agent-threat-rules 4.0.0 → 4.2.0

package/rules/tool-poisoning/ATR-2026-02514-mcp-server-metadata-url-html-breakout.yaml

@@ -0,0 +1,105 @@
+title: MCP Server Descriptor URL Field Carries an HTML/Script Breakout Payload
+id: ATR-2026-02514
+rule_version: 1
+status: experimental
+description: |
+  Detects a poisoned MCP server descriptor whose URL-typed metadata field carries markup instead of a URL — the payload that executes wherever a registry, catalogue or client renders server metadata.
+  Generalised from CVE-2026-44429 (MCP Registry < 1.7.7, CWE-79/CWE-116): the public catalogue interpolated server.websiteUrl into a double-quoted href via innerHTML, while server-side validation only checked that the value parsed as an absolute https URL and never rejected quote characters. A published server.json could therefore break out of the attribute and run script in every visitor's browser. The descriptor is data an MCP client ingests, so the same poisoned field reaches any surface that renders server metadata — registry UIs, client server pickers, tool inspectors.
+  Detection targets the field-type contract: a metadata key that must hold a URL, holding a value that also contains an inline event handler, a script or markup element, or a script-executing scheme. Text fields such as description are deliberately out of scope — ATR-2026-00571 already covers script payloads in rendered agent/MCP output; this rule covers the narrower case where the value's declared type makes markup unambiguously wrong.
+  Matching is confined to the INSIDE of the URL value: the bridge span is [^"\x27\n] so it cannot run past the value's closing quote into a sibling field, and the attribute-breakout condition requires an escaped quote (\") — the act of closing the attribute — before the handler. Without both constraints the rule fires on ordinary catalogue JSON that pairs a URL field with an HTML field on the same line, and on URLs whose query string happens to carry a parameter named onload=. Known blind spot accepted for precision: a single-quoted descriptor broken out with a bare double quote is not matched, because RE2 has no backreference to bind the value's delimiter.
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: medium
+references:
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI06:2026
+  mitre_atlas:
+    - AML.T0053 - LLM Plugin Compromise
+  mitre_attack:
+    - T1059.007 - JavaScript
+  cve:
+    - CVE-2026-44429
+  cwe:
+    - CWE-79
+    - CWE-116
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-44429
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  cve: human-reviewed
+  cwe: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 cybersecurity — runtime detection of markup injection carried in MCP server descriptor URL fields.
+      strength: primary
+    - article: '9'
+      context: Article 9 risk management — runtime risk-treatment control for poisoned MCP catalogue metadata.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MP.5.1
+      context: MAP 5.1 — adversarial input characterised/detected for MCP descriptor metadata poisoning.
+      strength: primary
+    - subcategory: MG.3.2
+      context: MANAGE 3.2 — runtime monitoring control for untrusted server metadata rendered to operators.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational control — detection of markup payloads in URL-typed MCP metadata fields.
+      strength: primary
+    - clause: '8.3'
+      context: Clause 8.3 AI risk treatment — runtime detection as treatment control.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: metadata-poisoning
+  scan_target: mcp
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: nvd-cve-2026-44429
+  suppress_in_code_blocks: true
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  false_positives:
+    - A data:image/... icon value — a legitimate inline image, not a script scheme.
+    - A description or documentation field whose prose mentions onload, onerror or script tags.
+    - Registry documentation explaining which characters the validator rejects.
+    - javascript:void(0) / javascript:; navigation placeholders in legacy menu JSON — excluded explicitly.
+    - 'A URL field followed on the same line by a sibling field holding HTML (logoHtml, embed, inline svg) — excluded: the bridge span cannot cross the value''s closing quote.'
+    - 'A legitimate URL whose query string contains a parameter literally named onload=/onclick= — excluded: an attribute breakout must first close the attribute with an escaped quote.'
+    - 'KNOWN RESIDUAL: unfenced source code or prose that quotes a live breakout payload verbatim (e.g. the registry''s own validator regression test) still matches. Markdown fenced/inline code blocks are suppressed; bare code is not separable by single-event regex. This is why the rule alerts rather than blocks.'
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)["\x27](?:websiteUrl|website_url|homepage|homepage_?url|documentation_?url|docs_?url|iconUrl|icon_?url|repositoryUrl|repository_?url|source_?url)\\{0,2}["\x27]\s*:\s*\\{0,2}["\x27]\s*https?://[^"\x27\n]{0,40}\\{1,2}["\x27]\s*[^"\x27\n]{0,24}\bon(?:error|load|click|focus|mouseover|mouseenter|animationstart|toggle)\s*=
+      description: |
+        A URL-typed descriptor field whose value continues past the URL into an inline event handler — the attribute breakout of CVE-2026-44429.
+    - field: content
+      operator: regex
+      value: (?i)["\x27](?:websiteUrl|website_url|homepage|homepage_?url|documentation_?url|docs_?url|iconUrl|icon_?url|repositoryUrl|repository_?url|source_?url)\\{0,2}["\x27]\s*:\s*\\{0,2}["\x27]\s*(?:(?:java|vb)script:\s*(?:[^v;"\x27\s]|v[^o"\x27\s]|vo[^i"\x27\s]|voi[^d"\x27\s]|void\s*\(\s*[^0-9)\s])|data:text/html)
+      description: |
+        A script-executing scheme where the descriptor contract requires an http(s) URL.
