agent-threat-rules 4.0.0 → 4.2.0

package/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml

@@ -1,82 +1,70 @@
-title: "Apache Pinot MCP Unauthenticated Remote Cluster Takeover"
+title: Apache Pinot MCP Unauthenticated Remote Cluster Takeover
 id: ATR-2026-00533
 rule_version: 1
 status: experimental
-description: >
-  Detects unauthenticated access to Apache Pinot MCP server cluster management
-  endpoints. Apache Pinot MCP exposes cluster administration operations
-  (schema modification, table deletion, segment management) without requiring
-  authentication, allowing any network-reachable caller to take over the cluster
-  via MCP tool calls. Detection covers (a) MCP configs pointing at Pinot
-  endpoints without auth, (b) tool calls invoking Pinot cluster management
-  functions without auth context, (c) content describing the unauthenticated
-  surface. CWE-306 (Missing Authentication for Critical Function).
-author: "ATR Community"
-date: "2026/05/20"
-schema_version: "0.1"
+description: |
+  Detects unauthenticated access to Apache Pinot MCP server cluster management endpoints. Apache Pinot MCP exposes cluster administration operations (schema modification, table deletion, segment management) without requiring authentication, allowing any network-reachable caller to take over the cluster via MCP tool calls. Detection covers (a) MCP configs pointing at Pinot endpoints without auth, (b) tool calls invoking Pinot cluster management functions without auth context, (c) content describing the unauthenticated surface. CWE-306 (Missing Authentication for Critical Function).
+author: ATR Community
+date: 2026/05/20
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: critical
-
 references:
   owasp_llm:
-    - "LLM06:2025"
-    - "LLM05:2025"
+    - LLM06:2025
+    - LLM05:2025
   owasp_agentic:
-    - "ASI05:2026"
-    - "ASI06:2026"
+    - ASI05:2026
+    - ASI06:2026
   mitre_atlas:
-    - "AML.T0049 - Exploit Public-Facing Application"
+    - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:
-    - "T1190 - Exploit Public-Facing Application"
-    - "T1078 - Valid Accounts"
-
+    - T1190 - Exploit Public-Facing Application
+    - T1078 - Valid Accounts
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
-
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "Apache Pinot MCP exposes cluster management without authentication; Article 15 requires AI tool servers to enforce authentication on all administrative functions."
+    - article: '15'
+      context: Apache Pinot MCP exposes cluster management without authentication; Article 15 requires AI tool servers to enforce authentication on all administrative functions.
       strength: primary
-    - article: "9"
-      context: "Article 9 risk management must enumerate unauthenticated cluster management endpoints as a critical threat for any agent-integrated real-time analytics infrastructure."
+    - article: '9'
+      context: Article 9 risk management must enumerate unauthenticated cluster management endpoints as a critical threat for any agent-integrated real-time analytics infrastructure.
       strength: primary
   nist_ai_rmf:
     - function: Manage
       subcategory: MG.2.3
-      context: "Runtime detection of unauthenticated MCP tool calls against Apache Pinot cluster management is the primary risk treatment."
+      context: Runtime detection of unauthenticated MCP tool calls against Apache Pinot cluster management is the primary risk treatment.
       strength: primary
     - function: Map
       subcategory: MP.5.1
-      context: "Unauthenticated real-time analytics cluster management surfaces must be catalogued in the organizational AI risk register."
+      context: Unauthenticated real-time analytics cluster management surfaces must be catalogued in the organizational AI risk register.
       strength: secondary
     - subcategory: GV.6.1
       function: Govern
-      context: "Database MCP servers must be assessed for missing authentication controls before agent pipelines depend on them."
+      context: Database MCP servers must be assessed for missing authentication controls before agent pipelines depend on them.
       strength: secondary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover)."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover).
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover)."
+    - subcategory: MG.3.2
+      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover).
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "Operational controls must detect and block unauthenticated MCP tool invocations targeting Apache Pinot cluster management endpoints."
