agent-audit-kit 0.3.46__tar.gz → 0.3.47__tar.gz

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/CHANGELOG.cves.md

@@ -8,6 +8,12 @@ shipped-at timestamp. The GitHub Action `.github/workflows/cve-watcher.yml`
 diffs NVD's MCP keyword feed against this file and opens an
 `sla-48h`-labelled issue for anything new.
 
+## Shipped in v0.3.47 (2026-07-07)
+
+| Incident / Anchor | Reference | AAK rule(s) | Shipped | Latency |
+|---|---|---|---|---|
+| CVE-2026-14471 (Amazon mcp-gateway-registry < 1.0.13 — SQL injection: crafted `table_name` interpolated into an SQL identifier in the metrics-service retention policy, CWE-89) | [NVD CVE-2026-14471](https://nvd.nist.gov/vuln/detail/CVE-2026-14471) (HIGH, CVSS 8.1, published 2026-07-06) | **AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001** (NEW: HIGH, SUPPLY_CHAIN — version-pin, fires < 1.0.13 / unpinned) | 2026-07-07 | <24h on NVD |
+
 ## Shipped in v0.3.46 (2026-07-06)
 
 | Incident / Anchor | Reference | AAK rule(s) | Shipped | Latency |

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added — AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001 (Amazon mcp-gateway-registry SQLi)
+
+CVE-response (closes #408). New **HIGH** rule + version-pin detector for
+[CVE-2026-14471](https://nvd.nist.gov/vuln/detail/CVE-2026-14471) (CVSS 8.1):
+Amazon `mcp-gateway-registry` before 1.0.13 interpolates a caller-supplied
+`table_name` into an SQL identifier position in the metrics-service retention
+policy (CWE-89), letting an authenticated remote user run arbitrary SQL. Fires
+on `< 1.0.13` or an unpinned reference across manifests + MCP config files;
+fixture-backed test; `rules.json` regenerated. Rule count **231 → 232**.
+
+### Fixed — correct SEP citations on the AAK-MCP-STATELESS-* pack
+
+Citation-accuracy pass on the shipped stateless-migration rules (no detection
+change, rule count stays 231). The `Mcp-Session-Id` / protocol-session removal
+was mis-attributed to SEP-1442; it is actually **SEP-2567** ("Sessionless MCP
+via Explicit State Handles"), with SEP-1442 / **SEP-2575** making the init
+handshake optional so stateless is the default. The `tasks/list` removal cited
+a **non-existent SEP-1359**; corrected to the experimental Tasks primitive
+(**SEP-1686**) moving out of core into the Extensions framework (redesigned as
+**SEP-2663**). Updated `AAK-MCP-STATELESS-001`/`-002` descriptions, the
+`mcp_stateless_migration` scanner docstring + engine label, and `rules.json`.
+Verified against modelcontextprotocol.io + the MCP GitHub SEPs. Version
+**0.3.46 → 0.3.47**.
+
 ### Security — Flowise CVE-2026-58057 (closes #372)
 
 Bumped `AAK-FLOWISE-001`'s pin floor **3.1.2 → 3.1.3** and added

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-audit-kit
-Version: 0.3.46
+Version: 0.3.47
 Summary: Security scanner for MCP-connected AI agent pipelines
 Project-URL: Homepage, https://github.com/sattyamjjain/agent-audit-kit
 Project-URL: Repository, https://github.com/sattyamjjain/agent-audit-kit
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
   <a href="https://pypi.org/project/agent-audit-kit/"><img src="https://img.shields.io/pypi/v/agent-audit-kit.svg" alt="PyPI"></a>
   <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.9+-blue.svg" alt="Python 3.9+"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-231-blue.svg" alt="Rules: 231"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-232-blue.svg" alt="Rules: 232"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -61,7 +61,7 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 13 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
 
-- **<!-- rule-count:total -->231<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->232<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
 - **<!-- scanner-count:total -->81<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
 - **16 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `watch`, plus `export-rules`, `verify-bundle`, `sbom`, `report`, `install-precommit`, and the Security-Advisories scan flag
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.46
+      - uses: sattyamjjain/agent-audit-kit@v0.3.47
         with:
           fail-on: high
 ```
@@ -120,7 +120,7 @@ agent-audit-kit scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.46
+    rev: v0.3.47
     hooks:
       - id: agent-audit-kit
 ```
@@ -145,7 +145,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
 | **MCP Configuration** | <!-- category-count:MCP_CONFIG -->53<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1) |
-| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->41<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**) |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->42<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**) |
 | **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->27<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->15<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
@@ -157,7 +157,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->12<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
 | **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
 