+    - field: content
+      operator: regex
+      value: (?i)["\x27](?:websiteUrl|website_url|homepage|homepage_?url|documentation_?url|docs_?url|iconUrl|icon_?url|repositoryUrl|repository_?url|source_?url)\\{0,2}["\x27]\s*:\s*\\{0,2}["\x27]\s*https?://[^"\x27\n]{0,40}(?:<\s*/\s*a\s*>|<\s*(?:script|img|svg|iframe)\b)
+      description: |
+        A URL-typed field whose value closes the surrounding element and opens a new markup element — the tag-breakout variant of the same flaw.
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02514] MEDIUM: an MCP server descriptor's URL-typed metadata field contains markup or a script scheme (CVE-2026-44429 class, CWE-79/CWE-116). The value breaks out of the attribute it is interpolated into. Reject the descriptor and validate that URL fields parse as http(s) and contain no quote or angle-bracket characters.
+confidence: 80

package/rules/tool-poisoning/ATR-2026-02542-pipeline-query-stage-injection.yaml

@@ -0,0 +1,95 @@
+title: Observability Query Tool Argument Appends a Pipeline Stage and Comments Out the Rest of the Query
+id: ATR-2026-02542
+rule_version: 1
+status: experimental
+description: |
+  Detects an agent tool argument that is documented as an identifier or a shorthand timeframe but whose value carries pipeline-query syntax: a `|` followed by a stage verb (`fields`, `fieldsAdd`, `filter`, `summarize`, `project`, `extend`, `parse`, `lookup`, ...) and terminated by a `//` line comment that swallows whatever the tool intended to append. That comment terminator is the tell -- a caller who merely wanted a legitimate value has no reason to comment out the rest of the server's own query. Mined from GHSA-pqh8-p93p-2rx7 (@dynatrace-oss/dynatrace-mcp-server interpolates `entityNames`, `timeframe`, `clusterId` and `kubernetesEntityId` straight into DQL strings; their Zod schemas are plain `z.string()` with no pattern validation, so `svc" | fields id, name, tags //` replaces the tool's `| fields id, name, type` stage, and `30d, to: now() | fieldsAdd internal_secret //` injects a stage before the tool's `| filter`). The impact is contract escape rather than new privilege: the tool's field selection, display caps, time-window bounds and its `readOnlyHint: true` annotation -- which MCP clients may treat as a reason to auto-approve -- are all bypassed. Written against the pipeline-and-comment shape shared by DQL, KQL and similar observability query languages rather than against Dynatrace's parameter names, because every observability MCP server that string-builds a query has the same sink.
+author: ATR Community (GHSA sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: medium
+references:
+  cwe:
+    - CWE-943
+    - CWE-20
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI05:2026
+  mitre_attack:
+    - T1213 - Data from Information Repositories
+  mitre_atlas:
+    - AML.T0053 - LLM Plugin Compromise
+  ghsa:
+    - GHSA-pqh8-p93p-2rx7
+  external:
+    - https://github.com/advisories/GHSA-pqh8-p93p-2rx7
+metadata_provenance:
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+  ghsa: ghsa-sync
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resistance to unauthorised data access; this rule detects tool arguments that inject query pipeline stages to read fields and time ranges outside the tool's declared output contract.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is the runtime risk-treatment control for the query-language-injection-via-tool-argument risk class.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Pipeline query injection through identifier-typed tool parameters is an identified AI risk requiring an active runtime countermeasure; this rule is the primary treatment implementation.
+      strength: primary
+    - subcategory: MP.5.1
+      context: MP.5.1 adversarial-input identification must enumerate observability query languages as an injection sink reachable from model-controlled tool arguments.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by this rule's detection of tool arguments that escape their declared query contract.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented by this rule's runtime detection of the injection attempt.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: pipeline-query-stage-injection
+  scan_target: both
+  confidence: medium
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)\|[ \t]{0,4}\b(?:fieldsAdd|fieldsRemove|fieldsKeep|fields|filterOut|filter|summarize|project|extend|search|parse|dedup|lookup|sort|limit)\b[^\n"\x27]{0,40}[ \t]//["\x27]
+      description: 'A pipeline stage verb introduced by | whose tail is commented out by a // that runs IMMEDIATELY into a string terminator (zero spaces). The zero-space requirement is load-bearing: in a real injection the // is the last thing inside the argument value and the quote that follows is the serialization boundary, whereas an ordinary source-code line comment always puts a space after the // before any quoted word (`// "status" is OPEN`). The bridge also forbids quotes, so a match cannot run out of the query string and land on a trailing code comment. Both were confirmed false-positive sources: with a `[^\n]{0,80}\s//\s{0,4}["\x27,}\]]` tail this fired on TypeScript, Go and Java sources that hold a DQL/KQL constant and explain a field in a trailing comment.'
+    - field: content
+      operator: regex
+      value: (?i)[:\[,][ \t]{0,4}["\x27][A-Za-z0-9_.\-]{1,40}\\{1,2}["\x27][ \t]{0,4}\|[ \t]{0,4}\b(?:fieldsAdd|fieldsRemove|fieldsKeep|fields|filterOut|filter|summarize|project|extend|parse|dedup|lookup|sort|limit)\b
+      description: 'Escaped-quote breakout, anchored at the START of the argument value: a JSON structural position (: [ ,), the opening quote, a bare identifier with no spaces or operators, and then the value immediately escaping its own quote into a pipeline stage. The start anchor is what makes this safe. A bare `\" | verb` test is NOT a breakout signal -- once a query is serialized into a tool call EVERY quote inside it is backslash-escaped, so `host == \"web-01\" | fields` (an ordinary literal comparison in DQL/KQL/SPL) has exactly the same shape as a breakout. Requiring the value to begin as a bare identifier and escape immediately separates the two, because a legitimate query never starts that way.'