+    - clause: '8.1'
+      context: Operational controls must detect and block unauthenticated MCP tool invocations targeting Apache Pinot cluster management endpoints.
       strength: primary
-    - clause: "8.3"
-      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover) as a treatment control."
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Apache Pinot MCP Unauthenticated Remote Cluster Takeover) as a treatment control.
       strength: secondary
-
 tags:
   category: tool-poisoning
   subcategory: mcp-missing-authentication
   scan_target: mcp
   confidence: high
-
 agent_source:
   type: mcp_exchange
   framework:
@@ -84,77 +72,31 @@ agent_source:
     - any
   provider:
     - any
-
 detection:
   condition: any
   false_positives:
-    - "Internal Pinot deployments behind authenticated VPN perimeter."
-    - "Security scanning tooling probing Pinot MCP for authentication bypass."
-    - "Educational documentation describing Pinot MCP architecture."
+    - Internal Pinot deployments behind authenticated VPN perimeter.
+    - Security scanning tooling probing Pinot MCP for authentication bypass.
+    - Educational documentation describing Pinot MCP architecture.
   conditions:
-    # -- Layer 1: Pinot cluster management tool call without auth --
     - field: tool_response
       operator: regex
-      value: "(?i)\"(?:name|tool)\"\\s*:\\s*\"(?:pinot_(?:create|delete|update|drop|add|modify|alter)_(?:table|schema|segment|tenant|instance)|apache[_\\-]?pinot[_\\-](?:admin|manage|cluster|delete|drop))[^\"]{0,60}\"(?:(?!(?:authorization|bearer|api[_\\-]?key|x-api-key|token|x-auth))[\\s\\S]){0,500}"
-      description: "MCP tool call targeting Apache Pinot cluster management function without auth — unauthenticated takeover vector"
-
-    # -- Layer 2: Pinot MCP endpoint in config without auth --
+      value: (?i)"(?:name|tool)"\s*:\s*"(?:pinot_(?:create|delete|update|drop|add|modify|alter)_(?:table|schema|segment|tenant|instance)|apache[_\-]?pinot[_\-](?:admin|manage|cluster|delete|drop))[^"]{0,60}"(?:(?!(?:authorization|bearer|api[_\-]?key|x-api-key|token|x-auth))[\s\S]){0,500}
+      description: MCP tool call targeting Apache Pinot cluster management function without auth — unauthenticated takeover vector
     - field: tool_response
       operator: regex
-      value: "(?i)\"url\"\\s*:\\s*\"https?://[^\"]{0,120}(?:apache[_\\-]?pinot|pinot[_\\-]?mcp|pinot\\.apache)[^\"]{0,60}(?:/mcp|/tools?|/controller|/api)[^\"]*\"(?![\\s\\S]{0,400}\"(?:auth|headers?|token|apiKey|authorization|bearer)\")"
-      description: "MCP server config pointing at Apache Pinot endpoint without auth — unauthenticated management surface"
-
-    # -- Layer 3: Pinot unauthenticated surface in content --
+      value: (?i)"url"\s*:\s*"https?://[^"]{0,120}(?:apache[_\-]?pinot|pinot[_\-]?mcp|pinot\.apache)[^"]{0,60}(?:/mcp|/tools?|/controller|/api)[^"]*"(?![\s\S]{0,400}"(?:auth|headers?|token|apiKey|authorization|bearer)")
+      description: MCP server config pointing at Apache Pinot endpoint without auth — unauthenticated management surface
     - field: content
       operator: regex
-      value: "(?i)apache[_\\-]?pinot[^\\n]{0,200}(?:mcp|tool\\s+call|endpoint)[^\\n]{0,200}(?:no\\s+auth|missing\\s+auth|unauth(?:enticated)?|without\\s+(?:auth|credentials?|token)|bypass|remote\\s+takeover|cluster\\s+(?:admin|management|takeover))"
-      description: "Content describing Apache Pinot MCP unauthenticated cluster takeover surface"
-
+      value: (?i)apache[_\-]?pinot[^\n]{0,200}(?:mcp|tool\s+call|endpoint)[^\n]{0,200}(?:no\s+auth|missing\s+auth|unauth(?:enticated)?|without\s+(?:auth|credentials?|token)|bypass|remote\s+takeover|cluster\s+(?:admin|management|takeover))
+      description: Content describing Apache Pinot MCP unauthenticated cluster takeover surface
 response:
   actions:
     - block_tool
     - alert
     - escalate
   auto_response_threshold: critical
-  message_template: >
-    [ATR-2026-00533] CRITICAL: Apache Pinot MCP unauthenticated cluster
-    management detected. MCP tool call targets Apache Pinot cluster
-    administration without authentication. Block tool invocation immediately;
-    enforce authentication on all Pinot MCP endpoints.