-**<!-- rule-count:total -->231<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->232<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
 
 ### MCP Server Card scanning (SEP-1649)
 
@@ -352,7 +352,7 @@ cross-reference, not a head-to-head benchmark.
 | ASI | Title | # rules |
 | --- | --- | --- |
 | **ASI01** | Goal Hijack | 12 |
-| **ASI02** | Tool Misuse | 38 |
+| **ASI02** | Tool Misuse | 39 |
 | **ASI03** | Memory Poisoning | 56 |
 | **ASI04** | Identity & Privilege Abuse | 38 |
 | **ASI05** | Cascading Failures | 33 |
@@ -398,7 +398,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->231<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->232<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/README.md

@@ -8,7 +8,7 @@
   <a href="https://pypi.org/project/agent-audit-kit/"><img src="https://img.shields.io/pypi/v/agent-audit-kit.svg" alt="PyPI"></a>
   <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.9+-blue.svg" alt="Python 3.9+"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-231-blue.svg" alt="Rules: 231"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-232-blue.svg" alt="Rules: 232"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -27,7 +27,7 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 13 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
 
-- **<!-- rule-count:total -->231<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->232<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
 - **<!-- scanner-count:total -->81<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
 - **16 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `watch`, plus `export-rules`, `verify-bundle`, `sbom`, `report`, `install-precommit`, and the Security-Advisories scan flag
@@ -66,7 +66,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.46
+      - uses: sattyamjjain/agent-audit-kit@v0.3.47
         with:
           fail-on: high
 ```
@@ -86,7 +86,7 @@ agent-audit-kit scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.46
+    rev: v0.3.47
     hooks:
       - id: agent-audit-kit
 ```
@@ -111,7 +111,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
 | **MCP Configuration** | <!-- category-count:MCP_CONFIG -->53<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1) |
-| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->41<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**) |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->42<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**) |
 | **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->27<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->15<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
@@ -123,7 +123,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->12<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
 | **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
 
-**<!-- rule-count:total -->231<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->232<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
 
 ### MCP Server Card scanning (SEP-1649)
 
@@ -318,7 +318,7 @@ cross-reference, not a head-to-head benchmark.
 | ASI | Title | # rules |
 | --- | --- | --- |
 | **ASI01** | Goal Hijack | 12 |
-| **ASI02** | Tool Misuse | 38 |
+| **ASI02** | Tool Misuse | 39 |
 | **ASI03** | Memory Poisoning | 56 |
 | **ASI04** | Identity & Privilege Abuse | 38 |
 | **ASI05** | Cascading Failures | 33 |
@@ -364,7 +364,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->231<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->232<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/action.yml

@@ -1,5 +1,5 @@
 name: 'AgentAuditKit MCP Security Scan'
-description: 'AgentAuditKit — MCP Security Scan (231 rules, OWASP Agentic Top 10 + MCP Top 10)'
+description: 'AgentAuditKit — MCP Security Scan (232 rules, OWASP Agentic Top 10 + MCP Top 10)'
 author: 'sattyamjjain'
 
 branding:

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/agent_audit_kit/__init__.py

@@ -1,6 +1,6 @@
 """AgentAuditKit — Security scanner for MCP-connected AI agent pipelines."""
 from __future__ import annotations
 
-__version__ = "0.3.46"
-RULE_COUNT = 231
+__version__ = "0.3.47"
+RULE_COUNT = 232
 SCANNER_COUNT = 81