+    - field: content
+      operator: regex
+      value: (?i)[a-z0-9_)\]]\\{1,2}["\x27][ \t]{0,4}(?:,[ \t]{0,4}(?:to|from)[ \t]{0,2}:|or\b|and\b)[ \t]{0,4}[^\n"\x27]{0,40}[ \t]//["\x27]
+      description: 'Escaped-quote breakout into a boolean/timeframe clause (or / and / , to: / , from:) terminated by the same zero-space // string terminator -- the tautology and prefix-injection variants of the same escape. Three hardenings, each traced to a measured false positive: the bridge forbids quotes and the // must run straight into the string terminator (the loose form fired on a JS config object, `{ from: "now()-24h", to: "now()" }; // "to" is exclusive`), and the backslash before the quote is MANDATORY rather than optional (with it optional the or-branch fired on ordinary documentation prose offering two literal choices, `the transport to "grpc" or http //"grpc" is recommended`). Inside a serialized tool argument a real breakout must escape the quote it is breaking out of; unescaped quotes are prose.'
+  false_positives:
+    - A query-authoring assistant whose legitimate job is emitting DQL/KQL, where the user genuinely asked for a pipeline whose tail is commented out and which ends exactly at the comment. Rare, because the rule requires the // to run into the string terminator with no space, whereas a human-written comment carries text.
+    - 'NOT a false positive any more, recorded because the first draft got it wrong: a legitimate query containing an escaped literal followed by another stage (`host == \" web-01 \" | fields ...`). Serialization escapes every quote in the query, so that shape is ordinary, not hostile. Condition 2 now requires the value to OPEN as a bare identifier and escape immediately.'
+    - A saved-search definition or dashboard export carried through agent context that already contains commented-out stages. The text is a stored artifact, not a live tool argument; check the event type before acting.
+    - An advisory or blog post quoting the injection payload verbatim. The payload is structurally identical to the live attack by construction.
+response:
+  actions:
+    - alert
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): no FP measurement on the benign corpus; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
+  message_template: |
+    [ATR-2026-02542] MEDIUM: an observability-query tool argument injects a pipeline stage and comments out the remainder of the server-built query. The tool's field selection, display caps, time-window bounds and any readOnlyHint-based auto-approval are being bypassed. Reject the argument and fix the server to bind values rather than interpolate them into query text.
+confidence: 65

package/rules/tool-poisoning/ATR-2026-02557-shell-separator-in-path-typed-tool-argument.yaml

@@ -0,0 +1,112 @@
+title: Shell Command Separator Inside a Path-Typed MCP Tool Argument
+id: ATR-2026-02557
+rule_version: 1
+status: experimental
+description: |
+  Detects an MCP or agent tool invocation in which a structurally path-typed argument - projectPath, file_path, directory, filename, log_file_name, cwd, output_path - carries a shell command separator followed by a command that either takes an argument (a flag, or an absolute system path) or is a bare reconnaissance binary that ends the value.
+  This is the shape reported as CVE-2026-25546 against godot-mcp, where executeOperation passed projectPath straight into exec(), so every tool that accepts a project path - create_scene, add_node, load_sprite and the rest - became a command-execution primitive. The same shape recurs across the MCP ecosystem wherever a typed path or identifier reaches a shell: MCP-for-Stata's log_file_name, and the broader family of servers that build command lines by string concatenation.
+  WHAT ADVERSARIAL MEASUREMENT CHANGED (2026-08-23). The first draft of this rule asserted that a separator inside a path argument "has no legitimate meaning". Run against the real engine, that formulation fired on 11 of 18 realistic benign samples. Separators are legal POSIX filename characters and humans use them as PUNCTUATION: "Smith; John Resume.pdf" (the Lastname; Firstname convention), "Attention Is All You Need; Vaswani et al 2017.pdf", "Terms; Conditions v4 EN.docx", "Fleet Overview | Grafana" (a browser page title used as a save-as name), "Daft Punk | Alive 2007", "/opt/tools;/opt/sdk/bin" (a semicolon-delimited search path). Structurally "| id" and "| Grafana" are the SAME string shape, so a separator plus a word token cannot be the signal.
+  What survives measurement is narrower and honest: the injected command must carry a shell TELL. Either it takes an argument that filename punctuation never takes - a flag terminated by whitespace, a quote or '=', or an absolute system path (/etc, /tmp, /var, /usr, /bin, ...) - or it is one of a deliberately tiny vocabulary of argumentless reconnaissance binaries (whoami, uname, hostname, ifconfig, netstat, lsblk, dmesg) that are not English filename words.
+  This rule therefore IS partly a command-shape test, not the pure structural test the first draft claimed. It still adds detection the corpus does not have: verified 2026-08-23 against the full loaded corpus, "; ls -la /etc", "| whoami" and "; uname" through a path-typed argument produce a match from this rule and from no other. "; cat /etc/passwd", "; python3 -c" and "out.log; touch /tmp/pwn" are already covered by ATR-2026-00066 / 00111 / 01615, so this rule is additive there rather than load-bearing.
+  CWE-78 (OS Command Injection), CWE-88 (Argument Injection), CWE-1287 (Improper Validation of Specified Type of Input).
+author: ATR Community
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-25546
+  euvd:
+    - EUVD-2026-25546
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI02:2026
+    - ASI05:2026
+  mitre_atlas:
+    - AML.T0053 - LLM Plugin Compromise
+  mitre_attack:
+    - 'T1059.004 - Command and Scripting Interpreter: Unix Shell'
+    - 'T1505.003 - Server Software Component: Web Shell'
+  external:
+    - https://github.com/Coding-Solo/godot-mcp/security/advisories
+metadata_provenance:
+  cve: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_atlas: human-reviewed
+  mitre_attack: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 requires accuracy, robustness and cybersecurity appropriate to the intended purpose. An MCP server that turns a path argument into a shell command line fails that requirement for every tool that accepts the argument; detecting the separator at call time is the compensating control while the server remains unpatched.
