|
462
|
+
"description": "Severity of path traversal: 'critical', 'high', 'medium', 'low', or 'none'"
|
|
463
|
+
},
|
|
464
|
+
{
|
|
465
|
+
"key": "path_traversal_type",
|
|
466
|
+
"type": "string",
|
|
467
|
+
"required": false,
|
|
468
|
+
"description": "Type of path traversal detected"
|
|
469
|
+
},
|
|
470
|
+
{
|
|
471
|
+
"key": "sql_injection_detected",
|
|
472
|
+
"type": "boolean",
|
|
473
|
+
"required": false,
|
|
474
|
+
"description": "Whether SQL injection patterns were detected"
|
|
475
|
+
},
|
|
476
|
+
{
|
|
477
|
+
"key": "sql_injection_type",
|
|
478
|
+
"type": "string",
|
|
479
|
+
"required": false,
|
|
480
|
+
"description": "Type of SQL injection: 'tautology', 'union_based', 'destructive', 'blind', or 'error_based'"
|
|
481
|
+
},
|
|
482
|
+
{
|
|
483
|
+
"key": "sql_injection_score",
|
|
484
|
+
"type": "number",
|
|
485
|
+
"required": false,
|
|
486
|
+
"description": "Confidence score for SQL injection detection (0-100).",
|
|
487
|
+
"range": "0-100"
|
|
488
|
+
},
|
|
489
|
+
{
|
|
490
|
+
"key": "cross_origin_detected",
|
|
491
|
+
"type": "boolean",
|
|
492
|
+
"required": false,
|
|
493
|
+
"description": "Whether cross-origin escalation patterns were detected"
|
|
494
|
+
},
|
|
495
|
+
{
|
|
496
|
+
"key": "cross_origin_type",
|
|
497
|
+
"type": "string",
|
|
498
|
+
"required": false,
|
|
499
|
+
"description": "Type of cross-origin escalation: 'cross_origin_tool', 'cross_origin_server', or 'none'"
|
|
500
|
+
},
|
|
501
|
+
{
|
|
502
|
+
"key": "cross_origin_score",
|
|
503
|
+
"type": "number",
|
|
504
|
+
"required": false,
|
|
505
|
+
"description": "Risk score for cross-origin escalation (0-100).",
|
|
506
|
+
"range": "0-100"
|
|
507
|
+
},
|
|
508
|
+
{
|
|
509
|
+
"key": "encoded_content_detected",
|
|
510
|
+
"type": "boolean",
|
|
511
|
+
"required": false,
|
|
512
|
+
"description": "Whether encoded content was detected (base64, hex, unicode, URL encoding)"
|
|
513
|
+
},
|
|
514
|
+
{
|
|
515
|
+
"key": "encoded_types",
|
|
516
|
+
"type": "array",
|
|
517
|
+
"required": false,
|
|
518
|
+
"description": "Array of encoding types detected (e.g., ['base64', 'hex', 'unicode', 'url'])"
|
|
519
|
+
},
|
|
520
|
+
{
|
|
521
|
+
"key": "encoded_count",
|
|
522
|
+
"type": "number",
|
|
523
|
+
"required": false,
|
|
524
|
+
"description": "Number of encoded segments found"
|
|
525
|
+
},
|
|
526
|
+
{
|
|
527
|
+
"key": "encoded_score",
|
|
528
|
+
"type": "number",
|
|
529
|
+
"required": false,
|
|
530
|
+
"description": "Risk score for encoded injection attempts (0-100).",
|
|
531
|
+
"range": "0-100"
|
|
532
|
+
},
|
|
533
|
+
{
|
|
534
|
+
"key": "detected_language",
|
|
535
|
+
"type": "string",
|
|
536
|
+
"required": false,
|
|
537
|
+
"description": "ISO language code of the detected language (e.g., 'en', 'fr', 'zh')"
|
|
538
|
+
},
|
|
539
|
+
{
|
|
540
|
+
"key": "is_english",
|
|
541
|
+
"type": "boolean",
|
|
542
|
+
"required": false,
|
|
543
|
+
"description": "Whether the content is in English"
|
|
544
|
+
},
|
|
545
|
+
{
|
|
546
|
+
"key": "language_confidence",
|
|
547
|
+
"type": "number",
|
|
548
|
+
"required": false,
|
|
549
|
+
"description": "Confidence score for language detection (0-100).",
|
|
550
|
+
"range": "0-100"
|
|
551
|
+
},
|
|
552
|
+
{
|
|
553
|
+
"key": "detected_script",
|
|
554
|
+
"type": "string",
|
|
555
|
+
"required": false,
|
|
556
|
+
"description": "Writing script detected: 'latin', 'cyrillic', 'arabic', 'cjk', 'unknown', etc."
|
|
557
|
+
},
|
|
558
|
+
{
|
|
559
|
+
"key": "is_latin_script",
|
|
560
|
+
"type": "boolean",
|
|
561
|
+
"required": false,
|
|
562
|
+
"description": "Whether the content uses Latin script"
|
|
563
|
+
},
|
|
564
|
+
{
|
|
565
|
+
"key": "script_confidence",
|
|
566
|
+
"type": "number",
|
|
567
|
+
"required": false,
|
|
568
|
+
"description": "Confidence score for script detection (0-100).",
|
|
569
|
+
"range": "0-100"
|
|
570
|
+
},
|
|
571
|
+
{
|
|
572
|
+
"key": "hallucination_score",
|
|
573
|
+
"type": "number",
|
|
574
|
+
"required": false,
|
|
575
|
+
"description": "ML-based score for hallucinated or fabricated content (0-100).",
|
|
576
|
+
"range": "0-100"
|
|
577
|
+
},
|
|
578
|
+
{
|
|
579
|
+
"key": "factuality_score",
|
|
580
|
+
"type": "number",
|
|
581
|
+
"required": false,
|
|
582
|
+
"description": "ML-based factuality assessment score (0-100).",
|
|
583
|
+
"range": "0-100"
|
|
584
|
+
},
|
|
585
|
+
{
|
|
586
|
+
"key": "sentiment_score",
|
|
587
|
+
"type": "number",
|
|
588
|
+
"required": false,
|
|
589
|
+
"description": "Sentiment analysis score.",
|
|
590
|
+
"range": "0-100"
|
|
591
|
+
},
|
|
592
|
+
{
|
|
593
|
+
"key": "contains_code",
|
|
594
|
+
"type": "boolean",
|
|
595
|
+
"required": false,
|
|
596
|
+
"description": "Whether code snippets were detected in the content"
|
|
597
|
+
},
|
|
598
|
+
{
|
|
599
|
+
"key": "code_languages",
|
|
600
|
+
"type": "array",
|
|
601
|
+
"required": false,
|
|
602
|
+
"description": "Array of programming languages detected in code snippets"
|
|
603
|
+
},
|
|
604
|
+
{
|
|
605
|
+
"key": "code_ratio",
|
|
606
|
+
"type": "number",
|
|
607
|
+
"required": false,
|
|
608
|
+
"description": "Percentage of content that consists of code (0-100).",
|
|
609
|
+
"range": "0-100"
|
|
610
|
+
},
|
|
611
|
+
{
|
|
612
|
+
"key": "keyword_matched",
|
|
613
|
+
"type": "boolean",
|
|
614
|
+
"required": false,
|
|
615
|
+
"description": "Whether any configured keywords or phrases were matched"
|
|
616
|
+
},
|
|
617
|