-
+  message_template: |
+    [ATR-2026-00533] CRITICAL: Apache Pinot MCP unauthenticated cluster management detected. MCP tool call targets Apache Pinot cluster administration without authentication. Block tool invocation immediately; enforce authentication on all Pinot MCP endpoints.
 confidence: 80
-
-test_cases:
-  true_positives:
-    - input: '{"name":"pinot_delete_table","arguments":{"tableName":"user_events"}}'
-      expected: triggered
-      description: "Unauthenticated Pinot table deletion via MCP tool call"
-    - input: '{"mcpServers":{"pinot-analytics":{"url":"http://apache-pinot.internal/mcp"}}}'
-      expected: triggered
-      description: "Pinot MCP config without auth field — unauthenticated surface"
-    - input: '{"name":"apache_pinot_admin","arguments":{"operation":"drop_schema","schema":"prod_users"}}'
-      expected: triggered
-      description: "Unauthenticated Pinot schema drop via MCP"
-    - input: 'apache-pinot MCP cluster management endpoint has no auth — unauthenticated remote takeover possible via tool calls'
-      expected: triggered
-      description: "Content describing unauthenticated Pinot cluster takeover"
-  true_negatives:
-    - input: '{"mcpServers":{"pinot":{"url":"http://pinot.internal/mcp","headers":{"Authorization":"Bearer token"}}}}'
-      expected: not_triggered
-      description: "Pinot MCP config with Authorization header — properly authenticated"
-    - input: '{"name":"pinot_query","arguments":{"sql":"SELECT count(*) FROM orders"}}'
-      expected: not_triggered
-      description: "Read-only Pinot query without cluster management pattern"
-    - input: "Apache Pinot documentation: configure authentication before exposing the controller API."
-      expected: not_triggered
-      description: "Defensive documentation about Pinot authentication"
-
-evasion_tests:
-  - input: '{"mcpServers":{"realtime-db":{"url":"http://10.0.0.8:9000/mcp"}}}'
-    expected: not_triggered
-    bypass_technique: ip_only_no_pinot_name
-    notes: "Generic key and raw IP — no pinot substring in URL evades Layer 2. Attacker renames endpoint path."
-  - input: '{"name":"PINOT_DELETE_TABLE","arguments":{"tableName":"users"}}'
-    expected: triggered
-    bypass_technique: case_variation
-    notes: "Case-insensitive flag covers uppercase tool name."

package/rules/tool-poisoning/ATR-2026-00534-alibaba-rds-mcp-unauthenticated-metadata-exfil.yaml

@@ -1,84 +1,70 @@
-title: "Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration"
+title: Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration
 id: ATR-2026-00534
 rule_version: 1
 status: experimental
-description: >
-  Detects unauthenticated access to Alibaba RDS MCP server metadata endpoints.
-  The Alibaba RDS MCP server exposes database schema, connection strings, and
-  credential metadata without requiring authentication. Alibaba confirmed the
-  vulnerability but declined to patch it, leaving all deployments permanently
-  exposed. An unauthenticated attacker can enumerate databases, extract schema
-  structures, and obtain connection credentials via MCP tool calls.