+      strength: primary
+    - article: '9'
+      context: Article 9 risk management must record the tool surface an agent can reach. When one unvalidated path parameter converts an entire tool family into command execution, that concentration of risk belongs in the risk register and this rule supplies the runtime evidence for it.
+      strength: secondary
+  nist_ai_rmf:
+    - function: Measure
+      subcategory: MS.2.7
+      context: MS.2.7 requires AI system security and resilience to be evaluated and documented. Inspecting typed tool arguments for shell syntax is a measurable, per-invocation control over the agent-to-tool boundary rather than an assumption that every MCP server validates its own input.
+      strength: primary
+    - function: Manage
+      subcategory: MG.3.1
+      context: MG.3.1 requires risks from third-party AI resources to be managed. MCP servers are third-party components whose input handling the deploying organisation cannot audit at scale, so enforcing argument typing at the client is the practical management control.
+      strength: primary
+    - function: Map
+      subcategory: MP.5.1
+      context: MP.5.1 requires adversarial techniques to be characterised. Argument injection through a structurally typed parameter is mapped here as distinct from command injection through a free-text command parameter, because the defensive assumption differs.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: Clause 8.1 operational control over externally provided processes covers MCP servers invoked by the agent. This rule is the operational control applied to each invocation, independent of the server's own hardening.
+      strength: primary
+    - clause: '6.2'
+      context: Clause 6.2 risk treatment requires proportionate controls. Because a single injected separator yields code execution at the server's privilege level, per-argument inspection is the proportionate treatment.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  suppress_in_code_blocks: true
+  subcategory: argument-injection-path-typed-parameter
+  scan_target: tool_args
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: godot-mcp-cve-2026-25546
+agent_source:
+  type: mcp_exchange
+  framework:
+    - mcp
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  method: pattern
+  false_positives:
+    - 'MEASURED RESIDUAL: a document that quotes the attack payload verbatim inside a FOUR-SPACE INDENTED code block still matches. The engine''s code-block suppression (tags.suppress_in_code_blocks, enabled here) covers fenced blocks, inline backticks and markdown table cells, but not indented blocks - so a fenced or inline advisory is clean and an indented one is not. Verified 2026-08-23: the fenced advisory, the inline-backtick advisory, the CHANGELOG prose and this rule''s own YAML test cases are all clean; only the indented form fires.'
+    - Security test suites, MCP server fixtures and CVE reproductions that pass a deliberately malicious path argument will match, which is the intended behaviour for a detection corpus.
+    - A path-typed argument whose value legitimately contains a separator followed by a lowercase word AND a flag-shaped token - for example a filename fragment written as 'draft -final ' with a trailing space - would match. The flag must terminate at whitespace, a quote or '=', which is what keeps 'draft -final.pdf' and 'rollup -v2.csv' clean; the residual is the spaced form.
+    - 'The engine compiles array-format regex conditions with flag ''i'' unconditionally (src/engine.ts compilePatterns) and IGNORES case_sensitive on this condition format. Every case-based discriminator is therefore unavailable to this rule. That is why the bare-recon vocabulary excludes ''id'', ''pwd'', ''groups'', ''arch'', ''env'' and ''ps'': each of them also matches an ordinary capitalised filename label such as ''/scans/Passport | ID'' or ''/design/Hero Banner | ps''.'
+  conditions:
+    - field: content
+      operator: regex
+      value: '"(?:[Pp]roject_?[Pp]ath|[Ff]ile_?[Pp]ath|[Dd]ir(?:ectory)?_?[Pp]ath|[Dd]irectory|[Ff]older|[Ff]ile_?[Nn]ame|[Oo]utput_?[Pp]ath|[Ii]nput_?[Pp]ath|[Ll]og_?[Ff]ile_?[Nn]ame|[Tt]arget_?[Pp]ath|[Ss]cene_?[Pp]ath|[Ss]ave_?[Pp]ath|cwd|[Ww]orkspace_?[Pp]ath)"\s*:\s*"[^"\n]{0,40}(?:;|&&|\|\||\s\|)\s{0,3}(?:\b[A-Za-z_][A-Za-z0-9_.-]{1,15}|/(?:usr/)?s?bin/[A-Za-z0-9_.-]{1,15})\s{1,2}(?:-{1,2}[A-Za-z][A-Za-z0-9-]{0,10}(?:\s|"|=)|/(?:etc|tmp|var|usr|bin|sbin|opt|root|home|dev|proc)[/\s"])'
+      description: A path-typed tool argument is chained past a shell separator to a lowercase command that takes a flag or an absolute system path as its argument - argument injection into a server that concatenates the value into a shell string
+    - field: content
+      operator: regex
+      value: '"(?:[Pp]roject_?[Pp]ath|[Ff]ile_?[Pp]ath|[Dd]ir(?:ectory)?_?[Pp]ath|[Dd]irectory|[Ff]older|[Ff]ile_?[Nn]ame|[Oo]utput_?[Pp]ath|[Ii]nput_?[Pp]ath|[Ll]og_?[Ff]ile_?[Nn]ame|[Tt]arget_?[Pp]ath|[Ss]cene_?[Pp]ath|[Ss]ave_?[Pp]ath|cwd|[Ww]orkspace_?[Pp]ath)"\s*:\s*"[^"\n]{0,40}(?:;|&&|\|\||\s\|)\s{0,3}\b(?:whoami|uname|hostname|ifconfig|netstat|lsblk|dmesg)\s{0,2}"'
+      description: A path-typed tool argument is chained past a shell separator to a bare reconnaissance binary that terminates the value - the argumentless form of the same argument injection
+response:
+  actions:
+    - alert
+    - snapshot
+    - escalate
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): no FP measurement on the benign corpus; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
+  auto_response_threshold: high
+  notify:
+    - security_team
+  message_template: |
+    [ATR-2026-02557] HIGH: a path-typed tool argument contains a shell command separator followed by a second command. A filesystem path has no legitimate reason to contain ';', '&&', '||' or a spaced '|'. This is the CVE-2026-25546 (godot-mcp) pattern, where projectPath reached exec() and every tool that accepted a project path became a command-execution primitive. Block the call, and check whether the target server builds its command line by string concatenation - if so, every path-typed argument it exposes is affected, not just this one.