+
{
|
|
618
|
+
"key": "keyword_categories",
|
|
619
|
+
"type": "array",
|
|
620
|
+
"required": false,
|
|
621
|
+
"description": "Array of keyword categories matched (e.g., ['competitor_names', 'restricted_topics'])"
|
|
622
|
+
},
|
|
623
|
+
{
|
|
624
|
+
"key": "keyword_count",
|
|
625
|
+
"type": "number",
|
|
626
|
+
"required": false,
|
|
627
|
+
"description": "Number of keyword matches found"
|
|
628
|
+
},
|
|
629
|
+
{
|
|
630
|
+
"key": "contains_non_ascii",
|
|
631
|
+
"type": "boolean",
|
|
632
|
+
"required": false,
|
|
633
|
+
"description": "Whether non-ASCII characters were detected"
|
|
634
|
+
},
|
|
635
|
+
{
|
|
636
|
+
"key": "phishing_detected",
|
|
637
|
+
"type": "boolean",
|
|
638
|
+
"required": false,
|
|
639
|
+
"description": "Whether phishing patterns were detected"
|
|
640
|
+
},
|
|
641
|
+
{
|
|
642
|
+
"key": "content_safety_score",
|
|
643
|
+
"type": "number",
|
|
644
|
+
"required": false,
|
|
645
|
+
"description": "Aggregate content safety score (0-100).",
|
|
646
|
+
"range": "0-100"
|
|
647
|
+
},
|
|
648
|
+
{
|
|
649
|
+
"key": "content_safety_blocked",
|
|
650
|
+
"type": "boolean",
|
|
651
|
+
"required": false,
|
|
652
|
+
"description": "Whether content was flagged for blocking by the content safety system"
|
|
653
|
+
},
|
|
654
|
+
{
|
|
655
|
+
"key": "conversation_turn",
|
|
656
|
+
"type": "number",
|
|
657
|
+
"required": false,
|
|
658
|
+
"description": "Current conversation turn number"
|
|
659
|
+
},
|
|
660
|
+
{
|
|
661
|
+
"key": "multi_turn_detection",
|
|
662
|
+
"type": "boolean",
|
|
663
|
+
"required": false,
|
|
664
|
+
"description": "Whether multi-turn injection patterns were detected"
|
|
665
|
+
},
|
|
666
|
+
{
|
|
667
|
+
"key": "budget_remaining_pct",
|
|
668
|
+
"type": "number",
|
|
669
|
+
"required": false,
|
|
670
|
+
"description": "Remaining token budget as percentage (0-100).",
|
|
671
|
+
"range": "0-100"
|
|
672
|
+
},
|
|
673
|
+
{
|
|
674
|
+
"key": "budget_exceeded",
|
|
675
|
+
"type": "boolean",
|
|
676
|
+
"required": false,
|
|
677
|
+
"description": "Whether the token budget has been exceeded"
|
|
678
|
+
},
|
|
679
|
+
{ "$ref": "session_keys" },
|
|
680
|
+
{ "$ref": "agent_identity_keys" }
|
|
681
|
+
]
|
|
682
|
+
},
|
|
683
|
+
{
|
|
684
|
+
"name": "call_tool",
|
|
685
|
+
"description": "Execute agentic tool calls, including shell commands, file operations, and MCP tools",
|
|
686
|
+
"context_attributes": [
|
|
687
|
+
{
|
|
688
|
+
"key": "role",
|
|
689
|
+
"type": "string",
|
|
690
|
+
"required": false,
|
|
691
|
+
"description": "Caller's RBAC role projected from the principal's token"
|
|
692
|
+
},
|
|
693
|
+
{
|
|
694
|
+
"key": "privilege_scope",
|
|
695
|
+
"type": "array",
|
|
696
|
+
"required": false,
|
|
697
|
+
"description": "Privilege-scope strings granted to the caller"
|
|
698
|
+
},
|
|
699
|
+
{
|
|
700
|
+
"key": "identity_type",
|
|
701
|
+
"type": "string",
|
|
702
|
+
"required": false,
|
|
703
|
+
"description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
|
|
704
|
+
},
|
|
705
|
+
{
|
|
706
|
+
"key": "principal",
|
|
707
|
+
"type": "string",
|
|
708
|
+
"required": false,
|
|
709
|
+
"description": "Stable principal identifier"
|
|
710
|
+
},
|
|
711
|
+
{
|
|
712
|
+
"key": "request_id",
|
|
713
|
+
"type": "string",
|
|
714
|
+
"required": true,
|
|
715
|
+
"description": "Unique identifier for this request"
|
|
716
|
+
},
|
|
717
|
+
{
|
|
718
|
+
"key": "timestamp",
|
|
719
|
+
"type": "number",
|
|
720
|
+
"required": true,
|
|
721
|
+
"description": "Unix timestamp in milliseconds"
|
|
722
|
+
},
|
|
723
|
+
{
|
|
724
|
+
"key": "source",
|
|
725
|
+
"type": "string",
|
|
726
|
+
"required": false,
|
|
727
|
+
"description": "Traffic origin: 'ide' | 'cli' | 'api' | 'browser'"
|
|
728
|
+
},
|
|
729
|
+
{
|
|
730
|
+
"key": "event",
|
|
731
|
+
"type": "string",
|
|
732
|
+
"required": false,
|
|
733
|
+
"description": "Event type: 'tool_call'"
|
|
734
|
+
},
|
|
735
|
+
{
|
|
736
|
+
"key": "user_email",
|
|
737
|
+
"type": "string",
|
|
738
|
+
"required": false,
|
|
739
|
+
"description": "Human operator email (IDE sessions)"
|
|
740
|
+
},
|
|
741
|
+
{
|
|
742
|
+
"key": "cwd",
|
|
743
|
+
"type": "string",
|
|
744
|
+
"required": false,
|
|
745
|
+
"description": "Current working directory"
|
|
746
|
+
},
|
|
747
|
+
{
|
|
748
|
+
"key": "workspace_root",
|
|
749
|
+
"type": "string",
|
|
750
|
+
"required": false,
|
|
751
|
+
"description": "IDE workspace root path"
|
|
752
|
+
},
|
|
753
|
+
{
|
|
754
|
+
"key": "tool_name",
|
|
755
|
+
"type": "string",
|
|
756
|
+
"required": false,
|
|
757
|
+
"description": "Name of the tool being called (e.g., 'shell', 'write_file', 'http_post')"
|
|
758
|
+
},
|
|
759
|
+
{
|
|
760
|
+
"key": "tool_risk_score",
|
|
761
|
+
"type": "number",
|
|
762
|
+
"required": false,
|
|
763
|
+
"description": "Computed risk score for this tool call (0-100).",
|
|
764
|
+
"range": "0-100"
|
|
765
|
+
},
|
|
766
|
+
{
|
|
767
|
+
"key": "tool_is_sensitive",
|
|
768
|
+
"type": "boolean",
|
|
769
|
+
"required": false,
|
|
770
|
+
"description": "Whether the tool is classified as sensitive"
|
|
771
|
+
},
|
|
772
|
+
{
|
|
773
|
+
"key": "tool_category",
|
|
774
|
+
"type": "string",
|
|
775
|
+
"required": false,
|
|
776
|
+
"description": "Tool classification: 'safe', 'sensitive', or 'dangerous'"
|
|
777
|
+
},
|
|
778
|
+
{
|
|
779
|
+
"key": "tool_is_builtin",
|
|
780
|
+
"type": "boolean",
|
|
781
|
+
"required": false,
|
|
782
|
+