-  Detection covers (a) MCP configs pointing at Alibaba RDS endpoints without
-  auth, (b) tool calls invoking RDS metadata functions without auth context,
-  (c) content describing the unpatched unauthenticated surface.
-  CWE-306 (Missing Authentication), CWE-200 (Exposure of Sensitive Information).
-author: "ATR Community"
-date: "2026/05/20"
-schema_version: "0.1"
+description: |
+  Detects unauthenticated access to Alibaba RDS MCP server metadata endpoints. The Alibaba RDS MCP server exposes database schema, connection strings, and credential metadata without requiring authentication. Alibaba confirmed the vulnerability but declined to patch it, leaving all deployments permanently exposed. An unauthenticated attacker can enumerate databases, extract schema structures, and obtain connection credentials via MCP tool calls. Detection covers (a) MCP configs pointing at Alibaba RDS endpoints without auth, (b) tool calls invoking RDS metadata functions without auth context, (c) content describing the unpatched unauthenticated surface. CWE-306 (Missing Authentication), CWE-200 (Exposure of Sensitive Information).
+author: ATR Community
+date: 2026/05/20
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: high
-
 references:
   owasp_llm:
-    - "LLM06:2025"
-    - "LLM02:2025"
+    - LLM06:2025
+    - LLM02:2025
   owasp_agentic:
-    - "ASI06:2026"
-    - "ASI03:2026"
+    - ASI06:2026
+    - ASI03:2026
   mitre_atlas:
-    - "AML.T0049 - Exploit Public-Facing Application"
+    - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:
-    - "T1190 - Exploit Public-Facing Application"
-    - "T1552 - Unsecured Credentials"
-
+    - T1190 - Exploit Public-Facing Application
+    - T1552 - Unsecured Credentials
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
-
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "Alibaba RDS MCP exposes database credentials and schema without authentication; Article 15 requires AI tool servers to protect sensitive data access with authentication."
+    - article: '15'
+      context: Alibaba RDS MCP exposes database credentials and schema without authentication; Article 15 requires AI tool servers to protect sensitive data access with authentication.
       strength: primary
-    - article: "9"
-      context: "Article 9 risk management must enumerate unauthenticated credential and schema exposure as a critical data-protection failure for any agent-integrated RDS tool — especially given vendor refusal to patch."
+    - article: '9'
+      context: Article 9 risk management must enumerate unauthenticated credential and schema exposure as a critical data-protection failure for any agent-integrated RDS tool — especially given vendor refusal to patch.
       strength: primary
   nist_ai_rmf:
     - function: Manage
       subcategory: MG.2.3
-      context: "Detection of unauthenticated MCP metadata calls against Alibaba RDS is the primary risk treatment given vendor non-response to the vulnerability."
+      context: Detection of unauthenticated MCP metadata calls against Alibaba RDS is the primary risk treatment given vendor non-response to the vulnerability.
       strength: primary
     - function: Map
       subcategory: MP.5.1
-      context: "Permanently unpatched credential exposure surfaces must be flagged as accepted-risk or mitigated at the network layer in the organizational AI risk register."
+      context: Permanently unpatched credential exposure surfaces must be flagged as accepted-risk or mitigated at the network layer in the organizational AI risk register.
       strength: secondary
     - subcategory: GV.6.1
       function: Govern
-      context: "Cloud provider MCP tools with unpatched authentication gaps require compensating controls under GV.6.1 supplier risk management."
+      context: Cloud provider MCP tools with unpatched authentication gaps require compensating controls under GV.6.1 supplier risk management.
       strength: primary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration)."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration).
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration)."
+    - subcategory: MG.3.2
+      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration).
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "Operational controls must detect MCP tool calls that would expose Alibaba RDS credentials or schema to unauthenticated callers."
+    - clause: '8.1'
+      context: Operational controls must detect MCP tool calls that would expose Alibaba RDS credentials or schema to unauthenticated callers.
       strength: primary
-    - clause: "8.3"
-      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration) as a treatment control."