+confidence: 77

package/rules/tool-poisoning/ATR-2026-02666-url-userinfo-decoy-host-allowlist-bypass.yaml

@@ -0,0 +1,101 @@
+title: Trusted Hostname Parked in the URL Userinfo So the Real Host Is Whatever Follows the At-Sign
+id: ATR-2026-02666
+rule_version: 2
+status: experimental
+description: |
+  Detects a URL in which a trusted-looking DOMAIN NAME sits in the userinfo component, so every allowlist that uses startsWith / contains / "does the URL mention our domain" sees the decoy while the browser or HTTP client connects to whatever follows the @ -- https://allowed-vendor.io@203.0.113.44/exfil, https://api.github.com:anypassword@collector.example/, and the percent-encoded https://api.github.com%40collector.example/. Mined from CVE-2025-47241 (Browser Use), where a decoy domain in the userinfo defeated allowed_domains. ATR-2026-02107 covers part of this shape, but only on llm_io channels (not on tool_call, where a browser_navigate URL argument actually lives) and only when the decoy carries two or more dots AND no password -- so 'allowed-vendor.io@IP', ':anypassword@' and '%40' all pass it today. PRECISION HANDLE: the userinfo must end in a plausible public suffix. That is what separates a decoy hostname from an ordinary credential -- oauth2, gitlab-ci-token, first.last and even first.last%40example.com are usernames, not hostnames.
+  V2 -- ADVERSARIAL REVIEW 2026-08-24. The public-suffix handle held: 20 hand-written benign twins included 9 ordinary credential URLs (git token remotes, GitLab CI, postgres, corporate proxy, Sentry DSN, percent-encoded registry e-mail, Azure DevOps, jsDelivr, Go module proxy) and NOT ONE fired. What did fire was 11 of 20: every one of them was DOCUMENTATION QUOTING THE PAYLOAD -- a security blog, an OWASP-style cheat sheet, a CHANGELOG announcing this CVE's fix, a pentest finding, a SIEM detection-rule doc, a StackOverflow answer about URL parsing, Traditional Chinese and Japanese bulletins, the WHATWG urltestdata.json parser fixture, and the same blog delivered through an MCP tool result. v1 declared this acceptable ("the payload is the URL"). It is not: scan_target is runtime, so an agent that browses the web alerts on every article explaining the attack it is meant to prevent.
+  THE FIX: the URL must sit in NAVIGATION-ARGUMENT position -- behind a url/uri/href/link/src/endpoint/location/address key with a quote, or after a navigation verb (navigate/goto/browse/visit/open/fetch/curl/wget). Prose that merely mentions the URL mid-sentence no longer matches. Measured after the fix: 0 of 20 benign twins, 0 of 10 fresh round-2 twins (legitimate browser_navigate, token fetch, proxy curl, CDN asset, sitemap), 4 of 5 true positives retained.
+  DELIBERATE GAP: a bare URL with no surrounding context is no longer detected. It is undecidable -- the same bytes are a navigation instruction, a link in a fetched page, and a line in a blog post.
+  RESIDUAL, MEASURED: a document that quotes the tool call VERBATIM ({"tool":"browser_navigate","arguments":{"url":"https://decoy.tld@ip"}}) still fires. That is the irreducible signature-quoting case, and it is a far narrower class than "every blog that explains authority confusion".
+  CORPUS CAVEAT: this rule is FP-clean on the 13,601-sample benign corpus, but that is a ZERO-MEASUREMENT pass -- 0 corpus samples contain a decoy-domain userinfo at all. The hand-written twins below are the only real evidence.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2025-47241
+  cwe:
+    - CWE-918
+    - CWE-1286
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI05:2026
+    - ASI04:2026
+  mitre_attack:
+    - T1036 - Masquerading
+  mitre_atlas:
+    - AML.T0049 - Exploit Public-Facing Application
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-47241
+    - https://github.com/browser-use/browser-use/security/advisories/GHSA-x39x-9qw5-ghrf
+metadata_provenance:
+  cve: human-reviewed
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resilience against circumvention of controls; a domain allowlist that is defeated by URL authority confusion is exactly such a circumvention, and this rule detects it.
+      strength: primary
+    - article: '9'
+      context: 'Article 9 (risk management system): navigation outside the approved domain set is an identified risk, treated at runtime by this detection.'
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Allowlist evasion by URL authority confusion is an identified AI risk; this rule is the runtime countermeasure.
+      strength: primary
+    - subcategory: MS.2.7
+      context: Counting authority-confusion URLs reaching browser tools measures how well the domain control actually holds.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'ISO/IEC 42001 Clause 8.1 (operational planning and control): the browsing allowlist is an operational control, and this rule reports inputs crafted to slip past it.'