"description": "Whether the tool is a built-in tool (vs MCP external tool)"
|
|
783
|
+
},
|
|
784
|
+
{
|
|
785
|
+
"key": "param_type_violation",
|
|
786
|
+
"type": "boolean",
|
|
787
|
+
"required": false,
|
|
788
|
+
"description": "True when any projected tool-call argument failed type coercion (AARM R3)"
|
|
789
|
+
},
|
|
790
|
+
{
|
|
791
|
+
"key": "param_type_violations",
|
|
792
|
+
"type": "array",
|
|
793
|
+
"required": false,
|
|
794
|
+
"description": "Names of the tool-call arguments that failed type coercion"
|
|
795
|
+
},
|
|
796
|
+
{
|
|
797
|
+
"key": "mcp_server",
|
|
798
|
+
"type": "string",
|
|
799
|
+
"required": false,
|
|
800
|
+
"description": "Name of the MCP server providing this tool"
|
|
801
|
+
},
|
|
802
|
+
{
|
|
803
|
+
"key": "mcp_tool",
|
|
804
|
+
"type": "string",
|
|
805
|
+
"required": false,
|
|
806
|
+
"description": "Name of the specific tool within the MCP server"
|
|
807
|
+
},
|
|
808
|
+
{
|
|
809
|
+
"key": "mcp_server_verified",
|
|
810
|
+
"type": "boolean",
|
|
811
|
+
"required": false,
|
|
812
|
+
"description": "Whether the MCP server is from a verified/trusted registry"
|
|
813
|
+
},
|
|
814
|
+
{
|
|
815
|
+
"key": "suspicious_pattern",
|
|
816
|
+
"type": "boolean",
|
|
817
|
+
"required": false,
|
|
818
|
+
"description": "Whether a suspicious action sequence was detected"
|
|
819
|
+
},
|
|
820
|
+
{
|
|
821
|
+
"key": "pattern_type",
|
|
822
|
+
"type": "string",
|
|
823
|
+
"required": false,
|
|
824
|
+
"description": "Type of suspicious pattern: 'data_exfiltration', 'secret_exfiltration', 'db_exfiltration', or 'none'"
|
|
825
|
+
},
|
|
826
|
+
{
|
|
827
|
+
"key": "sequence_risk",
|
|
828
|
+
"type": "number",
|
|
829
|
+
"required": false,
|
|
830
|
+
"description": "Risk score from action sequence analysis (0-100).",
|
|
831
|
+
"range": "0-100"
|
|
832
|
+
},
|
|
833
|
+
{
|
|
834
|
+
"key": "loop_detected",
|
|
835
|
+
"type": "boolean",
|
|
836
|
+
"required": false,
|
|
837
|
+
"description": "Whether a tool call loop was detected"
|
|
838
|
+
},
|
|
839
|
+
{
|
|
840
|
+
"key": "loop_count",
|
|
841
|
+
"type": "number",
|
|
842
|
+
"required": false,
|
|
843
|
+
"description": "Number of consecutive repeated tool calls"
|
|
844
|
+
},
|
|
845
|
+
{
|
|
846
|
+
"key": "loop_tool",
|
|
847
|
+
"type": "string",
|
|
848
|
+
"required": false,
|
|
849
|
+
"description": "Name of the tool involved in the loop"
|
|
850
|
+
},
|
|
851
|
+
{
|
|
852
|
+
"key": "secrets_detected",
|
|
853
|
+
"type": "boolean",
|
|
854
|
+
"required": false,
|
|
855
|
+
"description": "Whether secrets were detected in tool arguments or content"
|
|
856
|
+
},
|
|
857
|
+
{
|
|
858
|
+
"key": "secret_count",
|
|
859
|
+
"type": "number",
|
|
860
|
+
"required": false,
|
|
861
|
+
"description": "Total number of secret matches found in tool arguments"
|
|
862
|
+
},
|
|
863
|
+
{
|
|
864
|
+
"key": "secret_types",
|
|
865
|
+
"type": "array",
|
|
866
|
+
"required": false,
|
|
867
|
+
"description": "Array of secret types found in tool arguments"
|
|
868
|
+
},
|
|
869
|
+
{
|
|
870
|
+
"key": "pii_detected",
|
|
871
|
+
"type": "boolean",
|
|
872
|
+
"required": false,
|
|
873
|
+
"description": "Whether PII was detected in tool arguments"
|
|
874
|
+
},
|
|
875
|
+
{
|
|
876
|
+
"key": "pii_types",
|
|
877
|
+
"type": "array",
|
|
878
|
+
"required": false,
|
|
879
|
+
"description": "Array of PII types found in tool arguments"
|
|
880
|
+
},
|
|
881
|
+
{
|
|
882
|
+
"key": "pii_count",
|
|
883
|
+
"type": "number",
|
|
884
|
+
"required": false,
|
|
885
|
+
"description": "Number of PII pattern matches in tool arguments"
|
|
886
|
+
},
|
|
887
|
+
{
|
|
888
|
+
"key": "pii_score",
|
|
889
|
+
"type": "number",
|
|
890
|
+
"required": false,
|
|
891
|
+
"description": "PII detection ML classifier confidence for tool content (0-100).",
|
|
892
|
+
"range": "0-100"
|
|
893
|
+
},
|
|
894
|
+
{
|
|
895
|
+
"key": "injection_score",
|
|
896
|
+
"type": "number",
|
|
897
|
+
"required": false,
|
|
898
|
+
"description": "Combined prompt injection confidence in tool arguments (0-100).",
|
|
899
|
+
"range": "0-100"
|
|
900
|
+
},
|
|
901
|
+
{
|
|
902
|
+
"key": "injection_pulse_score",
|
|
903
|
+
"type": "number",
|
|
904
|
+
"required": false,
|
|
905
|
+
"description": "Highflame single-turn classifier score for prompt injection in tool arguments (0-100).",
|
|
906
|
+
"range": "0-100"
|
|
907
|
+
},
|
|
908
|
+
{
|
|
909
|
+
"key": "injection_deep_context_score",
|
|
910
|
+
"type": "number",
|
|
911
|
+
"required": false,
|
|
912
|
+
"description": "DeepContext multi-turn analyzer score for prompt injection in tool arguments (0-100).",
|
|
913
|
+
"range": "0-100"
|
|
914
|
+
},
|
|
915
|
+
{
|
|
916
|
+
"key": "indirect_injection_score",
|
|
917
|
+
"type": "number",
|
|
918
|
+
"required": false,
|
|
919
|
+
"description": "Indirect prompt injection risk score (0-100) — injection via tool outputs or retrieved documents.",
|
|
920
|
+
"range": "0-100"
|
|
921
|
+
},
|
|
922
|
+
{
|
|
923
|
+
"key": "indirect_injection_type",
|
|
924
|
+
"type": "string",
|
|
925
|
+
"required": false,
|
|
926
|
+
"description": "Type of indirect injection detected in tool content"
|
|
927
|
+
},
|
|
928
|
+
{
|
|
929
|
+
"key": "content_topics",
|
|
930
|
+
"type": "array",
|
|
931
|
+
"required": false,
|
|
932
|
+
"description": "Semantic topics detected in tool arguments"
|
|
933
|
+
},
|
|
934
|
+
{
|
|
935
|
+
"key": "topic_confidence",
|
|
936
|
+
"type": "number",
|
|
937