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/agent_audit_kit/engine.py

@@ -84,7 +84,7 @@ _OPTIONAL_SCANNERS: list[tuple[str, str, list[str]]] = [
     ("skill_lifecycle_attribution", "Skill lifecycle outcome-attribution (SkillsVote, arXiv:2605.18401)", []),
     ("agent_harness_shared_state", "Multi-agent shared-state lock (Code-as-Harness, arXiv:2605.18747)", []),
     ("mcp_sampling_capability", "MCP `sampling` capability consent guard (MCP07:2025)", []),
-    ("mcp_stateless_migration", "MCP 2026-07-28 stateless-migration smells (SEP-1442/1359)", []),
+    ("mcp_stateless_migration", "MCP 2026-07-28 stateless-migration smells (SEP-2567/1442/2575)", []),
     ("eu_ai_act_art15_locale", "EU AI Act Art. 15 multilingual-eval coverage (advisory)", []),
     ("mcp_tunnel", "MCP Tunnels gateway config + credential exposure (Anthropic 2026-05-19 research preview)", []),
     ("sandbox_self_disable", "Tool-schema sandbox self-disable parameter (CVE-2026-42074)", []),

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/agent_audit_kit/rules/builtin.py

@@ -125,6 +125,7 @@ _AICM_TAGS: dict[str, list[str]] = {
     "AAK-AZURE-MCP-NOAUTH-001": ["IAM-01", "IAM-16"],
     "AAK-MCP-AUTH-PATHTRAVERSAL-001": ["IAM-01", "IVS-04"],
     "AAK-MCP-KONG-CVE-2026-13341-001": ["AIS-07", "AIS-12"],
+    "AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001": ["AIS-07", "DSP-07"],
     "AAK-LMDEPLOY-VL-SSRF-001": ["IVS-04", "AIS-08"],
     "AAK-SPLUNK-MCP-TOKEN-LEAK-001": ["DSP-17", "LOG-06"],
     "AAK-MARKETPLACE-001": ["STA-10"],
@@ -525,22 +526,27 @@ _r(
 # ---------------------------------------------------------------------------
 # AAK-MCP-STATELESS-001..004 — 2026-07-28 stateless-MCP migration
 #
-# The MCP 2026-07-28 spec release candidate (locked 2026-05-21) makes the
-# protocol stateless by default: the `Mcp-Session-Id` header and the
-# protocol-level session are removed (SEP-1442), and the experimental
-# `tasks/list` method is removed because it can't be scoped safely without
-# sessions (SEP-1359). Server/client code that assumes the pre-RC stateful
-# protocol — relies on `Mcp-Session-Id`, dispatches `tasks/list`, requires
-# sticky routing or a shared session store, or skips client-side caching of
-# `tools/list` while holding per-session server state — will silently break
-# after 2026-07-28 once the final spec lands. These four rules surface the
-# migration surface so it can be fixed before the cutover.
+# The MCP 2026-07-28 spec release candidate makes the protocol stateless by
+# default: the `Mcp-Session-Id` header and the protocol-level session are
+# removed and replaced with explicit, server-minted state handles (SEP-2567),
+# while making the mandatory initialization handshake optional so stateless is
+# the default (SEP-1442 / SEP-2575). The experimental Tasks primitive (SEP-1686)
+# — including `tasks/list` — is moved out of the core spec into the Extensions
+# framework (redesigned as SEP-2663), so core `tasks/list` is removed. Server/
+# client code that assumes the pre-RC stateful protocol — relies on
+# `Mcp-Session-Id`, dispatches `tasks/list`, requires sticky routing or a shared
+# session store, or skips client-side caching of `tools/list` while holding
+# per-session server state — will silently break after 2026-07-28 once the final
+# spec lands. These four rules surface the migration surface so it can be fixed
+# before the cutover.
 #
 # Sources:
 #   https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/
-#   https://blog.modelcontextprotocol.io/posts/2025-12-19-mcp-transport-future/
+#   https://modelcontextprotocol.io/seps/2567-sessionless-mcp
 #   https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1442
-#   https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1359
+#   https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2575
+#   https://modelcontextprotocol.io/community/seps/1686-tasks
+#   https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2663
 # ---------------------------------------------------------------------------
 