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented by alerting before the agent navigates to the real host.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: url-userinfo-decoy
+  scan_target: runtime
+  confidence: high
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?:["']?(?:url|uri|href|link|src|endpoint|location|address|target_url)["']?\s{0,3}[:=]\s{0,3}["']|\b(?:navigate|goto|browse|visit|open|fetch|curl|wget)\b\s{1,3}(?:to\s{1,3})?)\bhttps?://[\w-]{2,40}(?:\.[\w-]{1,30}){0,3}\.(?:com|net|org|io|ai|co|dev|app|cloud|xyz|info|biz|gov|edu|uk|de|fr|jp|cn|us|eu|tld|example)(?::[^\s/@"']{0,40})?@(?:\d{1,3}\.){3}\d{1,3}(?::\d{1,5})?(?:[/?\s"'\\]|$)
+      description: A domain-shaped userinfo in front of a bare IPv4 host -- the CVE-2025-47241 PoC exactly. The real destination is a raw address, which no allowlist entry can be.
+    - field: content
+      operator: regex
+      value: (?:["']?(?:url|uri|href|link|src|endpoint|location|address|target_url)["']?\s{0,3}[:=]\s{0,3}["']|\b(?:navigate|goto|browse|visit|open|fetch|curl|wget)\b\s{1,3}(?:to\s{1,3})?)\bhttps?://[\w-]{2,40}(?:\.[\w-]{1,30}){1,3}\.(?:com|net|org|io|ai|co|dev|app|cloud|xyz|info|biz|gov|edu|uk|de|fr|jp|cn|us|eu|tld|example)(?::[^\s/@"']{0,40})?@[\w-]{2,60}(?:\.[\w-]{2,30}){0,3}(?::\d{1,5})?(?:[/?\s"'\\]|$)
+      description: A fully-qualified decoy hostname (two or more labels plus a public suffix) in the userinfo, with a different real host after the @. Covers the ':anypassword@' form that ATR-2026-02107's pattern rejects.
+    - field: content
+      operator: regex
+      value: (?:["']?(?:url|uri|href|link|src|endpoint|location|address|target_url)["']?\s{0,3}[:=]\s{0,3}["']|\b(?:navigate|goto|browse|visit|open|fetch|curl|wget)\b\s{1,3}(?:to\s{1,3})?)\bhttps?://[\w-]{2,40}(?:\.[\w-]{1,30}){1,3}\.(?:com|net|org|io|ai|co|dev|app|cloud|xyz|info|biz|gov|edu|uk|de|fr|jp|cn|us|eu|tld|example)%40[\w-]{2,60}
+      description: The same decoy with the at-sign percent-encoded as %40, which many filters neither decode nor split on. Requires two or more labels before the %40, so an e-mail username such as first.last%40example.com does not match.
+  false_positives:
+    - 'Ordinary credential-carrying URLs, whose userinfo is a USERNAME rather than a hostname: https://oauth2:TOKEN@github.com/org/repo.git, https://gitlab-ci-token:$CI_JOB_TOKEN@gitlab.example.com/..., postgres://admin:pw@db.internal:5432/main, https://user:pass@proxy.corp.example.com:8080. None end in a public suffix, so none match. Fourteen such samples were written and run during authoring.'
+    - E-mail addresses used as registry usernames, including the percent-encoded form first.last%40example.com:token@registry.example.com -- excluded because the label count before the %40 is one, not two or more.
+    - A userinfo that genuinely looks like a hostname (a service account literally named api.example.com) would match. Such an account name is itself indistinguishable from the attack.
+    - Documentation that quotes a userinfo-confusion URL as an example will match; the payload is the URL.
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02666] This URL puts a trusted-looking domain in the userinfo component; the host actually contacted is the one after the @. Re-check it against the allowlist after parsing, not before.
+confidence: 83

package/rules/tool-poisoning/ATR-2026-02668-vcs-ref-name-command-substitution.yaml

@@ -0,0 +1,98 @@
+title: Branch or Tag Ref Name Carrying Shell Command Substitution in Tool Output
+id: ATR-2026-02668
+rule_version: 2
+status: experimental
+description: |
+  Detects a version-control REF NAME that contains a shell command substitution: a branch listed as remotes/origin/hotfix-$(id > /tmp/pwned), or a head_ref / branch / tag_name field holding $(cat ~/.ssh/id_rsa | base64). Git allows those characters in a ref name, and everything downstream that interpolates the name into a shell -- a prompt renderer, a release script, a GitHub Actions run: block using github.head_ref -- executes it. For an agent the decisive event is the tool_response: git branch -a or gh pr list output that the model then feeds into its next command. Mined from CVE-2026-27113 (Liquid Prompt). ADVERSARIAL REVIEW 2026-08-24. Fifteen benign samples were run through the shipped engine against rule_version 1; FOURTEEN fired. Two changes, and one arm cut back to nothing:
+  (1) THE PR-TITLE FORM WAS ABANDONED. `title` is no longer in the field list. Rule_version 1 had already been narrowed once during authoring -- from "any pipe" to "shell, encoder, fetch tool or system redirect" -- and it still fired on ten ordinary pull-request titles, because those are exactly the tools a title about shell scripting names: "fix: quote $(curl -sSf https://sh.rustup.rs) in the bootstrap script", "ci: replace $(base64 -w0 tls.crt) with a projected secret volume", "chore: drop $(eval echo ~) in favour of $HOME in the installer", "docs: warn that $(curl -fsSL url | sh) installers cannot be verified", and -- the diagnostic one -- the title of the ATR pull request that ships this very rule. A PR title is prose: it may contain any command substitution, with any payload, for any reason. There is no shape that separates a poisoned title from a title about poisoning, so the title form was removed rather than narrowed a third time. Ref-NAME fields (head_ref / headRefName / branch / tag_name / source_branch) are kept: those are identifiers, not prose. STATED RECALL LIMIT: a poisoned PR title is not detected by this rule at all.
