@panguard-ai/panguard-mcp-proxy 1.8.9 → 1.8.12

package/dist/evaluator.d.ts

@@ -38,6 +38,12 @@ interface RuleLike {
     readonly severity: string;
     readonly maturity?: string;
     readonly confirm?: string;
+    /** ATR scan_target lives on the parsed rule under tags (rich vocab: mcp /
+     *  tool_args / skill / host / code / any / llm_io / ...). Used by the built-in-
+     *  tool surface gate to skip MCP-argument rules on a native shell command. */
+    readonly tags?: {
+        readonly scan_target?: string;
+    };
 }
 /**
  * Whether a single rule match is strong enough to HARD-DENY a live tool call
@@ -56,7 +62,7 @@ interface RuleLike {
  * Pure + exported so the policy is unit-tested independently of which live rule
  * happens to match (the rule corpus changes daily; this policy must not).
  */
-export declare function shouldHardDeny(rule: RuleLike): boolean;
+export declare function shouldHardDeny(rule: RuleLike, builtinToolSurface?: boolean): boolean;
 export declare class ProxyEvaluator {
     private readonly engine;
     private rulesLoaded;
@@ -109,7 +115,7 @@ export declare class ProxyEvaluator {
      * The old hardcoded 'mcp_exchange' both missed the tool_call attack rules
      * and false-fired multi_agent_comm rules on ordinary commands.
      */
-    evaluateToolCall(toolName: string, args: Record<string, unknown>, eventType?: AgentEvent['type']): Promise<EvalResult>;
+    evaluateToolCall(toolName: string, args: Record<string, unknown>, eventType?: AgentEvent['type'], builtinToolSurface?: boolean): Promise<EvalResult>;
     /**
      * Evaluate a tool response (PostToolUse) — the indirect-prompt-injection path.
      *

package/dist/evaluator.js

@@ -55,9 +55,28 @@ export const EVALUATION_ERROR_SENTINEL = 'evaluation-error';
  * Pure + exported so the policy is unit-tested independently of which live rule
  * happens to match (the rule corpus changes daily; this policy must not).
  */
-export function shouldHardDeny(rule) {
+export function shouldHardDeny(rule, builtinToolSurface = false) {
     if (rule.confirm === 'embedding')
         return false;
+    if (builtinToolSurface && rule.tags?.scan_target === 'mcp') {
+        // FALSE-POSITIVE gate for the built-in-tool hook, which guards the agent's
+        // OWN native shell (Bash/Edit/Write/WebFetch). Rules scoped scan_target:mcp
+        // are MCP-tool-ARGUMENT rules — e.g. ATR-2026-00111 "Shell Metacharacter
+        // Injection in Tool Arguments" / ATR-2026-00066 "Parameter Injection" — that
+        // key on shell metacharacters (`;` `|` `$()`). Inside an MCP argument those
+        // are anomalous and rightly deny; but they are the NORMAL grammar of a real
+        // shell, so matched against the agent's own `echo x; curl localhost` they
+        // false-block legitimate work (they only reach a tool_call event at all via
+        // the engine's mcp-over-tool exception). On this surface an mcp-scoped rule
+        // therefore DEGRADES to an 'ask' advisory — the caller warns, never bricks
+        // the agent. Semantic exfil/RCE rules scoped to the shell's real domain
+        // (tool_args / skill / host / code / any) still hard-block, so credential
+        // exfil (`cat ~/.ssh/id_rsa | curl`, `env | curl`) is caught regardless of
+        // this gate. The MCP proxy leaves builtinToolSurface=false: on a genuine MCP
+        // ARGUMENT, `; curl` really is injection. This keys on scan_target (a rule's
+        // intrinsic scope), NOT maturity — so it never drifts with the daily corpus.
+        return false;
+    }
     if (rule.severity === 'critical')
         return true;
     return rule.severity === 'high' && rule.maturity === 'stable';
@@ -192,7 +211,13 @@ export class ProxyEvaluator {
      * The old hardcoded 'mcp_exchange' both missed the tool_call attack rules
      * and false-fired multi_agent_comm rules on ordinary commands.
      */
-    async evaluateToolCall(toolName, args, eventType = 'mcp_exchange') {
+    async evaluateToolCall(toolName, args, eventType = 'mcp_exchange', 
+    // The built-in-tool hook (guarding the agent's OWN Bash/Edit/Write) passes
+    // true: on that high-FP surface an MCP-argument rule (scan_target:mcp shell-
+    // metacharacter rule) advises instead of hard-blocking a real shell command.
+    // The MCP proxy leaves it false (default) — on a genuine MCP argument those
+    // rules correctly deny.
+    builtinToolSurface = false) {
         const start = Date.now();
         // Check Guard blocklist first (instant deny, no regex needed)
         this.refreshBlocklist();
@@ -217,7 +242,7 @@ export class ProxyEvaluator {
                 tool_input: flatContent,
             },
         };
-        return this.evaluate(event, start);
+        return this.evaluate(event, start, builtinToolSurface);
     }
     /**
      * Evaluate a tool response (PostToolUse) — the indirect-prompt-injection path.
@@ -251,7 +276,7 @@ export class ProxyEvaluator {
         };
         return this.evaluate(event, start);
     }
-    async evaluate(event, start) {
+    async evaluate(event, start, builtinToolSurface = false) {
         try {
             const matches = this.engine.evaluate(event);
             const durationMs = Date.now() - start;
@@ -284,7 +309,7 @@ export class ProxyEvaluator {
             // 'ask' advisory below, but it can never silently block the user's tool.
             // Bundled/trusted rules are unaffected. This is the arm gate for the
             // enforce path.
-            const blockMatch = matches.find((m) => shouldHardDeny(m.rule) && !this.adviseOnlyIds.has(m.rule.id));
+            const blockMatch = matches.find((m) => shouldHardDeny(m.rule, builtinToolSurface) && !this.adviseOnlyIds.has(m.rule.id));
             const askMatch = blockMatch ??
                 matches.find((m) => m.rule.severity === 'high' || m.rule.severity === 'critical');
             const outcome = blockMatch ? 'deny' : askMatch ? 'ask' : 'allow';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panguard-ai/panguard-mcp-proxy",
-  "version": "1.8.9",
+  "version": "1.8.12",
   "description": "MCP Proxy — runtime interception for AI agent tool calls using ATR rules",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,12 +21,12 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",
     "agent-threat-rules": "^3.5.8",
-    "@panguard-ai/atr": "1.8.9",
+    "@panguard-ai/atr": "1.8.12",
     "@panguard-ai/containment": "0.1.0",
-    "@panguard-ai/panguard-guard": "1.8.9"
+    "@panguard-ai/panguard-guard": "1.8.12"
   },
   "peerDependencies": {
-    "@panguard-ai/atr": "1.8.9"
+    "@panguard-ai/atr": "1.8.12"
   },
   "files": [
     "dist",