|
+
"required": false,
|
|
938
|
+
"description": "Confidence score from topic classifier for tool content (0-100).",
|
|
939
|
+
"range": "0-100"
|
|
940
|
+
},
|
|
941
|
+
{
|
|
942
|
+
"key": "command_injection_detected",
|
|
943
|
+
"type": "boolean",
|
|
944
|
+
"required": false,
|
|
945
|
+
"description": "Whether command injection patterns were detected in tool arguments"
|
|
946
|
+
},
|
|
947
|
+
{
|
|
948
|
+
"key": "command_injection_type",
|
|
949
|
+
"type": "string",
|
|
950
|
+
"required": false,
|
|
951
|
+
"description": "Type of command injection detected in tool arguments"
|
|
952
|
+
},
|
|
953
|
+
{
|
|
954
|
+
"key": "command_injection_score",
|
|
955
|
+
"type": "number",
|
|
956
|
+
"required": false,
|
|
957
|
+
"description": "Confidence score for command injection in tool arguments (0-100).",
|
|
958
|
+
"range": "0-100"
|
|
959
|
+
},
|
|
960
|
+
{
|
|
961
|
+
"key": "path_traversal_detected",
|
|
962
|
+
"type": "boolean",
|
|
963
|
+
"required": false,
|
|
964
|
+
"description": "Whether path traversal patterns were detected in tool arguments"
|
|
965
|
+
},
|
|
966
|
+
{
|
|
967
|
+
"key": "path_traversal_severity",
|
|
968
|
+
"type": "string",
|
|
969
|
+
"required": false,
|
|
970
|
+
"description": "Severity of path traversal in tool arguments"
|
|
971
|
+
},
|
|
972
|
+
{
|
|
973
|
+
"key": "path_traversal_type",
|
|
974
|
+
"type": "string",
|
|
975
|
+
"required": false,
|
|
976
|
+
"description": "Type of path traversal detected in tool arguments"
|
|
977
|
+
},
|
|
978
|
+
{
|
|
979
|
+
"key": "sql_injection_detected",
|
|
980
|
+
"type": "boolean",
|
|
981
|
+
"required": false,
|
|
982
|
+
"description": "Whether SQL injection patterns were detected in tool arguments"
|
|
983
|
+
},
|
|
984
|
+
{
|
|
985
|
+
"key": "sql_injection_type",
|
|
986
|
+
"type": "string",
|
|
987
|
+
"required": false,
|
|
988
|
+
"description": "Type of SQL injection detected in tool arguments"
|
|
989
|
+
},
|
|
990
|
+
{
|
|
991
|
+
"key": "sql_injection_score",
|
|
992
|
+
"type": "number",
|
|
993
|
+
"required": false,
|
|
994
|
+
"description": "Confidence score for SQL injection in tool arguments (0-100).",
|
|
995
|
+
"range": "0-100"
|
|
996
|
+
},
|
|
997
|
+
{
|
|
998
|
+
"key": "tool_poisoning_detected",
|
|
999
|
+
"type": "boolean",
|
|
1000
|
+
"required": false,
|
|
1001
|
+
"description": "Whether tool poisoning was detected"
|
|
1002
|
+
},
|
|
1003
|
+
{
|
|
1004
|
+
"key": "tool_poisoning_score",
|
|
1005
|
+
"type": "number",
|
|
1006
|
+
"required": false,
|
|
1007
|
+
"description": "Confidence score for tool poisoning detection (0-100).",
|
|
1008
|
+
"range": "0-100"
|
|
1009
|
+
},
|
|
1010
|
+
{
|
|
1011
|
+
"key": "tool_poisoning_type",
|
|
1012
|
+
"type": "string",
|
|
1013
|
+
"required": false,
|
|
1014
|
+
"description": "Type of tool poisoning: 'hidden_instructions', 'system_prompt_injection', or 'authority_hijack'"
|
|
1015
|
+
},
|
|
1016
|
+
{
|
|
1017
|
+
"key": "rug_pull_detected",
|
|
1018
|
+
"type": "boolean",
|
|
1019
|
+
"required": false,
|
|
1020
|
+
"description": "Whether a rug pull was detected"
|
|
1021
|
+
},
|
|
1022
|
+
{
|
|
1023
|
+
"key": "rug_pull_score",
|
|
1024
|
+
"type": "number",
|
|
1025
|
+
"required": false,
|
|
1026
|
+
"description": "Confidence score for rug pull detection (0-100).",
|
|
1027
|
+
"range": "0-100"
|
|
1028
|
+
},
|
|
1029
|
+
{
|
|
1030
|
+
"key": "rug_pull_type",
|
|
1031
|
+
"type": "string",
|
|
1032
|
+
"required": false,
|
|
1033
|
+
"description": "Type of rug pull detected: 'risk_spike', 'pattern_change', 'combined', or 'none'"
|
|
1034
|
+
},
|
|
1035
|
+
{
|
|
1036
|
+
"key": "mcp_config_risk",
|
|
1037
|
+
"type": "boolean",
|
|
1038
|
+
"required": false,
|
|
1039
|
+
"description": "Whether MCP configuration risk was detected"
|
|
1040
|
+
},
|
|
1041
|
+
{
|
|
1042
|
+
"key": "mcp_risk_type",
|
|
1043
|
+
"type": "string",
|
|
1044
|
+
"required": false,
|
|
1045
|
+
"description": "Type of MCP risk: 'inline_execution', 'suspicious_url', or 'cross_origin'"
|
|
1046
|
+
},
|
|
1047
|
+
{
|
|
1048
|
+
"key": "mcp_risk_score",
|
|
1049
|
+
"type": "number",
|
|
1050
|
+
"required": false,
|
|
1051
|
+
"description": "Risk score for MCP configuration issues (0-100).",
|
|
1052
|
+
"range": "0-100"
|
|
1053
|
+
},
|
|
1054
|
+
{
|
|
1055
|
+
"key": "cross_origin_detected",
|
|
1056
|
+
"type": "boolean",
|
|
1057
|
+
"required": false,
|
|
1058
|
+
"description": "Whether cross-origin escalation patterns were detected in tool calls"
|
|
1059
|
+
},
|
|
1060
|
+
{
|
|
1061
|
+
"key": "cross_origin_type",
|
|
1062
|
+
"type": "string",
|
|
1063
|
+
"required": false,
|
|
1064
|
+
"description": "Type of cross-origin escalation detected in tool call"
|
|
1065
|
+
},
|
|
1066
|
+
{
|
|
1067
|
+
"key": "cross_origin_score",
|
|
1068
|
+
"type": "number",
|
|
1069
|
+
"required": false,
|
|
1070
|
+
"description": "Risk score for cross-origin escalation in tool calls (0-100).",
|
|
1071
|
+
"range": "0-100"
|
|
1072
|
+
},
|
|
1073
|
+
{
|
|
1074
|
+
"key": "invisible_chars_detected",
|
|
1075
|
+
"type": "boolean",
|
|
1076
|
+
"required": false,
|
|
1077
|
+
"description": "Whether invisible Unicode characters were detected in tool arguments"
|
|
1078
|
+
},
|
|
1079
|
+
{
|
|
1080
|
+
"key": "invisible_chars_score",
|
|
1081
|
+
"type": "number",
|
|
1082
|
+
"required": false,
|
|
1083
|
+
"description": "Invisible character attack severity score in tool arguments (0-100).",
|
|
1084
|
+
"range": "0-100"