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Alibaba RDS MCP Unauthenticated Database Metadata Exfiltration) as a treatment control.
       strength: secondary
-
 tags:
   category: tool-poisoning
   subcategory: mcp-missing-authentication
   scan_target: mcp
   confidence: high
-
 agent_source:
   type: mcp_exchange
   framework:
@@ -87,78 +73,31 @@ agent_source:
   provider:
     - alibaba
     - any
-
 detection:
   condition: any
   false_positives:
-    - "Internal Alibaba RDS deployments behind authenticated VPN."
-    - "Security scanning tooling probing the Alibaba RDS MCP endpoint."
-    - "Educational content describing the vulnerability."
+    - Internal Alibaba RDS deployments behind authenticated VPN.
+    - Security scanning tooling probing the Alibaba RDS MCP endpoint.
+    - Educational content describing the vulnerability.
   conditions:
-    # -- Layer 1: RDS metadata/credential tool call without auth --
     - field: tool_response
       operator: regex
-      value: "(?i)\"(?:name|tool)\"\\s*:\\s*\"(?:rds_(?:describe|list|get|fetch)_(?:instances?|databases?|schemas?|credentials?|connection[_\\-]?strings?|accounts?|passwords?)|alibaba[_\\-]rds[_\\-](?:describe|list|metadata|credentials?|schema))[^\"]{0,60}\"(?:(?!(?:authorization|bearer|api[_\\-]?key|x-api-key|token|x-auth))[\\s\\S]){0,500}"
-      description: "MCP tool call targeting Alibaba RDS metadata or credential enumeration without auth — unauthenticated exfiltration vector"
-
-    # -- Layer 2: Alibaba RDS MCP endpoint in config without auth --
+      value: (?i)"(?:name|tool)"\s*:\s*"(?:rds_(?:describe|list|get|fetch)_(?:instances?|databases?|schemas?|credentials?|connection[_\-]?strings?|accounts?|passwords?)|alibaba[_\-]rds[_\-](?:describe|list|metadata|credentials?|schema))[^"]{0,60}"(?:(?!(?:authorization|bearer|api[_\-]?key|x-api-key|token|x-auth))[\s\S]){0,500}
+      description: MCP tool call targeting Alibaba RDS metadata or credential enumeration without auth — unauthenticated exfiltration vector
     - field: tool_response
       operator: regex
-      value: "(?i)\"url\"\\s*:\\s*\"https?://[^\"]{0,120}(?:alibaba[_\\-]?rds|aliyun[_\\-]?rds|rds\\.aliyuncs\\.com|rds[_\\-]mcp\\.alibaba)[^\"]{0,60}(?:/mcp|/tools?|/api|/metadata)[^\"]*\"(?![\\s\\S]{0,400}\"(?:auth|headers?|token|apiKey|authorization|bearer)\")"
-      description: "MCP config pointing at Alibaba RDS endpoint without auth — unpatched credential exposure surface"
-
-    # -- Layer 3: Alibaba RDS unpatched surface in content --
+      value: (?i)"url"\s*:\s*"https?://[^"]{0,120}(?:alibaba[_\-]?rds|aliyun[_\-]?rds|rds\.aliyuncs\.com|rds[_\-]mcp\.alibaba)[^"]{0,60}(?:/mcp|/tools?|/api|/metadata)[^"]*"(?![\s\S]{0,400}"(?:auth|headers?|token|apiKey|authorization|bearer)")
+      description: MCP config pointing at Alibaba RDS endpoint without auth — unpatched credential exposure surface
     - field: content
       operator: regex
-      value: "(?i)alibaba[_\\-]?rds[^\\n]{0,200}(?:mcp|tool\\s+call|endpoint)[^\\n]{0,200}(?:no\\s+auth|missing\\s+auth|unauth(?:enticated)?|without\\s+(?:auth|credentials?|token)|vendor\\s+(?:refuse|declined|won.t\\s+patch|unpatched)|exfil(?:trat)?|credentials?\\s+(?:exposed?|leak)|connection\\s+string)"
-      description: "Content describing Alibaba RDS MCP unauthenticated credential exfiltration — vendor-refused-to-patch surface"
-
