agent-audit-kit 0.3.41__tar.gz → 0.3.46__tar.gz

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/.github/workflows/badge-ox-coverage.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version: "3.12"
 

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}
 

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/.github/workflows/codeql.yml

@@ -27,14 +27,14 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:${{ matrix.language }}"

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/.github/workflows/coverage-page.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version: "3.12"
       - name: Install AAK

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/.github/workflows/cve-watcher.yml

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.11"
 

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/.github/workflows/mcp-security-index.yml

@@ -27,7 +27,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.11"
 

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/.github/workflows/release.yml

@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v6.3.0
         with:
           python-version: '3.11'
 
@@ -149,7 +149,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v6.3.0
         with:
           python-version: '3.11'
 

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/.github/workflows/scorecard.yml

@@ -31,6 +31,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: results.sarif

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/.github/workflows/sync-repo-metadata.yml

@@ -17,7 +17,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.METADATA_SYNC_TOKEN || secrets.GITHUB_TOKEN }}
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version: '3.12'
       - name: Rewrite README + docs pins

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/.github/workflows/sync-rule-count.yml

@@ -31,7 +31,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.11"
 

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/CHANGELOG.cves.md

@@ -8,6 +8,12 @@ shipped-at timestamp. The GitHub Action `.github/workflows/cve-watcher.yml`
 diffs NVD's MCP keyword feed against this file and opens an
 `sla-48h`-labelled issue for anything new.
 
+## Shipped in v0.3.46 (2026-07-06)
+
+| Incident / Anchor | Reference | AAK rule(s) | Shipped | Latency |
+|---|---|---|---|---|
+| CVE-2026-58057 (Flowise < 3.1.3 — case-sensitive NODE_OPTIONS denylist bypass → `node_options` on Windows → `NODE_OPTIONS --require` RCE) | [NVD CVE-2026-58057](https://nvd.nist.gov/vuln/detail/CVE-2026-58057) (CVSS 5.0, published 2026-06-28) | **AAK-FLOWISE-001** (pin floor bumped 3.1.2 → 3.1.3; 3.1.2 configs now flag) | 2026-07-06 | version-pin extension |
+
 ## Shipped in v0.3.22 (2026-05-20)
 
