@panguard-ai/panguard-mcp-proxy 1.8.10 → 1.8.13

package/dist/evaluator.d.ts

@@ -38,6 +38,13 @@ interface RuleLike {
     readonly severity: string;
     readonly maturity?: string;
     readonly confirm?: string;
+    /** ATR scan_target lives on the parsed rule under tags (rich vocab: mcp /
+     *  tool_args / skill / host / code / any / llm_io / ...). Used by the built-in-
+     *  tool surface gate to skip MCP-argument rules on a native shell command. */
+    readonly tags?: {
+        readonly scan_target?: string;
+        readonly subcategory?: string;
+    };
 }
 /**
  * Whether a single rule match is strong enough to HARD-DENY a live tool call
@@ -56,7 +63,7 @@ interface RuleLike {
  * Pure + exported so the policy is unit-tested independently of which live rule
  * happens to match (the rule corpus changes daily; this policy must not).
  */
-export declare function shouldHardDeny(rule: RuleLike): boolean;
+export declare function shouldHardDeny(rule: RuleLike, builtinToolSurface?: boolean): boolean;
 export declare class ProxyEvaluator {
     private readonly engine;
     private rulesLoaded;
@@ -109,7 +116,7 @@ export declare class ProxyEvaluator {
      * The old hardcoded 'mcp_exchange' both missed the tool_call attack rules
      * and false-fired multi_agent_comm rules on ordinary commands.
      */
-    evaluateToolCall(toolName: string, args: Record<string, unknown>, eventType?: AgentEvent['type']): Promise<EvalResult>;
+    evaluateToolCall(toolName: string, args: Record<string, unknown>, eventType?: AgentEvent['type'], builtinToolSurface?: boolean): Promise<EvalResult>;
     /**
      * Evaluate a tool response (PostToolUse) — the indirect-prompt-injection path.
      *