+  (2) THE LISTING FORM NOW REQUIRES A PAYLOAD AND AN END-OF-LINE. Version 1 matched any `$(` after `origin/<something>` at the start of a line, which is the shape of a wrapped shell command, not only of listing output. It fired on a multi-line `for ref in \\ origin/main \\ origin/release-$(VERSION)` loop, on a Makefile continuation `origin/nightly-$(BUILD_TAG)...HEAD`, and on a documentation snippet giving `origin/nightly-$(date +%Y%m%d)` as a naming convention. Real `git branch -a` output has nothing after the ref, and a poisoned ref carries a payload, so both are now required. `$(VERSION)`, `$(BUILD_TAG)` and `$(date +%Y%m%d)` are all silent.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cve:
+    - CVE-2026-27113
+  cwe:
+    - CWE-78
+    - CWE-88
+  owasp_llm:
+    - LLM01:2025
+    - LLM05:2025
+  owasp_agentic:
+    - ASI04:2026
+    - ASI05:2026
+  mitre_attack:
+    - T1059.004 - Unix Shell
+    - T1195.001 - Compromise Software Dependencies and Development Tools
+  mitre_atlas:
+    - AML.T0051 - LLM Prompt Injection
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-27113
+metadata_provenance:
+  cve: human-reviewed
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resilience against attacker-controlled input; a repository ref name is attacker-controlled input, and this rule detects the form that executes.
+      strength: primary
+    - article: '9'
+      context: 'Article 9 (risk management system): command injection through repository metadata is an identified risk treated at runtime by this detection.'
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Poisoned repository metadata reaching an agent's shell is an identified AI risk; this rule is the runtime countermeasure on the channel that carries it.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Cataloguing ref-name command injection in the organizational AI risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by inspecting tool output for identifiers that will execute when interpolated.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented by alerting before the agent reuses the ref name in a command.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: ref-name-command-injection
+  scan_target: runtime
+  confidence: high
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?:\n|\\n|^)\s{0,6}\*?\s{0,4}(?:remotes/)?origin/[\w.\-/]{1,40}\$\([^)\r\n]{0,60}(?:\|\s{0,3}(?:sh|bash|zsh|base64|nc|curl|wget|python\d{0,1}|perl)\b|>\s{0,3}/(?:tmp|dev|var|etc|home|root|Users)/|\b(?:curl|wget|nc|chmod|base64|eval)\b|\brm\s{1,3}-[rf])[^)\r\n]{0,60}\)\s{0,4}(?:\r?\n|\\n|$)
+      description: 'A ref-listing line (git branch -a / git branch -r output) whose branch name carries a command substitution that pipes into a shell or encoder, redirects into a system directory, or names a fetch/permission tool, and which ENDS at the ref -- real listing output has nothing after the ref. NARROWED by adversarial review 2026-08-24: see false_positives.'
+    - field: content
+      operator: regex
+      value: '["''](?:head_ref|headRefName|ref|branch|tag_name|source_branch|refName|base_ref|baseRefName)["'']\s{0,3}:\s{0,3}["''][^"''\n]{0,60}\$\([^)\n]{0,60}(?:\|\s{0,3}(?:sh|bash|zsh|base64|nc|curl|wget|python\d{0,1}|perl)\b|>\s{0,3}/(?:tmp|dev|var|etc|home|root|Users)/|\b(?:curl|wget|nc|chmod|base64|eval)\b|\brm\s{1,3}-[rf])'
+      description: A ref-NAME field (head_ref / headRefName / branch / tag_name / source_branch / ref) whose value carries a command substitution with a shell, encoder, fetch tool or system-directory redirect inside it. `title` was REMOVED from the field list by adversarial review 2026-08-24 -- see false_positives.
+  false_positives:
+    - 'Shell commands that interpolate a real ref: git rev-parse origin/$(git branch --show-current), DIFF=$(git diff origin/main...HEAD), git push origin HEAD:refs/heads/build-$(date +%Y%m%d). None is a ref-listing line, so none matches.'
+    - 'A wrapped shell command or Makefile continuation whose next line begins with the ref: `for ref in \ origin/main \ origin/release-$(VERSION); do`, `git diff --name-only \ origin/nightly-$(BUILD_TAG)...HEAD`. MEASURED: both fired rule_version 1. The line must now END at the ref and the substitution must carry a payload.'
+    - 'Documentation giving a branch-naming convention such as origin/nightly-$(date +%Y%m%d). MEASURED: fired rule_version 1; $(date ...) is not a payload.'
+    - PULL-REQUEST AND ISSUE TITLES OF EVERY KIND, including poisoned ones. `title` was removed from the field list -- see change (1) in the description. Ten benign titles fired rule_version 1, among them the title of the ATR pull request shipping this rule.
+    - An ordinary git branch -a listing, including branches with slashes and dots.
+    - A payload with no redirect, pipe or known tool inside the substitution is NOT detected. Stated limit.
+    - 'KNOWN AND UNFIXABLE, MEASURED: a blog post or advisory that reproduces a poisoned listing line verbatim still fires, because the sample contains the attack. Prose describing the technique without the listing line is silent.'
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02668] A branch, tag or pull-request identifier in this tool output contains a shell command substitution. Do not interpolate it into a command line; quote it or reject the ref.