 | Incident / Anchor | Reference | AAK rule(s) | Shipped | Latency |

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/CHANGELOG.md

@@ -7,6 +7,173 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security — Flowise CVE-2026-58057 (closes #372)
+
+Bumped `AAK-FLOWISE-001`'s pin floor **3.1.2 → 3.1.3** and added
+[CVE-2026-58057](https://nvd.nist.gov/vuln/detail/CVE-2026-58057) (Flowise
+before 3.1.3 validates Custom-MCP stdio env vars against a *case-sensitive*
+denylist, so on Windows `node_options` bypasses the `NODE_OPTIONS` entry and
+reaches `NODE_OPTIONS --require` RCE). Flowise 3.1.2 configs now flag; test +
+ledger updated. Clears the last open `sla-48h` gate item.
+
+### Added — bench: determinism head-to-head
+
+New `benchmarks/determinism/` proves AAK yields a **byte-identical finding set
+across 20 runs** (single shared SHA-256, 0% variance) over a fixed committed
+corpus, using the real `engine.run_scan` entrypoint — contrasted, **cited (from
+their own docs), not re-run**, against LLM-judge tools (Snyk Agent Scan +
+[Cisco DefenseClaw](https://github.com/cisco-ai-defense/defenseclaw)). No
+competitor number is fabricated; the LLM-as-judge variance concern is cited to
+[arXiv:2606.13685](https://arxiv.org/abs/2606.13685) ("The Coin Flip Judge?").
+`tests/test_determinism_benchmark.py` enforces the single-digest invariant in
+CI; README's determinism bullet + comparison table link
+`benchmarks/determinism/RESULTS.md`. Version **0.3.45 → 0.3.46**.
+
+### Added — Public OWASP coverage leaderboard (issue #67) + Kong Konnect MCP CVE
+
+**OWASP coverage leaderboard (#67).** New generator `scripts/gen_coverage.py`
+emits two Markdown tables from the **live rule registry** so they cannot drift:
+`docs/coverage/owasp-agentic-top10.md` (ASI01–ASI10) and
+`docs/coverage/owasp-mcp-top10.md` (MCP01:2025–MCP10:2025). Each OWASP slot maps
+to the exact AAK rule IDs that cover it, with a **published, reproducible**
+coverage label (Full = ≥3 rules, Partial = 1–2, None = 0) — not a self-scored
+grade. Includes an honest "coverage vs. named toolkits" note: the Microsoft
+Agent Governance Toolkit (2026-04-02, MIT) states 10/10 Agentic coverage as a
+*runtime* enforcer; AAK reports its per-category *static* rule counts next to it
+(a cross-reference, not a head-to-head benchmark). CI fails on staleness via
+`tests/test_coverage_tables.py` (runs `gen_coverage.check()` in every test job).
+README links the leaderboard from the Frameworks section and the State-of-MCP
+report. Fully offline/deterministic — no account, cloud call, or signup.
+
+**AAK-MCP-KONG-CVE-2026-13341-001** (HIGH). Kong Konnect MCP server before 1.0.0
+is vulnerable to **indirect prompt injection** — untrusted content the server
+relays can carry instructions the agent acts on, issuing unintended
+Konnect/Admin API requests ([CVE-2026-13341](https://nvd.nist.gov/vuln/detail/CVE-2026-13341),
+CVSS 7.4, published 2026-07-03; fixed in 1.0.0). Detected as a version pin in
+`supply_chain.py` across dependency manifests **and** MCP config files (fires on
+`< 1.0.0` or an unpinned reference). Category TOOL_POISONING, OWASP MCP05:2025 +
+ASI01.
+
+Rule count **230 → 231**. Version **0.3.44 → 0.3.45**.
+
+### Added — AAK-MCP-CARD-* : MCP Server Card (SEP-1649) static audit + discovery crawler
+
+New **MCP Server Card** rule category (`Category.MCP_SERVER_CARD`) + scanner
+(`scanners/mcp_server_card.py`) that statically audits SEP-1649 discovery cards
+(`/.well-known/mcp/server-card.json`) — a client fetches and trusts a card
+*before* connecting, so the card is an attack surface. Four deterministic rules:
+
+- **AAK-MCP-CARD-001** (CRITICAL) — tool-description poisoning / imperative
+  injection in `tools[].description`. **Reuses** the AAK-POISON-001..006
+  detectors (invisible Unicode, prompt-injection, cross-tool reference, encoded
+  payloads) — nothing duplicated.
+- **AAK-MCP-CARD-002** (HIGH) — declared-transport vs advertised-capability
+  mismatch (remote transport with `authentication.required: false`, or a
+  `stdio`/local card advertising a remote `endpoint`).
+- **AAK-MCP-CARD-003** (HIGH) — missing / placeholder signature / provenance;
+  the card's self-declared tools + endpoint are trusted with no origin proof.
+- **AAK-MCP-CARD-004** (MEDIUM) — over-broad capability claims (wildcard scopes,
+  all-capabilities, `required: true` with empty `schemes`).
+
+SARIF 2.1.0 emitter (fingerprint + `fixes[]` + security-severity) is reused
+unchanged. Emits are stdlib-only and **offline by default** — card fetching is
+opt-in (`AAK_FETCH_SERVER_CARD_URL`, or the crawler's `--server-cards` pass).
+
+**Discovery crawler:** `benchmarks/sources.py` gains `well_known_server_cards()`
+and `benchmarks/crawler.py` a `--server-cards` network pass that enumerates
+servers, probes `/.well-known/mcp/server-card.json`, audits each card, and writes
+a **dated** `benchmarks/results-<date>.json` (never overwrites
+`results-2026-06-13.json`). New test + poisoned/clean card fixtures under
+`tests/fixtures/server_cards/`.
+
+Rule count **226 → 230**; scanner modules **80 → 81**; categories **11 → 12**.
+Version **0.3.43 → 0.3.44**.
+
+### Added — AAK-MCP-AUTH-PATHTRAVERSAL-001: bearer-token → session-file path traversal ([CVE-2026-52830](https://nvd.nist.gov/vuln/detail/CVE-2026-52830))
+
+CVE-response cycle item (closes #394). New **CRITICAL** rule + scanner
+(`scanners/mcp_auth_pathtraversal.py`) flagging MCP auth code that concatenates