package/dist/evaluator.js

@@ -38,6 +38,20 @@ function findRulesDir() {
  * silently break the fail-open contract.
  */
 export const EVALUATION_ERROR_SENTINEL = 'evaluation-error';
+/**
+ * The ONLY rule subcategories whose detection keys on shell METACHARACTERS
+ * (`;` `|` `$()` `&&`) — the grammar that is anomalous inside an MCP tool
+ * argument but NORMAL in the agent's own shell. Only these may degrade on the
+ * built-in-tool surface. Everything else scoped scan_target:mcp (credential-theft,
+ * env-var-harvesting, tool-poisoning, ...) detects malicious SEMANTICS that are
+ * illegitimate on any shell and MUST keep hard-blocking there. 1.8.12 wrongly
+ * gated the whole scan_target:mcp class, which silently degraded credential theft
+ * (`cat ~/.ssh/id_rsa`) to an advisory on the agent's own shell — a shipped hole.
+ */
+const SHELL_METACHAR_FP_SUBCATEGORIES = new Set([
+    'shell-escape',
+    'parameter-injection',
+]);
 /**
  * Whether a single rule match is strong enough to HARD-DENY a live tool call
  * (vs. degrade to 'ask'). This is the proxy's false-positive control point: the
@@ -55,9 +69,29 @@ export const EVALUATION_ERROR_SENTINEL = 'evaluation-error';
  * Pure + exported so the policy is unit-tested independently of which live rule
  * happens to match (the rule corpus changes daily; this policy must not).
  */
-export function shouldHardDeny(rule) {
+export function shouldHardDeny(rule, builtinToolSurface = false) {
     if (rule.confirm === 'embedding')
         return false;
+    if (builtinToolSurface &&
+        rule.tags?.scan_target === 'mcp' &&
+        SHELL_METACHAR_FP_SUBCATEGORIES.has(rule.tags?.subcategory ?? '')) {
+        // FALSE-POSITIVE gate for the built-in-tool hook, which guards the agent's
+        // OWN native shell (Bash/Edit/Write/WebFetch). NARROWED (1.8.13) to ONLY the
+        // shell-metacharacter-injection subcategories (shell-escape / parameter-
+        // injection — ATR-2026-00111 / 00066) that key on `;` `|` `$()` grammar.
+        // Inside an MCP argument those are anomalous and rightly deny; but they are the
+        // NORMAL grammar of a real shell, so matched against the agent's own
+        // `echo x; curl localhost` they false-block legitimate work (they only reach a
+        // tool_call event via the engine's mcp-over-tool exception). On this surface
+        // they DEGRADE to an 'ask' advisory. CRITICAL: every OTHER scan_target:mcp
+        // rule still hard-blocks here — 1.8.12 wrongly gated the whole class, which
+        // silently degraded credential theft (`cat ~/.ssh/id_rsa`, matched by the
+        // scan_target:mcp credential-theft rule 00113) to a non-blocking advisory on
+        // the agent's own shell. The MCP proxy leaves builtinToolSurface=false: on a genuine MCP
+        // ARGUMENT, `; curl` really is injection. This keys on scan_target (a rule's
+        // intrinsic scope), NOT maturity — so it never drifts with the daily corpus.
+        return false;
+    }
     if (rule.severity === 'critical')
         return true;
     return rule.severity === 'high' && rule.maturity === 'stable';
@@ -192,7 +226,13 @@ export class ProxyEvaluator {
      * The old hardcoded 'mcp_exchange' both missed the tool_call attack rules
      * and false-fired multi_agent_comm rules on ordinary commands.
      */
-    async evaluateToolCall(toolName, args, eventType = 'mcp_exchange') {
+    async evaluateToolCall(toolName, args, eventType = 'mcp_exchange', 
+    // The built-in-tool hook (guarding the agent's OWN Bash/Edit/Write) passes
+    // true: on that high-FP surface an MCP-argument rule (scan_target:mcp shell-
+    // metacharacter rule) advises instead of hard-blocking a real shell command.
+    // The MCP proxy leaves it false (default) — on a genuine MCP argument those
+    // rules correctly deny.
+    builtinToolSurface = false) {
         const start = Date.now();
         // Check Guard blocklist first (instant deny, no regex needed)
         this.refreshBlocklist();
@@ -217,7 +257,7 @@ export class ProxyEvaluator {
                 tool_input: flatContent,
             },
         };
-        return this.evaluate(event, start);
+        return this.evaluate(event, start, builtinToolSurface);
     }
     /**
      * Evaluate a tool response (PostToolUse) — the indirect-prompt-injection path.
@@ -251,7 +291,7 @@ export class ProxyEvaluator {
         };
         return this.evaluate(event, start);
     }
-    async evaluate(event, start) {
+    async evaluate(event, start, builtinToolSurface = false) {
         try {
             const matches = this.engine.evaluate(event);
             const durationMs = Date.now() - start;
@@ -284,7 +324,7 @@ export class ProxyEvaluator {
             // 'ask' advisory below, but it can never silently block the user's tool.
             // Bundled/trusted rules are unaffected. This is the arm gate for the
             // enforce path.
-            const blockMatch = matches.find((m) => shouldHardDeny(m.rule) && !this.adviseOnlyIds.has(m.rule.id));
+            const blockMatch = matches.find((m) => shouldHardDeny(m.rule, builtinToolSurface) && !this.adviseOnlyIds.has(m.rule.id));
             const askMatch = blockMatch ??
                 matches.find((m) => m.rule.severity === 'high' || m.rule.severity === 'critical');
             const outcome = blockMatch ? 'deny' : askMatch ? 'ask' : 'allow';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panguard-ai/panguard-mcp-proxy",
-  "version": "1.8.10",
+  "version": "1.8.13",
   "description": "MCP Proxy — runtime interception for AI agent tool calls using ATR rules",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,12 +21,12 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",
     "agent-threat-rules": "^3.5.8",
-    "@panguard-ai/atr": "1.8.10",
-    "@panguard-ai/containment": "0.1.0",
-    "@panguard-ai/panguard-guard": "1.8.10"
+    "@panguard-ai/atr": "1.8.13",
+    "@panguard-ai/panguard-guard": "1.8.13",
+    "@panguard-ai/containment": "0.1.0"
   },
   "peerDependencies": {
-    "@panguard-ai/atr": "1.8.10"
+    "@panguard-ai/atr": "1.8.13"
   },
   "files": [
     "dist",