|
|
1085
|
+
},
|
|
1086
|
+
{
|
|
1087
|
+
"key": "encoded_content_detected",
|
|
1088
|
+
"type": "boolean",
|
|
1089
|
+
"required": false,
|
|
1090
|
+
"description": "Whether encoded content was detected in tool arguments"
|
|
1091
|
+
},
|
|
1092
|
+
{
|
|
1093
|
+
"key": "encoded_types",
|
|
1094
|
+
"type": "array",
|
|
1095
|
+
"required": false,
|
|
1096
|
+
"description": "Array of encoding types detected in tool arguments"
|
|
1097
|
+
},
|
|
1098
|
+
{
|
|
1099
|
+
"key": "encoded_count",
|
|
1100
|
+
"type": "number",
|
|
1101
|
+
"required": false,
|
|
1102
|
+
"description": "Number of encoded segments found in tool arguments"
|
|
1103
|
+
},
|
|
1104
|
+
{
|
|
1105
|
+
"key": "encoded_score",
|
|
1106
|
+
"type": "number",
|
|
1107
|
+
"required": false,
|
|
1108
|
+
"description": "Risk score for encoded injection in tool arguments (0-100).",
|
|
1109
|
+
"range": "0-100"
|
|
1110
|
+
},
|
|
1111
|
+
{
|
|
1112
|
+
"key": "tool_operation_classes",
|
|
1113
|
+
"type": "array",
|
|
1114
|
+
"required": false,
|
|
1115
|
+
"description": "All operation classes observed in the tool call: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'"
|
|
1116
|
+
},
|
|
1117
|
+
{
|
|
1118
|
+
"key": "path",
|
|
1119
|
+
"type": "string",
|
|
1120
|
+
"required": false,
|
|
1121
|
+
"description": "File path targeted by the tool call"
|
|
1122
|
+
},
|
|
1123
|
+
{
|
|
1124
|
+
"key": "conversation_turn",
|
|
1125
|
+
"type": "number",
|
|
1126
|
+
"required": false,
|
|
1127
|
+
"description": "Current conversation turn number"
|
|
1128
|
+
},
|
|
1129
|
+
{
|
|
1130
|
+
"key": "multi_turn_detection",
|
|
1131
|
+
"type": "boolean",
|
|
1132
|
+
"required": false,
|
|
1133
|
+
"description": "Whether multi-turn injection patterns were detected across tool calls"
|
|
1134
|
+
},
|
|
1135
|
+
{
|
|
1136
|
+
"key": "budget_remaining_pct",
|
|
1137
|
+
"type": "number",
|
|
1138
|
+
"required": false,
|
|
1139
|
+
"description": "Remaining token budget as percentage (0-100).",
|
|
1140
|
+
"range": "0-100"
|
|
1141
|
+
},
|
|
1142
|
+
{
|
|
1143
|
+
"key": "budget_exceeded",
|
|
1144
|
+
"type": "boolean",
|
|
1145
|
+
"required": false,
|
|
1146
|
+
"description": "Whether the token budget has been exceeded"
|
|
1147
|
+
},
|
|
1148
|
+
{
|
|
1149
|
+
"key": "highest_severity",
|
|
1150
|
+
"type": "string",
|
|
1151
|
+
"required": false,
|
|
1152
|
+
"description": "Highest severity level across all detection engines"
|
|
1153
|
+
},
|
|
1154
|
+
{
|
|
1155
|
+
"key": "threat_count",
|
|
1156
|
+
"type": "number",
|
|
1157
|
+
"required": false,
|
|
1158
|
+
"description": "Total number of threats detected"
|
|
1159
|
+
},
|
|
1160
|
+
{
|
|
1161
|
+
"key": "detected_threats",
|
|
1162
|
+
"type": "array",
|
|
1163
|
+
"required": false,
|
|
1164
|
+
"description": "Array of specific threat names detected"
|
|
1165
|
+
},
|
|
1166
|
+
{ "$ref": "session_keys" },
|
|
1167
|
+
{ "$ref": "agent_identity_keys" }
|
|
1168
|
+
]
|
|
1169
|
+
},
|
|
1170
|
+
{
|
|
1171
|
+
"name": "read_file",
|
|
1172
|
+
"description": "Read file operations for analyzing file content before allowing access",
|
|
1173
|
+
"context_attributes": [
|
|
1174
|
+
{
|
|
1175
|
+
"key": "role",
|
|
1176
|
+
"type": "string",
|
|
1177
|
+
"required": false,
|
|
1178
|
+
"description": "Caller's RBAC role projected from the principal's token"
|
|
1179
|
+
},
|
|
1180
|
+
{
|
|
1181
|
+
"key": "privilege_scope",
|
|
1182
|
+
"type": "array",
|
|
1183
|
+
"required": false,
|
|
1184
|
+
"description": "Privilege-scope strings granted to the caller"
|
|
1185
|
+
},
|
|
1186
|
+
{
|
|
1187
|
+
"key": "identity_type",
|
|
1188
|
+
"type": "string",
|
|
1189
|
+
"required": false,
|
|
1190
|
+
"description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
|
|
1191
|
+
},
|
|
1192
|
+
{
|
|
1193
|
+
"key": "principal",
|
|
1194
|
+
"type": "string",
|
|
1195
|
+
"required": false,
|
|
1196
|
+
"description": "Stable principal identifier"
|
|
1197
|
+
},
|
|
1198
|
+
{
|
|
1199
|
+
"key": "request_id",
|
|
1200
|
+
"type": "string",
|
|
1201
|
+
"required": true,
|
|
1202
|
+
"description": "Unique identifier for this request"
|
|
1203
|
+
},
|
|
1204
|
+
{
|
|
1205
|
+
"key": "timestamp",
|
|
1206
|
+
"type": "number",
|
|
1207
|
+
"required": true,
|
|
1208
|
+
"description": "Unix timestamp in milliseconds"
|
|
1209
|
+
},
|
|
1210
|
+
{
|
|
1211
|
+
"key": "source",
|
|
1212
|
+
"type": "string",
|
|
1213
|
+
"required": false,
|
|
1214
|
+
"description": "Traffic origin: 'ide' | 'cli' | 'api' | 'browser'"
|
|
1215
|
+
},
|
|
1216
|
+
{
|
|
1217
|
+
"key": "event",
|
|
1218
|
+
"type": "string",
|
|
1219
|
+
"required": false,
|
|
1220
|
+
"description": "Event type: 'file_read'"
|
|
1221
|
+
},
|
|
1222
|
+
{
|
|
1223
|
+
"key": "user_email",
|
|
1224
|
+
"type": "string",
|
|
1225
|
+
"required": false,
|
|
1226
|
+
"description": "Human operator email (IDE sessions)"
|
|
1227
|
+
},
|
|
1228
|
+
{
|
|
1229
|
+
"key": "cwd",
|
|
1230
|
+
"type": "string",
|
|
1231
|
+
"required": false,
|
|
1232
|
+
"description": "Current working directory"
|
|
1233
|
+
},
|
|
1234
|
+
{
|
|
1235
|
+
"key": "workspace_root",
|
|
1236
|
+
"type": "string",
|
|
1237
|
+
"required": false,
|
|
1238
|
+
"description": "IDE workspace root path"
|
|
1239
|
+
},
|
|
1240
|
+
{
|
|
1241
|
+
"key": "path",
|
|
1242
|
+
"type": "string",
|
|
1243
|
+
"required": false,
|
|
1244
|
+
"description": "File path being read. Use for path-based access control policies."