+or `os.path.join`-es an untrusted token / bearer credential into a session file
+path used for an existence/read check — without rejecting path separators / `..`
+or resolving-and-containing the result. The caller controls the token, so they
+control the path (`../../etc/passwd`, `../<other-session>`): an auth check becomes
+arbitrary-file access + cross-session takeover. Anchor: **CVE-2026-52830**
+(CVSS 9.4, CWE-22) — `fast-mcp-telegram` before 0.19.1 joined the caller-supplied
+bearer token straight into the session path; fixed in 0.19.1.
+
+Python detection reuses the repo's stdlib-`ast` taint mechanism (token source →
+path construction → `exists`/`open` sink, suppressed by a separator/`..` reject
+or a resolve-and-contain guard — no new taint engine; the #22 tree-sitter
+migration is separate); TS/JS/Rust use the analogous concat-into-path regex.
+Category **MCP_CONFIG** (matching the nearest auth rules), OWASP **MCP07:2025**,
+**ASI03**. Distinct from `AAK-MCP-015` (resource-handler path traversal on a
+request *path* param). FP guards: separator-rejected + resolved-and-contained
+flows, constant paths, and non-auth code all pass; SARIF carries the fingerprint,
+the remediation, and the critical-band security-severity.
+
+Rule count **225 → 226**; scanner modules **79 → 80**. Version **0.3.42 → 0.3.43**.
+
+### Added — MCP prevalence scan (664 configs) + score calibration (issue #23)
+
+Empirical sequel to the State-of-MCP-Security harness. Widened the corpus by
+sweeping five MCP-config filename queries in `benchmarks/crawler.py` (was a
+single `.mcp.json` query capped at GitHub Code Search's 1,000-result ceiling ≈
+571 distinct) → **664 distinct public configs**. Re-ran the #373 harness (reuses
+`engine.run_scan` + `scoring.compute_score`; extended to emit `owasp_mcp_hit_rate`
+and top-10). New report `research/state-of-mcp-2026/PREVALENCE.md`: the score
+distribution (A 30% / B 36% / C 13% / D 7% / F 13%; **median grade B, top 10%
+A** — the empirical anchor #23 asked for), 26.1% critical, 24.2% no-auth,
+OWASP-MCP hit rate (MCP07 99.4%), top-10 findings, methodology, honest
+limitations, and manual distribution drafts. `REPORT.md` now redirects to
+PREVALENCE.md (canonical); README + `docs/DISTRIBUTION-CHECKLIST.md` updated to
+664. Aggregate-only, no per-server list published and no CVEs filed (90-day
+coordinated-disclosure policy). No package code touched — version stays 0.3.42.
+
+### Changed — finish the State of MCP Security 2026 report (launch-ready)
+
+Promoted the data-report harness (shipped in #373) into a finished, launch-ready
+report. `research/state-of-mcp-2026/REPORT.md` gains an executive summary, an
+OWASP-MCP-Top-10 hit-rate table, three anonymized CVE-class case studies, a
+"how we scan (offline, reproducible)" section leading with the two wedges, and a
+`pip install` self-scan block so the report doubles as a distribution funnel.
+Every figure is sourced to `results.json` — the harness was re-run against the
+current corpus (571 distinct configs; 25.7% critical; 28.9% grade A; 99.3% trip
+OWASP MCP07). The harness now also aggregates `owasp_mcp_hit_rate` (no scanner
+change — it reads `owasp_mcp_references` off the existing rules). Filled
+`docs/DISTRIBUTION-CHECKLIST.md` with ready-to-post copy (Show HN, r/netsec,
+OWASP working-group note, awesome-mcp-security) — operator-posted, nothing
+auto-posts. Version **0.3.41 → 0.3.42**. No scanner rules added; rule count
+stays 225.
+
+### Changed — docs: align public rule-count to canonical 225; promote State-of-MCP-Security-2026 report
+
+Killed the last public rule-count drift: the GitHub repo "About" description and
+every human-facing rule-count string (`CLAUDE.md`, launch outreach/blog/awesome
+drafts, the launch data-report draft) said **221** — corrected to the canonical
+**225** (matching the README badge, the `RULES` registry, `rules.json`, and the
+`test_rule_count_is_canonical` CI fence). Adjacent stale metrics on the same
+lines were fixed too (75 → 79 scanners, v0.3.34 → v0.3.41). Promoted the
+reproducible report: the README "State of MCP Security 2026" section now leads
+with the two wedges (offline/deterministic + compliance-evidence), the earlier
+`launch/state-of-mcp-security-2026.md` marketing draft is banner-marked as
+superseded by `research/state-of-mcp-2026/REPORT.md` (canonical), and a manual
+`docs/DISTRIBUTION-CHECKLIST.md` lists launch surfaces (Show HN, r/netsec,
+awesome-mcp-security, OWASP working group). Docs/metadata only — no version bump.
+
+### Added — State-of-MCP-Security-2026 research harness + report
+
+New `research/state-of-mcp-2026/` directory: a reproducible data-report harness
+(`run_report.py`) that scans a corpus of public MCP configs and aggregates a
+grade distribution (A–F), per-category hit rates, and the top misconfigurations.
+It contains **no scanner** — it reuses `agent_audit_kit.engine.run_scan` and
+`agent_audit_kit.scoring.compute_score` (the same scan + grade the CLI / MCP
+Security Index use), and delegates corpus acquisition to the existing
+`benchmarks/crawler.py`. Ships the raw aggregate (`results.json`) and the
+human-readable writeup (`REPORT.md`). Headline from the committed run: 571
+distinct configs, 25.7% with a critical finding, ~29% grade A. README gains a
+"State of MCP Security 2026" section with the reproduce command. Docs/research
+only — no package code, no version bump.
+
 ### Changed — CVE-backlog coverage: extend existing pins (Flowise/LiteLLM/Doris)
 
