agent-threat-rules 3.1.1 → 3.3.0

package/rules/tool-poisoning/ATR-2026-00419-cursor-mcp-zero-click-config.yaml

@@ -15,7 +15,7 @@ author: "ATR Community"
 date: "2026/05/04"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 
 references:
@@ -48,6 +48,9 @@ compliance:
     - article: "14"
       context: "Article 14 human oversight requirements are violated when a workspace-bound MCP config triggers tool execution before any human-reviewable signal is presented."
       strength: secondary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "GV.6.1"
       context: "Supply-chain governance under GV.6.1 must include integrity verification for any IDE / agent config file consumed at workspace-open time, since this is the canonical zero-click delivery vector."
@@ -55,10 +58,19 @@ compliance:
     - subcategory: "MS.4.1"
       context: "Measurement subcategory MS.4.1 requires monitoring of tool-invocation events including the config-load event itself; CVE-2025-54136 exploits the absence of such monitoring."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: "Operational controls must require explicit consent and integrity verification for any AI-tool config file auto-loaded by IDEs / coding assistants, blocking the zero-click vector."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00434-mcp-remote-authorization-endpoint-command-injection.yaml

@@ -53,10 +53,19 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Risk treatment under MG.2.3 must require URL-grammar validation on every server-supplied OAuth metadata field before any shell or subprocess use."
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must include detection of shell metacharacters in OAuth/OIDC discovery metadata fields consumed by MCP client tooling."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must include detection of shell metacharacters in OAuth/OIDC discovery metadata fields consumed by MCP client tooling."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00435-azure-mcp-server-missing-authentication.yaml

@@ -58,10 +58,19 @@ compliance:
     - subcategory: "GV.6.1"
       context: "Third-party MCP services (including Azure MCP Server) must be assessed under GV.6.1 supplier risk-management for authentication-on-critical-function controls before agent deployments depend on them."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must include detection of MCP server registrations pointing at endpoints lacking an authentication challenge."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must include detection of MCP server registrations pointing at endpoints lacking an authentication challenge."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00448-spring-ai-milvus-filter-injection.yaml

@@ -63,10 +63,19 @@ compliance:
     - subcategory: "MG.2.3"
       context: "Risk treatment plans under MG.2.3 must require parameterised filter construction in any code path that consumes LLM output and reaches a vector-store query / delete API."
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must prohibit LLM-generated or user-supplied content from being string-concatenated into vector-store filter expressions; parameterised filter builders are mandatory."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must prohibit LLM-generated or user-supplied content from being string-concatenated into vector-store filter expressions; parameterised filter builders are mandatory."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00494-garak-exploitation-mixedunassigned.yaml

@@ -50,6 +50,12 @@ compliance:
       subcategory: MP.5.1
       context: "Identifying tool poisoning as an AI risk to be catalogued in the organizational risk register."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (SQL Injection and Code Injection Attack Payload Detection)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (SQL Injection and Code Injection Attack Payload Detection)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Addressing tool poisoning risk is an objective required under clause 6.2 AIMS information security planning; this rule operationalizes the detection control measure."
@@ -57,6 +63,12 @@ compliance:
     - clause: "8.4"
       context: "Impact assessment for AI deployments under clause 8.4 must account for tool poisoning inputs; detection events from this rule provide the required monitoring evidence."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (SQL Injection and Code Injection Attack Payload Detection)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (SQL Injection and Code Injection Attack Payload Detection) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00513-package-hallucination-exploitation.yaml

@@ -51,6 +51,12 @@ compliance:
       subcategory: MP.5.1
       context: "Identifying tool poisoning as an AI risk to be catalogued in the organizational risk register."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Package Hallucination Exploitation — AI-Suggested Fake Package Installation)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Package Hallucination Exploitation — AI-Suggested Fake Package Installation)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Addressing tool poisoning risk is an objective required under clause 6.2 AIMS information security planning; this rule operationalizes the detection control measure."
@@ -58,6 +64,12 @@ compliance:
     - clause: "8.4"
       context: "Impact assessment for AI deployments under clause 8.4 must account for tool poisoning inputs; detection events from this rule provide the required monitoring evidence."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Package Hallucination Exploitation — AI-Suggested Fake Package Installation)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Package Hallucination Exploitation — AI-Suggested Fake Package Installation) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00521-shell-command-injection-agent-tool-context.yaml