+      value: (?i)alibaba[_\-]?rds[^\n]{0,200}(?:mcp|tool\s+call|endpoint)[^\n]{0,200}(?:no\s+auth|missing\s+auth|unauth(?:enticated)?|without\s+(?:auth|credentials?|token)|vendor\s+(?:refuse|declined|won.t\s+patch|unpatched)|exfil(?:trat)?|credentials?\s+(?:exposed?|leak)|connection\s+string)
+      description: Content describing Alibaba RDS MCP unauthenticated credential exfiltration — vendor-refused-to-patch surface
 response:
   actions:
     - block_tool
     - alert
     - escalate
   auto_response_threshold: high
-  message_template: >
-    [ATR-2026-00534] HIGH: Alibaba RDS MCP unauthenticated metadata/credential
-    exfiltration detected. MCP tool call targets Alibaba RDS schema or credential
-    metadata without authentication. Note: Alibaba confirmed this vulnerability
-    but declined to patch — apply network-layer controls immediately and remove
-    Alibaba RDS MCP from agent toolchains until a compensating control is in place.
-
+  message_template: |
+    [ATR-2026-00534] HIGH: Alibaba RDS MCP unauthenticated metadata/credential exfiltration detected. MCP tool call targets Alibaba RDS schema or credential metadata without authentication. Note: Alibaba confirmed this vulnerability but declined to patch — apply network-layer controls immediately and remove Alibaba RDS MCP from agent toolchains until a compensating control is in place.
 confidence: 81
-
-test_cases:
-  true_positives:
-    - input: '{"name":"rds_describe_instances","arguments":{"region":"cn-hangzhou"}}'
-      expected: triggered
-      description: "Unauthenticated Alibaba RDS instance enumeration via MCP"
-    - input: '{"name":"rds_get_credentials","arguments":{"instanceId":"rm-abc123"}}'
-      expected: triggered
-      description: "Unauthenticated credential retrieval from Alibaba RDS via MCP"
-    - input: '{"mcpServers":{"alibaba-rds":{"url":"https://rds.aliyuncs.com/mcp"}}}'
-      expected: triggered
-      description: "Alibaba RDS MCP config without auth field"
-    - input: 'alibaba-rds MCP endpoint exposes connection strings without auth — vendor declined to patch, unauthenticated callers can exfiltrate credentials'
-      expected: triggered
-      description: "Content describing vendor-unpatched Alibaba RDS credential exposure"
-  true_negatives:
-    - input: '{"mcpServers":{"rds":{"url":"https://rds.aliyuncs.com/mcp","headers":{"Authorization":"Bearer token"}}}}'
-      expected: not_triggered
-      description: "Alibaba RDS MCP config WITH Authorization header"
-    - input: '{"name":"rds_query","arguments":{"sql":"SELECT COUNT(*) FROM orders"}}'
-      expected: not_triggered
-      description: "Read-only RDS query without metadata/credential access pattern"
-    - input: "Mitigate Alibaba RDS MCP exposure by placing a reverse proxy with authentication in front of the endpoint."
-      expected: not_triggered
-      description: "Defensive mitigation guidance"
-
-evasion_tests:
-  - input: '{"mcpServers":{"cloud-db":{"url":"http://10.0.0.20:8080/mcp"}}}'
-    expected: not_triggered
-    bypass_technique: ip_only_no_alibaba_name
-    notes: "Generic key and raw IP evades Layer 2 — no alibaba/aliyun substring in URL."
-  - input: '{"name":"ALIBABA_RDS_DESCRIBE_INSTANCES","arguments":{}}'
-    expected: triggered
-    bypass_technique: case_variation
-    notes: "Case-insensitive flag covers uppercase tool name."