 Worked the open `sla-48h` backlog. The genuinely AAK-actionable items map to

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/CLAUDE.md

@@ -3,10 +3,10 @@
 <!-- AUTO-MANAGED: project-description -->
 ## Overview
 
-**AgentAuditKit** (v0.3.34) — Security scanner for MCP-connected AI agent pipelines. The "npm audit" for AI agents.
+**AgentAuditKit** (v0.3.41) — Security scanner for MCP-connected AI agent pipelines. The "npm audit" for AI agents.
 
-- **221 rules** across 11 security categories
-- **75 scanner modules** including Python/TypeScript/Rust taint analysis
+- **225 rules** across 11 security categories
+- **79 scanner modules** including Python/TypeScript/Rust taint analysis
 - **16 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `watch`, `export-rules`, `verify-bundle`, `sbom`, `report`, `install-precommit`
 - **OWASP coverage**: Agentic Top 10 (10/10), MCP Top 10 (10/10), Adversa AI Top 25
 - **Compliance mapping** (12 frameworks): EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, NSA MCP CSI, + regional (India DPDP, Singapore, Alabama, Tennessee)
@@ -65,8 +65,8 @@ agent_audit_kit/
   llm_scan.py          # LLM-assisted scanning
   vuln_db.py           # CVE/vulnerability database
   rules/
-    builtin.py         # 221 RuleDefinition entries (rule registry)
-  scanners/            # 75 scanner modules (core set shown), each exports scan() -> (list[Finding], set[str])
+    builtin.py         # 225 RuleDefinition entries (rule registry)
+  scanners/            # 79 scanner modules (core set shown), each exports scan() -> (list[Finding], set[str])
     mcp_config.py      # MCP configuration checks
     hook_injection.py  # Hook injection detection
     trust_boundary.py  # Trust boundary violations
@@ -123,7 +123,7 @@ benchmarks/            # Benchmark crawler
 ## Detected Patterns
 