|
|
1245
|
+
},
|
|
1246
|
+
{
|
|
1247
|
+
"key": "secrets_detected",
|
|
1248
|
+
"type": "boolean",
|
|
1249
|
+
"required": false,
|
|
1250
|
+
"description": "Whether secrets were detected in the file content being read"
|
|
1251
|
+
},
|
|
1252
|
+
{
|
|
1253
|
+
"key": "secret_count",
|
|
1254
|
+
"type": "number",
|
|
1255
|
+
"required": false,
|
|
1256
|
+
"description": "Total number of secret matches found in file content"
|
|
1257
|
+
},
|
|
1258
|
+
{
|
|
1259
|
+
"key": "secret_types",
|
|
1260
|
+
"type": "array",
|
|
1261
|
+
"required": false,
|
|
1262
|
+
"description": "Array of secret types found in file content"
|
|
1263
|
+
},
|
|
1264
|
+
{
|
|
1265
|
+
"key": "pii_detected",
|
|
1266
|
+
"type": "boolean",
|
|
1267
|
+
"required": false,
|
|
1268
|
+
"description": "Whether PII was detected in the file content"
|
|
1269
|
+
},
|
|
1270
|
+
{
|
|
1271
|
+
"key": "pii_types",
|
|
1272
|
+
"type": "array",
|
|
1273
|
+
"required": false,
|
|
1274
|
+
"description": "Array of PII types found in file content"
|
|
1275
|
+
},
|
|
1276
|
+
{
|
|
1277
|
+
"key": "path_traversal_detected",
|
|
1278
|
+
"type": "boolean",
|
|
1279
|
+
"required": false,
|
|
1280
|
+
"description": "Whether path traversal patterns were detected in the file path"
|
|
1281
|
+
},
|
|
1282
|
+
{
|
|
1283
|
+
"key": "path_traversal_severity",
|
|
1284
|
+
"type": "string",
|
|
1285
|
+
"required": false,
|
|
1286
|
+
"description": "Severity of path traversal in the file path"
|
|
1287
|
+
},
|
|
1288
|
+
{
|
|
1289
|
+
"key": "path_traversal_type",
|
|
1290
|
+
"type": "string",
|
|
1291
|
+
"required": false,
|
|
1292
|
+
"description": "Type of path traversal detected"
|
|
1293
|
+
},
|
|
1294
|
+
{
|
|
1295
|
+
"key": "highest_severity",
|
|
1296
|
+
"type": "string",
|
|
1297
|
+
"required": false,
|
|
1298
|
+
"description": "Highest severity level across all detection engines"
|
|
1299
|
+
},
|
|
1300
|
+
{
|
|
1301
|
+
"key": "threat_count",
|
|
1302
|
+
"type": "number",
|
|
1303
|
+
"required": false,
|
|
1304
|
+
"description": "Total number of threats detected"
|
|
1305
|
+
},
|
|
1306
|
+
{
|
|
1307
|
+
"key": "detected_threats",
|
|
1308
|
+
"type": "array",
|
|
1309
|
+
"required": false,
|
|
1310
|
+
"description": "Array of specific threat names detected"
|
|
1311
|
+
},
|
|
1312
|
+
{
|
|
1313
|
+
"key": "budget_remaining_pct",
|
|
1314
|
+
"type": "number",
|
|
1315
|
+
"required": false,
|
|
1316
|
+
"description": "Remaining token budget as percentage (0-100).",
|
|
1317
|
+
"range": "0-100"
|
|
1318
|
+
},
|
|
1319
|
+
{
|
|
1320
|
+
"key": "budget_exceeded",
|
|
1321
|
+
"type": "boolean",
|
|
1322
|
+
"required": false,
|
|
1323
|
+
"description": "Whether the token budget has been exceeded"
|
|
1324
|
+
},
|
|
1325
|
+
{ "$ref": "session_keys" },
|
|
1326
|
+
{ "$ref": "agent_identity_keys" }
|
|
1327
|
+
]
|
|
1328
|
+
},
|
|
1329
|
+
{
|
|
1330
|
+
"name": "write_file",
|
|
1331
|
+
"description": "Write file operations for preventing writes of sensitive content",
|
|
1332
|
+
"context_attributes": [
|
|
1333
|
+
{
|
|
1334
|
+
"key": "role",
|
|
1335
|
+
"type": "string",
|
|
1336
|
+
"required": false,
|
|
1337
|
+
"description": "Caller's RBAC role projected from the principal's token"
|
|
1338
|
+
},
|
|
1339
|
+
{
|
|
1340
|
+
"key": "privilege_scope",
|
|
1341
|
+
"type": "array",
|
|
1342
|
+
"required": false,
|
|
1343
|
+
"description": "Privilege-scope strings granted to the caller"
|
|
1344
|
+
},
|
|
1345
|
+
{
|
|
1346
|
+
"key": "identity_type",
|
|
1347
|
+
"type": "string",
|
|
1348
|
+
"required": false,
|
|
1349
|
+
"description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
|
|
1350
|
+
},
|
|
1351
|
+
{
|
|
1352
|
+
"key": "principal",
|
|
1353
|
+
"type": "string",
|
|
1354
|
+
"required": false,
|
|
1355
|
+
"description": "Stable principal identifier"
|
|
1356
|
+
},
|
|
1357
|
+
{
|
|
1358
|
+
"key": "request_id",
|
|
1359
|
+
"type": "string",
|
|
1360
|
+
"required": true,
|
|
1361
|
+
"description": "Unique identifier for this request"
|
|
1362
|
+
},
|
|
1363
|
+
{
|
|
1364
|
+
"key": "timestamp",
|
|
1365
|
+
"type": "number",
|
|
1366
|
+
"required": true,
|
|
1367
|
+
"description": "Unix timestamp in milliseconds"
|
|
1368
|
+
},
|
|
1369
|
+
{
|
|
1370
|
+
"key": "source",
|
|
1371
|
+
"type": "string",
|
|
1372
|
+
"required": false,
|
|
1373
|
+
"description": "Traffic origin: 'ide' | 'cli' | 'api' | 'browser'"
|
|
1374
|
+
},
|
|
1375
|
+
{
|
|
1376
|
+
"key": "event",
|
|
1377
|
+
"type": "string",
|
|
1378
|
+
"required": false,
|
|
1379
|
+
"description": "Event type: 'file_write'"
|
|
1380
|
+
},
|
|
1381
|
+
{
|
|
1382
|
+
"key": "user_email",
|
|
1383
|
+
"type": "string",
|
|
1384
|
+
"required": false,
|
|
1385
|
+
"description": "Human operator email (IDE sessions)"
|
|
1386
|
+
},
|
|
1387
|
+
{
|
|
1388
|
+
"key": "cwd",
|
|
1389
|
+
"type": "string",
|
|
1390
|
+
"required": false,
|
|
1391
|
+
"description": "Current working directory"
|
|
1392
|
+
},
|
|
1393
|
+
{
|
|
1394
|
+
"key": "workspace_root",
|
|
1395
|
+
"type": "string",
|
|
1396
|
+
"required": false,
|
|
1397
|
+
"description": "IDE workspace root path"
|
|
1398
|
+
},
|
|
1399
|
+
{
|
|
1400
|
+
"key": "path",
|
|
1401
|
+
"type": "string",
|
|
1402
|
+
"required": false,
|
|
1403
|
+
"description": "File path being written. Use for path-based blocking policies."