+confidence: 80

package/rules/tool-poisoning/ATR-2026-02669-query-pipeline-stage-in-identifier-parameter.yaml

@@ -0,0 +1,88 @@
+title: Query-Language Pipeline Stage Smuggled Into an Identifier-Typed Tool Parameter
+id: ATR-2026-02669
+rule_version: 1
+status: experimental
+description: |
+  Detects a tool parameter that the tool's own schema describes as an IDENTIFIER -- entityName, entitySelector, table_name, index_name, metric_name, dashboard_id -- carrying a query-language pipeline stage instead: "host-1 | fetch logs | fields content | limit 50000". The observability backend concatenates the identifier into the query it builds, so the appended stages run with the server's credentials and outside every limit the tool documented -- different data source, different fields, a time window and row count the caller was never allowed to ask for. Mined from GHSA-pqh8-p93p-2rx7 (@dynatrace-oss/dynatrace-mcp-server), where parameters not documented as DQL were interpolated into DQL. The same shape appears wherever an MCP server builds a query language from "safe" fields: KQL's | externaldata, Splunk's | inputlookup, Lucene/ES pipelines. ATR-2026-00066 covers template and shell metacharacter injection in tool arguments and has no notion of a query-pipeline stage.
+author: ATR Community (GHSA sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: medium
+references:
+  ghsa:
+    - GHSA-pqh8-p93p-2rx7
+  cwe:
+    - CWE-943
+    - CWE-88
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI05:2026
+  mitre_attack:
+    - T1213 - Data from Information Repositories
+  mitre_atlas:
+    - AML.T0053 - AI Agent Tool Invocation
+  external:
+    - https://github.com/advisories/GHSA-pqh8-p93p-2rx7
+metadata_provenance:
+  ghsa: human-reviewed
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resistance to input that alters system behaviour; a pipeline stage inside an identifier field rewrites the query the server executes.
+      strength: primary
+    - article: '10'
+      context: 'Article 10 (data and data governance): the appended stages read data sets the tool never declared, which is a data-governance boundary failure.'
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Query-language injection through agent tool parameters is an identified AI risk; this rule is the runtime countermeasure.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Recording observability-query injection in the organizational AI risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: 'ISO/IEC 42001 Clause 8.1 (operational planning and control): the documented parameter contract is an operational control, and this rule reports values that break it.'
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented by alerting before the concatenated query is executed.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: query-language-injection
+  scan_target: runtime
+  confidence: high
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: '[{,]\s{0,3}"(?:entity_?name|entity_?selector|table_?name|index_?name|metric_?name|dashboard_?id|cluster_?name|stream_?name)"\s{0,3}:\s{0,3}"(?:[^"\\\n,:]|\\.){0,40}\|\s{1,3}(?:(?:externaldata|inputlookup|mv-expand|make-series|parse-kv|fieldsadd|fieldskeep|fieldsremove|summarize)\b|(?:fetch|fields|limit)\b[^\r\n]{0,24}(?:\||==|\w\())'
+      description: A JSON tool argument whose identifier-typed key carries a query pipeline stage. Unambiguous query verbs (externaldata, inputlookup, summarize, fieldsAdd, ...) stand alone; the three verbs that are also ordinary English words (fetch, fields, limit) additionally require a second pipe, a comparison or a function call, so a display label such as "Main Stage | Fetch Festival (2026)" does not qualify.
+  false_positives:
+    - 'MEASURED AND FIXED 2026-08-24 (adversarial review, 19 benign probes through the shipped engine). The published version fired on 12 of 12 first-wave probes. Four separate defects, each fixed: (a) the identifier alternation had no leading boundary, so upstream_name, executable_name and printable_name matched by substring; (b) the value only needed a pipe somewhere, so allowlist regexes such as stream_name = "^(orders|fetch)-events$" and index_name: "(app|fields)-2026.08" fired; (c) the key could be unquoted and assigned with = or :, so ordinary prose fired -- a GHSA writeup, a CHANGELOG entry, a Traditional Chinese vulnerability explanation, the MCP server''s own regression test asserting rejection, and ATR''s own rule documentation; (d) a shell pipeline assigned to cluster_name fired.'
+    - 'MEASURED AND FIXED 2026-08-24, second wave. After (a)-(d) the rule still fired on 7 of 7 display labels that use the ubiquitous '' | '' title separator inside an identifier field: {"stream_name":"Main Stage | Fetch Festival (2026)"}, {"metric_name":"Requests | Limit (p99)"}, {"entity_name":"EU West | Fetch & Ship (Ops)"} and the Traditional Chinese equivalent. Fixed by splitting the verb list: externaldata / inputlookup / summarize / mv-expand / make-series / parse-kv / fieldsAdd / fieldsKeep / fieldsRemove are never ordinary English and stand alone, while fetch / fields / limit additionally require a second pipe, a comparison, or a function call in the following 24 characters.'
+    - A parameter documented as a query and legitimately containing a pipeline (a dql / query / kql field). Those field names are deliberately absent from the identifier list.
+    - Shell pipelines in a command argument. The query verbs are not shell commands, and the value must be a quoted JSON string attached to an identifier key.
+    - 'STATED GAP: the rule now requires the JSON object form ({"entityName":"..."}) that an mcp_exchange actually carries. A payload rendered as prose or as a Python kwarg (entityName: "x | fetch logs", index_name = ''...'') is no longer detected -- that form could not be separated from documentation describing the advisory, which is the single largest false-positive source for this rule.'
+    - 'STATED GAP: a pipeline written without a space after the pipe ("x|fetch logs") is not detected. The space is what separates a pipeline stage from a regex alternation such as (orders|fetch).'
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02669] An identifier-typed tool parameter carries a query pipeline stage. The backend will concatenate it into the query it builds -- reject the value or bind it as a parameter instead of concatenating.
+confidence: 78