 - **Scanner registry**: `engine.py` lazy-builds a list of `ScannerRegistration` dataclasses; each wraps a `scan_fn` callable. New scanners are registered via try/except ImportError blocks for backward compatibility.
-- **Rule registry**: `rules/builtin.py` defines all 221 rules as `RuleDefinition` dataclasses in a global `RULES` dict, populated by `_r()` helper.
+- **Rule registry**: `rules/builtin.py` defines all 225 rules as `RuleDefinition` dataclasses in a global `RULES` dict, populated by `_r()` helper.
 - **Finding model**: All scanners produce `Finding` dataclasses with rule_id, severity, category, evidence, remediation, and framework references (OWASP, CVE, Adversa).
 - **Scoring**: Penalty-based (start at 100, deduct per severity), clamped to [0,100], mapped to letter grade.
 - **Output formatters**: Each module in `output/` takes a `ScanResult` and formats it (console, JSON, SARIF, OWASP, compliance).

{agent_audit_kit-0.3.41 → agent_audit_kit-0.3.46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-audit-kit
-Version: 0.3.41
+Version: 0.3.46
 Summary: Security scanner for MCP-connected AI agent pipelines
 Project-URL: Homepage, https://github.com/sattyamjjain/agent-audit-kit
 Project-URL: Repository, https://github.com/sattyamjjain/agent-audit-kit
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
   <a href="https://pypi.org/project/agent-audit-kit/"><img src="https://img.shields.io/pypi/v/agent-audit-kit.svg" alt="PyPI"></a>
   <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.9+-blue.svg" alt="Python 3.9+"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-225-blue.svg" alt="Rules: 225"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-231-blue.svg" alt="Rules: 231"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -58,12 +58,12 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 
 **Two things it does that hosted scanners can't:**
 
-1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). No account, no telemetry.
+1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 13 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
 
-- **<!-- rule-count:total -->225<!-- /rule-count --> rules** across 11 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->231<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
-- **<!-- scanner-count:total -->79<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
+- **<!-- scanner-count:total -->81<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
 - **16 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `watch`, plus `export-rules`, `verify-bundle`, `sbom`, `report`, `install-precommit`, and the Security-Advisories scan flag
 - **OWASP coverage**: Agentic Top 10 (10/10), MCP Top 10 (10/10), Adversa AI Top 25
 - **Compliance mapping** (13 frameworks): EU AI Act Art. 15 + 55, SOC 2, ISO 27001, ISO/IEC 42001, HIPAA, NIST AI RMF, **NSA MCP Security CSI (U/OO/6030316-26, May 2026)**, Singapore Agentic AI, India DPDP 2023, **Alabama Personal Data Protection Act (HB 351, 2026)**, **Tennessee SB 1580 Health Care AI (PRA)**, **MCP 2026 Roadmap (May 2026)** — PDF reports via `agent-audit-kit report --format pdf --framework <name>`
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.41
+      - uses: sattyamjjain/agent-audit-kit@v0.3.46
         with:
           fail-on: high
 ```
@@ -120,7 +120,7 @@ agent-audit-kit scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.41
+    rev: v0.3.46
     hooks:
       - id: agent-audit-kit
 ```
@@ -144,9 +144,9 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
-| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->52<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)) |
+| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->53<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1) |
 | **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->41<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**) |
-| **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->26<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin. Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
+| **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->27<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->15<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
 | **A2A Protocol** | <!-- category-count:A2A_PROTOCOL -->13<!-- /category-count --> | Missing mutual auth, unbounded delegation, transitive trust, replay protection, schema confusion, HTTP endpoints, JWT lifetime/validation, impersonation, multi-agent shared-state without lock (Code-as-Harness) |
@@ -155,8 +155,23 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Transport Security** | <!-- category-count:TRANSPORT_SECURITY -->11<!-- /category-count --> | HTTP endpoints, TLS disabled, deprecated SSE, tokens in URL query strings, transport body-size limits (CVE-2026-39313), SSRF redirect bypass (CVE-2026-41481), DNS-rebinding (CVE-2025-66414/66416, CVE-2026-35568/35577) |
 | **Legal Compliance** | <!-- category-count:LEGAL_COMPLIANCE -->12<!-- /category-count --> | Copyleft licenses (AGPL/SSPL), missing licenses, DMCA-flagged packages, India PII surface, US-state consumer privacy (Alabama HB 351, Tennessee SB 1580), Singapore Agentic AI, healthcare AI triggers, EU AI Act Article 15 multilingual-eval coverage advisory (binding 2026-08-02) |
 | **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->12<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
+| **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
 