|
|
1404
|
+
},
|
|
1405
|
+
{
|
|
1406
|
+
"key": "invisible_chars_detected",
|
|
1407
|
+
"type": "boolean",
|
|
1408
|
+
"required": false,
|
|
1409
|
+
"description": "Whether invisible Unicode characters were detected in the content being written"
|
|
1410
|
+
},
|
|
1411
|
+
{
|
|
1412
|
+
"key": "invisible_chars_score",
|
|
1413
|
+
"type": "number",
|
|
1414
|
+
"required": false,
|
|
1415
|
+
"description": "Invisible character attack severity score in write content (0-100).",
|
|
1416
|
+
"range": "0-100"
|
|
1417
|
+
},
|
|
1418
|
+
{
|
|
1419
|
+
"key": "secrets_detected",
|
|
1420
|
+
"type": "boolean",
|
|
1421
|
+
"required": false,
|
|
1422
|
+
"description": "Whether secrets were detected in the content being written"
|
|
1423
|
+
},
|
|
1424
|
+
{
|
|
1425
|
+
"key": "secret_count",
|
|
1426
|
+
"type": "number",
|
|
1427
|
+
"required": false,
|
|
1428
|
+
"description": "Total number of secret matches found in write content"
|
|
1429
|
+
},
|
|
1430
|
+
{
|
|
1431
|
+
"key": "secret_types",
|
|
1432
|
+
"type": "array",
|
|
1433
|
+
"required": false,
|
|
1434
|
+
"description": "Array of secret types found in write content"
|
|
1435
|
+
},
|
|
1436
|
+
{
|
|
1437
|
+
"key": "pii_detected",
|
|
1438
|
+
"type": "boolean",
|
|
1439
|
+
"required": false,
|
|
1440
|
+
"description": "Whether PII was detected in the content being written"
|
|
1441
|
+
},
|
|
1442
|
+
{
|
|
1443
|
+
"key": "pii_types",
|
|
1444
|
+
"type": "array",
|
|
1445
|
+
"required": false,
|
|
1446
|
+
"description": "Array of PII types found in write content"
|
|
1447
|
+
},
|
|
1448
|
+
{
|
|
1449
|
+
"key": "path_traversal_detected",
|
|
1450
|
+
"type": "boolean",
|
|
1451
|
+
"required": false,
|
|
1452
|
+
"description": "Whether path traversal patterns were detected in the file path"
|
|
1453
|
+
},
|
|
1454
|
+
{
|
|
1455
|
+
"key": "path_traversal_severity",
|
|
1456
|
+
"type": "string",
|
|
1457
|
+
"required": false,
|
|
1458
|
+
"description": "Severity of path traversal in the file write path"
|
|
1459
|
+
},
|
|
1460
|
+
{
|
|
1461
|
+
"key": "path_traversal_type",
|
|
1462
|
+
"type": "string",
|
|
1463
|
+
"required": false,
|
|
1464
|
+
"description": "Type of path traversal detected"
|
|
1465
|
+
},
|
|
1466
|
+
{
|
|
1467
|
+
"key": "highest_severity",
|
|
1468
|
+
"type": "string",
|
|
1469
|
+
"required": false,
|
|
1470
|
+
"description": "Highest severity level across all detection engines"
|
|
1471
|
+
},
|
|
1472
|
+
{
|
|
1473
|
+
"key": "threat_count",
|
|
1474
|
+
"type": "number",
|
|
1475
|
+
"required": false,
|
|
1476
|
+
"description": "Total number of threats detected"
|
|
1477
|
+
},
|
|
1478
|
+
{
|
|
1479
|
+
"key": "detected_threats",
|
|
1480
|
+
"type": "array",
|
|
1481
|
+
"required": false,
|
|
1482
|
+
"description": "Array of specific threat names detected"
|
|
1483
|
+
},
|
|
1484
|
+
{
|
|
1485
|
+
"key": "budget_remaining_pct",
|
|
1486
|
+
"type": "number",
|
|
1487
|
+
"required": false,
|
|
1488
|
+
"description": "Remaining token budget as percentage (0-100).",
|
|
1489
|
+
"range": "0-100"
|
|
1490
|
+
},
|
|
1491
|
+
{
|
|
1492
|
+
"key": "budget_exceeded",
|
|
1493
|
+
"type": "boolean",
|
|
1494
|
+
"required": false,
|
|
1495
|
+
"description": "Whether the token budget has been exceeded"
|
|
1496
|
+
},
|
|
1497
|
+
{ "$ref": "session_keys" },
|
|
1498
|
+
{ "$ref": "agent_identity_keys" }
|
|
1499
|
+
]
|
|
1500
|
+
},
|
|
1501
|
+
{
|
|
1502
|
+
"name": "connect_server",
|
|
1503
|
+
"description": "Connect to an MCP server, used to control which MCP servers are allowed",
|
|
1504
|
+
"context_attributes": [
|
|
1505
|
+
{
|
|
1506
|
+
"key": "role",
|
|
1507
|
+
"type": "string",
|
|
1508
|
+
"required": false,
|
|
1509
|
+
"description": "Caller's RBAC role projected from the principal's token"
|
|
1510
|
+
},
|
|
1511
|
+
{
|
|
1512
|
+
"key": "privilege_scope",
|
|
1513
|
+
"type": "array",
|
|
1514
|
+
"required": false,
|
|
1515
|
+
"description": "Privilege-scope strings granted to the caller"
|
|
1516
|
+
},
|
|
1517
|
+
{
|
|
1518
|
+
"key": "identity_type",
|
|
1519
|
+
"type": "string",
|
|
1520
|
+
"required": false,
|
|
1521
|
+
"description": "Principal identity class: 'human', 'agent', 'service', or 'mcp_server'"
|
|
1522
|
+
},
|
|
1523
|
+
{
|
|
1524
|
+
"key": "principal",
|
|
1525
|
+
"type": "string",
|
|
1526
|
+
"required": false,
|
|
1527
|
+
"description": "Stable principal identifier"
|
|
1528
|
+
},
|
|
1529
|
+
{
|
|
1530
|
+
"key": "request_id",
|
|
1531
|
+
"type": "string",
|
|
1532
|
+
"required": true,
|
|
1533
|
+
"description": "Unique identifier for this request"
|
|
1534
|
+
},
|
|
1535
|
+
{
|
|
1536
|
+
"key": "timestamp",
|
|
1537
|
+
"type": "number",
|
|
1538
|
+
"required": true,
|
|
1539
|
+