@@ -53,6 +53,12 @@ compliance:
       subcategory: MP.5.1
       context: "Identifying tool poisoning as an AI risk to be catalogued in the organizational risk register."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Shell Command Injection in Agent Tool Context)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Shell Command Injection in Agent Tool Context)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Addressing tool poisoning risk is an objective required under clause 6.2 AIMS information security planning; this rule operationalizes the detection control measure."
@@ -60,6 +66,12 @@ compliance:
     - clause: "8.4"
       context: "Impact assessment for AI deployments under clause 8.4 must account for tool poisoning inputs; detection events from this rule provide the required monitoring evidence."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Shell Command Injection in Agent Tool Context)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Shell Command Injection in Agent Tool Context) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00522-sql-injection-natural-language-agent-interface.yaml

@@ -56,6 +56,12 @@ compliance:
       subcategory: MP.5.1
       context: "Identifying tool poisoning as an AI risk to be catalogued in the organizational risk register."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (SQL Injection via Natural Language Agent Interface)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (SQL Injection via Natural Language Agent Interface)."
+      strength: secondary
   iso_42001:
     - clause: "6.2"
       context: "Addressing tool poisoning risk is an objective required under clause 6.2 AIMS information security planning; this rule operationalizes the detection control measure."
@@ -63,6 +69,12 @@ compliance:
     - clause: "8.4"
       context: "Impact assessment for AI deployments under clause 8.4 must account for tool poisoning inputs; detection events from this rule provide the required monitoring evidence."
       strength: secondary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (SQL Injection via Natural Language Agent Interface)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (SQL Injection via Natural Language Agent Interface) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00526-claude-code-shell-metachar-in-double-quoted-path.yaml

@@ -51,6 +51,9 @@ compliance:
         Article 15 robustness against manipulation requires defending
         against this specific shell metacharacter bypass class.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path)."
+      strength: secondary
   nist_ai_rmf:
     - function: Manage
       subcategory: MG.2.3
@@ -58,12 +61,24 @@ compliance:
         MG.2.3 runtime risk treatment — detecting the metacharacter
         shape blocks the exploit before shell execution.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path)."
+      strength: secondary
   iso_42001:
     - clause: "8.4"
       context: >
         AIMS impact assessment for AI tool integrations must cover
         path-injection RCE; this rule is the detection control.
       strength: primary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00529-litellm-proxy-sqli-cisa-kev.yaml

@@ -48,6 +48,9 @@ compliance:
         Article 15 robustness — defending AI proxies against SQL injection
         is required for high-risk AI systems with persistent state.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08))."
+      strength: secondary
   nist_ai_rmf:
     - function: Manage
       subcategory: MG.2.3
@@ -55,12 +58,24 @@ compliance:
         Runtime risk treatment for AI proxy components includes detection
         of injection metacharacters reaching SQL boundary.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08))."
+      strength: secondary
   iso_42001:
     - clause: "8.4"
       context: >
         AIMS impact assessment must cover the proxy SQL surface;
         detection events feed the required monitoring trail.
       strength: primary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08))."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00530-ms-agent-shell-tool-unsanitized-argv-rce.yaml

@@ -50,6 +50,9 @@ compliance:
         Article 15 robustness explicitly requires defending agent tool
         wrappers against prompt-to-RCE primitives.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256))."
+      strength: secondary
   nist_ai_rmf:
     - function: Manage
       subcategory: MG.2.3
@@ -57,6 +60,12 @@ compliance:
         MG.2.3 runtime risk treatment — detection on unsafe shell-tool
         invocation prevents the exploit before shell execution.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256))."
+      strength: secondary
   iso_42001:
     - clause: "8.4"
       context: >
@@ -64,6 +73,12 @@ compliance:
         prompt-to-RCE shell vectors; detection events feed the
         monitoring trail.
       strength: primary
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256))."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml

@@ -62,10 +62,19 @@ compliance:
       function: Govern
       context: "Third-party multi-agent frameworks (including PraisonAI) must be assessed under GV.6.1 supplier risk management for missing-authentication-on-critical-function controls before agent pipelines depend on them."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must detect and block tool invocations targeting PraisonAI agent execution endpoints without a verified authentication mechanism."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must detect and block tool invocations targeting PraisonAI agent execution endpoints without a verified authentication mechanism."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00532-apache-doris-mcp-sql-injection.yaml

@@ -58,10 +58,19 @@ compliance:
       function: Govern
       context: "Database MCP servers (including Apache Doris) must be assessed for input validation controls before agent pipelines depend on them."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Apache Doris MCP Server SQL Injection (CVE-2025-66335))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Apache Doris MCP Server SQL Injection (CVE-2025-66335))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must detect SQL injection payloads in MCP tool call arguments before they reach database execution."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must detect SQL injection payloads in MCP tool call arguments before they reach database execution."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Apache Doris MCP Server SQL Injection (CVE-2025-66335)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml

@@ -57,10 +57,19 @@ compliance:
       function: Govern
       context: "Database MCP servers must be assessed for missing authentication controls before agent pipelines depend on them."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover)."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: "Operational controls must detect and block unauthenticated MCP tool invocations targeting Apache Pinot cluster management endpoints."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00534-alibaba-rds-mcp-unauthenticated-metadata-exfil.yaml

@@ -59,10 +59,19 @@ compliance:
       function: Govern
       context: "Cloud provider MCP tools with unpatched authentication gaps require compensating controls under GV.6.1 supplier risk management."
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration)."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: "Operational controls must detect MCP tool calls that would expose Alibaba RDS credentials or schema to unauthenticated callers."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00536-nginx-ui-mcp-unauthenticated-command-execution.yaml

@@ -64,10 +64,19 @@ compliance:
       function: Govern
       context: "Third-party MCP-enabled server tools (including nginx-ui) must be assessed under GV.6.1 supplier risk management for missing-authentication-on-critical-function controls before agent pipelines depend on them."
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
-      context: "Operational controls under clause 8.6 must detect and block MCP server registrations or tool invocations targeting nginx-ui command-execution endpoints without a verified authentication mechanism."
+    - clause: "8.1"
+      context: "Operational controls under clause 8.1 must detect and block MCP server registrations or tool invocations targeting nginx-ui command-execution endpoints without a verified authentication mechanism."
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00537-fastmcp-server-name-cmd-injection-windows.yaml

@@ -76,13 +76,22 @@ compliance:
         `[A-Za-z0-9\-_.\ ]` on any MCP server name field that flows into a
         shell-backed installer, mirroring the FastMCP 3.2.0 patch.
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
-        Operational controls under clause 8.6 must detect cmd.exe metacharacters
+        Operational controls under clause 8.1 must detect cmd.exe metacharacters
         in MCP server name fields to prevent installation-time command injection
         on Windows agent infrastructure.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00538-langchain-chatchat-mcp-stdio-unauthenticated-rce.yaml

@@ -85,13 +85,22 @@ compliance:
         management interfaces and deny arbitrary binary values in command
         fields (enforce an allowlist of approved MCP server executables).
       strength: secondary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block unauthenticated MCP STDIO
         server registration attempts carrying shell-binary command fields and
         RCE argument patterns.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00540-praisonai-parse-mcp-command-cli-injection.yaml

@@ -55,6 +55,9 @@ compliance:
         AI agent CLI interfaces validate user-controlled parameters before any
         subprocess execution.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: >
@@ -62,12 +65,21 @@ compliance:
         an adversarial input attack; MP.5.1 requires scanning MCP CLI arguments
         for inline-exec flags and shell metacharacters.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block PraisonAI --mcp arguments
         containing shell interpreter inline-exec primitives before process launch.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00541-agent-zero-mcp-config-command-injection.yaml

@@ -60,6 +60,9 @@ compliance:
         mandate that AI agent configuration interfaces sanitize command parameters
         before execution.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: >
@@ -67,13 +70,22 @@ compliance:
         constitute an adversarial input; MP.5.1 requires scanning MCP server config
         for shell-binary command fields and inline-exec argument patterns.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block Agent Zero mcp_servers
         configurations containing shell binary command fields before agent
         MCP server initialisation.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00542-upsonic-mcp-command-allowlist-bypass.yaml

@@ -58,6 +58,9 @@ compliance:
         requirements mandate that AI agent configuration interfaces validate
         command parameters before execution.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: >
@@ -65,13 +68,22 @@ compliance:
         constitute an adversarial input; MP.5.1 requires scanning MCP server
         config for shell-binary command fields and inline-exec argument patterns.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block Upsonic mcp_servers
         configurations containing shell binary command fields before agent
         MCP server initialisation.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning

package/rules/tool-poisoning/ATR-2026-00543-litellm-mcp-server-argv-injection.yaml

@@ -59,6 +59,9 @@ compliance:
         subprocess execution; Article 15 cybersecurity requirements mandate
         that AI proxy server-creation APIs validate command parameters.
       strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623))."
+      strength: secondary
   nist_ai_rmf:
     - subcategory: "MP.5.1"
       context: >
@@ -66,13 +69,22 @@ compliance:
         subprocess constitute an adversarial input; MP.5.1 requires scanning
         LiteLLM MCP registration payloads for shell-binary command fields.
       strength: primary
+    - subcategory: "MS.2.7"
+      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623))."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623))."
+      strength: secondary
   iso_42001:
-    - clause: "8.6"
+    - clause: "8.1"
       context: >
         Operational controls must detect and block LiteLLM MCP server
         registration payloads containing shell binary command fields before
         proxy-side subprocess spawning.
       strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623)) as a treatment control."
+      strength: secondary
 
 tags:
   category: tool-poisoning