-**<!-- rule-count:total -->225<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->231<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+
+### MCP Server Card scanning (SEP-1649)
+
+The MCP discovery track ([SEP-1649](https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1649), superseded-in-draft by SEP-2127) has servers publish a **server card** at `/.well-known/mcp/server-card.json` — a JSON document (`serverInfo`, `transport`, `capabilities`, `authentication`, `tools[]`) that a client fetches and **trusts before it connects**, ahead of the [2026-07-28 MCP spec finalization](https://modelcontextprotocol.io/). That makes the card an attack surface in its own right.
+
+`agent-audit-kit` statically audits a server card — from a committed file, or an **opt-in** fetch — with four deterministic rules (`AAK-MCP-CARD-001..004`, category **MCP Server Card**): tool-description poisoning, transport/capability mismatch, missing/placeholder provenance, and over-broad capability claims. It stays **offline and deterministic** — the default scan path makes zero network calls; card fetching only happens behind an explicit flag (`AAK_FETCH_SERVER_CARD_URL`, or the crawler's `--server-cards` network pass), and the same card always yields the same findings.
+
+```bash
+# audit a committed / saved server card, fully offline
+agent-audit-kit scan path/to/server-card.json
+
+# opt-in prevalence sweep of discoverable cards (network; writes results-<date>.json)
+python benchmarks/crawler.py --server-cards --limit 200
+```
 
 ### Agent Platforms Scanned
 
@@ -314,18 +329,34 @@ Generate an SVG badge for your README: `agent-audit-kit score . --badge`
 | **OWASP Agentic Top 10** (ASI01-ASI10) | 10/10 (100%) — density by slot below |
 | **OWASP MCP Top 10** (MCP01-MCP10) | 10/10 (100%) |
 
+### Public OWASP coverage leaderboard
+
+Category-by-category coverage tables — every OWASP slot mapped to the exact AAK
+rule IDs that cover it — are generated from the live rule registry so they
+cannot drift (CI regenerates and fails on staleness, `scripts/gen_coverage.py`):
+
+- **[OWASP Agentic Top 10 → AAK rules](docs/coverage/owasp-agentic-top10.md)**
+- **[OWASP MCP Top 10 → AAK rules](docs/coverage/owasp-mcp-top10.md)**
+
+Coverage labels use a published threshold (**Full** = ≥3 rules, **Partial** =
+1–2, **None** = 0) — reproducible from the registry, not a self-scored grade.
+The [Microsoft Agent Governance Toolkit](https://github.com/microsoft/agent-governance-toolkit)
+(2026-04-02) states 10/10 Agentic coverage as a *runtime* enforcer; AAK reports
+its honest per-category **static** rule counts next to it — a coverage
+cross-reference, not a head-to-head benchmark.
+
 <details>
 <summary>OWASP Agentic Top 10 — density by slot</summary>
 