"description": "Unix timestamp in milliseconds"
|
|
1540
|
+
},
|
|
1541
|
+
{
|
|
1542
|
+
"key": "source",
|
|
1543
|
+
"type": "string",
|
|
1544
|
+
"required": false,
|
|
1545
|
+
"description": "Traffic origin: 'ide' | 'cli' | 'api' | 'browser'"
|
|
1546
|
+
},
|
|
1547
|
+
{
|
|
1548
|
+
"key": "event",
|
|
1549
|
+
"type": "string",
|
|
1550
|
+
"required": false,
|
|
1551
|
+
"description": "Event type: 'connect_server'"
|
|
1552
|
+
},
|
|
1553
|
+
{
|
|
1554
|
+
"key": "user_email",
|
|
1555
|
+
"type": "string",
|
|
1556
|
+
"required": false,
|
|
1557
|
+
"description": "Human operator email (IDE sessions)"
|
|
1558
|
+
},
|
|
1559
|
+
{
|
|
1560
|
+
"key": "cwd",
|
|
1561
|
+
"type": "string",
|
|
1562
|
+
"required": false,
|
|
1563
|
+
"description": "Current working directory"
|
|
1564
|
+
},
|
|
1565
|
+
{
|
|
1566
|
+
"key": "workspace_root",
|
|
1567
|
+
"type": "string",
|
|
1568
|
+
"required": false,
|
|
1569
|
+
"description": "IDE workspace root path"
|
|
1570
|
+
},
|
|
1571
|
+
{
|
|
1572
|
+
"key": "mcp_server",
|
|
1573
|
+
"type": "string",
|
|
1574
|
+
"required": false,
|
|
1575
|
+
"description": "Name of the MCP server being connected to"
|
|
1576
|
+
},
|
|
1577
|
+
{
|
|
1578
|
+
"key": "mcp_server_verified",
|
|
1579
|
+
"type": "boolean",
|
|
1580
|
+
"required": false,
|
|
1581
|
+
"description": "Whether the MCP server is from a verified/trusted registry"
|
|
1582
|
+
},
|
|
1583
|
+
{
|
|
1584
|
+
"key": "tool_poisoning_detected",
|
|
1585
|
+
"type": "boolean",
|
|
1586
|
+
"required": false,
|
|
1587
|
+
"description": "Whether tool poisoning was detected in the MCP server's tool descriptions"
|
|
1588
|
+
},
|
|
1589
|
+
{
|
|
1590
|
+
"key": "tool_poisoning_score",
|
|
1591
|
+
"type": "number",
|
|
1592
|
+
"required": false,
|
|
1593
|
+
"description": "Confidence score for tool poisoning in MCP server tools (0-100).",
|
|
1594
|
+
"range": "0-100"
|
|
1595
|
+
},
|
|
1596
|
+
{
|
|
1597
|
+
"key": "tool_poisoning_type",
|
|
1598
|
+
"type": "string",
|
|
1599
|
+
"required": false,
|
|
1600
|
+
"description": "Type of tool poisoning detected: 'hidden_instructions', 'system_prompt_injection', or 'authority_hijack'"
|
|
1601
|
+
},
|
|
1602
|
+
{
|
|
1603
|
+
"key": "mcp_config_risk",
|
|
1604
|
+
"type": "boolean",
|
|
1605
|
+
"required": false,
|
|
1606
|
+
"description": "Whether MCP configuration risk was detected"
|
|
1607
|
+
},
|
|
1608
|
+
{
|
|
1609
|
+
"key": "mcp_risk_type",
|
|
1610
|
+
"type": "string",
|
|
1611
|
+
"required": false,
|
|
1612
|
+
"description": "Type of MCP configuration risk: 'inline_execution', 'suspicious_url', or 'cross_origin'"
|
|
1613
|
+
},
|
|
1614
|
+
{
|
|
1615
|
+
"key": "mcp_risk_score",
|
|
1616
|
+
"type": "number",
|
|
1617
|
+
"required": false,
|
|
1618
|
+
"description": "Risk score for MCP configuration issues (0-100).",
|
|
1619
|
+
"range": "0-100"
|
|
1620
|
+
},
|
|
1621
|
+
{
|
|
1622
|
+
"key": "cross_origin_detected",
|
|
1623
|
+
"type": "boolean",
|
|
1624
|
+
"required": false,
|
|
1625
|
+
"description": "Whether cross-origin escalation patterns were detected"
|
|
1626
|
+
},
|
|
1627
|
+
{
|
|
1628
|
+
"key": "cross_origin_type",
|
|
1629
|
+
"type": "string",
|
|
1630
|
+
"required": false,
|
|
1631
|
+
"description": "Type of cross-origin escalation detected"
|
|
1632
|
+
},
|
|
1633
|
+
{
|
|
1634
|
+
"key": "cross_origin_score",
|
|
1635
|
+
"type": "number",
|
|
1636
|
+
"required": false,
|
|
1637
|
+
"description": "Risk score for cross-origin escalation (0-100).",
|
|
1638
|
+
"range": "0-100"
|
|
1639
|
+
},
|
|
1640
|
+
{
|
|
1641
|
+
"key": "highest_severity",
|
|
1642
|
+
"type": "string",
|
|
1643
|
+
"required": false,
|
|
1644
|
+
"description": "Highest severity level across all detection engines"
|
|
1645
|
+
},
|
|
1646
|
+
{
|
|
1647
|
+
"key": "threat_count",
|
|
1648
|
+
"type": "number",
|
|
1649
|
+
"required": false,
|
|
1650
|
+
"description": "Total number of threats detected"
|
|
1651
|
+
},
|
|
1652
|
+
{
|
|
1653
|
+
"key": "detected_threats",
|
|
1654
|
+
"type": "array",
|
|
1655
|
+
"required": false,
|
|
1656
|
+
"description": "Array of specific threat names detected"
|
|
1657
|
+
},
|
|
1658
|
+
{
|
|
1659
|
+
"key": "budget_remaining_pct",
|
|
1660
|
+
"type": "number",
|
|
1661
|
+
"required": false,
|
|
1662
|
+
"description": "Remaining token budget as percentage (0-100).",
|
|
1663
|
+
"range": "0-100"
|
|
1664
|
+
},
|
|
1665
|
+
{
|
|
1666
|
+
"key": "budget_exceeded",
|
|
1667
|
+
"type": "boolean",
|
|
1668
|
+
"required": false,
|
|
1669
|
+
"description": "Whether the token budget has been exceeded"
|
|
1670
|
+
},
|
|
1671
|
+
{ "$ref": "session_keys" },
|
|
1672
|
+
{ "$ref": "agent_identity_keys" }
|
|
1673
|
+
]
|
|
1674
|
+
}
|
|
1675
|
+
]
|
|
1676
|
+
}
|