 <!-- owasp-coverage:start -->
 | ASI | Title | # rules |
 | --- | --- | --- |
-| **ASI01** | Goal Hijack | 11 |
+| **ASI01** | Goal Hijack | 12 |
 | **ASI02** | Tool Misuse | 38 |
-| **ASI03** | Memory Poisoning | 54 |
-| **ASI04** | Identity & Privilege Abuse | 37 |
+| **ASI03** | Memory Poisoning | 56 |
+| **ASI04** | Identity & Privilege Abuse | 38 |
 | **ASI05** | Cascading Failures | 33 |
-| **ASI06** | Unauthorized Capability Acquisition | 28 |
+| **ASI06** | Unauthorized Capability Acquisition | 30 |
 | **ASI07** | Plan Injection | 9 |
 | **ASI08** | Agent Communication Poisoning | 4 |
 | **ASI09** | Resource Abuse | 14 |
@@ -367,7 +398,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->225<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->231<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |
@@ -381,6 +412,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | GitHub Security Advisories | **Yes** (`--advisories`) | No | No | No |
 | Secret verification | **Yes** | No | No | No |
 | A2A protocol scanning | **12 rules** | Agent Mesh | No | No |
+| Reproducible finding set (same input → same digest) | **[Yes — 20/20 runs, 0% variance](benchmarks/determinism/RESULTS.md)** | Runtime governance | LLM-judge in path | LLM-assisted |
 | Healthcare-AI legal triggers | **Yes** (TN SB 1580, KS/WA/UT) | No | No | No |
 | Offline / zero cloud | **Yes** | Yes | No | Optional |
 | License | **MIT** | MIT | Proprietary | Proprietary |
@@ -415,6 +447,42 @@ Public leaderboard of MCP servers we scan weekly:
 - **90-day coordinated disclosure** before anything lands on a public card — see [`docs/disclosure-policy.md`](docs/disclosure-policy.md)
 - Maintainer-fix earlier gets published the day the fix lands, with credit
 
+## State of MCP Security 2026
+
+A reproducible data report: we scanned **664 distinct public MCP server configs**
+and found **1 in 4 ships a critical-severity flaw** — the **median config scores
+a B, the top 10% an A**, and **24.2% declare a remote server with no auth**. It
+exists because of AAK's two defensible wedges — the scan is **offline and
+deterministic** (no code or configs leave the machine; same input, same result),
+and it yields **auditor-ready compliance evidence**, which is what makes a report
+reproducible and an audit defensible. Full distribution, score calibration,
+OWASP-MCP-Top-10 hit rate, top-10 findings, external anchors (MCP Registry 9,652
+servers; Knostic 1,862 exposed / 119-of-119 unauthenticated; the 2,614-server
+82%-path-traversal survey), and honest limitations are in
+**[`research/state-of-mcp-2026/PREVALENCE.md`](research/state-of-mcp-2026/PREVALENCE.md)**
+(raw aggregate: [`results.json`](research/state-of-mcp-2026/results.json)).
+
+Mapped to the OWASP MCP Top 10, **99.4% of configs trip MCP07 (authorization /
+excessive permissions)** — see which AAK rules cover each slot in the
+[public coverage leaderboard](docs/coverage/owasp-mcp-top10.md). Scan your own in
+30s, fully offline:
+
+```bash
+pip install agent-audit-kit && agent-audit-kit scan .
+```
+
+The harness contains no scanner — it reuses `agent_audit_kit.engine.run_scan` +
+`scoring.compute_score`. Regenerate the report:
+
+```bash
+export GITHUB_TOKEN=$(gh auth token)
+python benchmarks/crawler.py --limit 500 --output benchmarks/results.json
+python research/state-of-mcp-2026/run_report.py --corpus benchmarks/data \
+    --out research/state-of-mcp-2026/results.json
+```
+
+Launch-ready copy for the report is in [`docs/DISTRIBUTION-CHECKLIST.md`](docs/DISTRIBUTION-CHECKLIST.md).
+
 ## CVE Response
 
 AgentAuditKit tracks newly disclosed MCP CVEs and ships rule coverage on a best-effort basis, recorded in a public ledger ([`CHANGELOG.cves.md`](CHANGELOG.cves.md)). A [GitHub Action](.github/workflows/cve-watcher.yml) watches NVD's MCP keyword feed every 6 hours and files a tracking issue for each new disclosure.