 _r(
@@ -548,8 +554,10 @@ _r(
     "Reliance on `Mcp-Session-Id` header / protocol-level session id",
     "Server or client code reads, writes, asserts, or constants the "
     "`Mcp-Session-Id` header. The MCP 2026-07-28 spec release candidate "
-    "(SEP-1442) makes the protocol stateless and removes the "
-    "`Mcp-Session-Id` header along with the protocol-level session. After "
+    "removes the `Mcp-Session-Id` header and the protocol-level session, "
+    "replacing them with explicit server-minted state handles (SEP-2567); "
+    "SEP-1442 / SEP-2575 make the initialization handshake optional so "
+    "stateless is the default. After "
     "the final spec lands on 2026-07-28, code that depends on this header "
     "(or on the session it represented) will silently break: any MCP "
     "request can land on any server instance, and sticky routing / shared "
@@ -572,10 +580,11 @@ _r(
     "Use of removed `tasks/list` method",
     "Server or client code dispatches, handles, or names the `tasks/list` "
     "JSON-RPC method. The MCP 2026-07-28 spec release candidate removes "
-    "`tasks/list` outright because it cannot be scoped safely without the "
-    "protocol-level session. Tasks moves out of the core specification into "
-    "the new Extensions framework; the stateful list surface has no "
-    "stateless successor.",
+    "`tasks/list` from the core because it cannot be scoped safely without "
+    "the protocol-level session: the experimental Tasks primitive (SEP-1686) "
+    "moves out of the core specification into the Extensions framework "
+    "(redesigned as SEP-2663), and the stateful list surface has no "
+    "stateless successor in core.",
     Severity.HIGH,
     Category.MCP_CONFIG,
     "Stop calling and handling `tasks/list`. If your application needs an "
@@ -5196,6 +5205,30 @@ _r(
     adversa_references=["ADV-INJECT-01"],
 )
 
+_r(
+    "AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001",
+    "Amazon mcp-gateway-registry < 1.0.13 (SQL injection)",
+    "The Amazon `mcp-gateway-registry` before 1.0.13 improperly neutralizes a "
+    "caller-supplied `table_name` in the metrics-service retention-policy "
+    "component: the value is interpolated directly into an SQL statement in "
+    "identifier position, so an authenticated remote user can execute arbitrary "
+    "SQL against the gateway's metrics store (CVE-2026-14471, HIGH CVSS 8.1, "
+    "CWE-89, published 2026-07-06). A project that depends on the gateway "
+    "registry at a version below 1.0.13 (or unpinned) is exposed.",
+    Severity.HIGH,
+    Category.SUPPLY_CHAIN,
+    "Upgrade `mcp-gateway-registry` to >= 1.0.13 and pin it explicitly. Never "
+    "interpolate a request-supplied value into an SQL identifier position; "
+    "validate `table_name` against a fixed allow-list of known table names, or "
+    "quote it with the driver's identifier-quoting API rather than string "
+    "formatting.",
+    sarif_name="McpGatewayRegistrySqlInjection",
+    cve_references=["CVE-2026-14471"],
+    owasp_mcp_references=["MCP04:2025"],
+    owasp_agentic_references=["ASI02"],
+    adversa_references=["ADV-SUPPLY-01"],
+)
+
 
 # ---------------------------------------------------------------------------
 # Internal / meta rules (surfaced when the scanner itself has a problem)

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/agent_audit_kit/scanners/mcp_stateless_migration.py

@@ -3,11 +3,13 @@
 The MCP 2026-07-28 spec release candidate (locked 2026-05-21) makes the
 protocol stateless by default:
 
-* SEP-1442: the protocol-level session and `Mcp-Session-Id` header are
-  removed; any MCP request can land on any server instance.
-* SEP-1359: the `tasks/list` method is removed because it can't be scoped
-  safely without sessions; Tasks moves out of the core specification into
-  the Extensions framework.
+* SEP-2567: the protocol-level session and `Mcp-Session-Id` header are
+  removed and replaced with explicit server-minted state handles, so any
+  MCP request can land on any server instance. SEP-1442 / SEP-2575 make the
+  initialization handshake optional so stateless is the default.
+* The experimental Tasks primitive (SEP-1686), including `tasks/list`, moves
+  out of the core specification into the Extensions framework (redesigned as
+  SEP-2663), so core `tasks/list` is removed.
 
 Server / client code that assumes the pre-RC stateful protocol will
 silently break once the final spec lands on 2026-07-28. This scanner

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/agent_audit_kit/scanners/supply_chain.py

@@ -464,6 +464,7 @@ def scan(project_root: Path) -> tuple[list[Finding], set[str]]:
     findings.extend(_check_mcp_specific_vulns(project_root))
     findings.extend(_check_doris_mcp_pin(project_root, scanned_files))
     findings.extend(_check_kong_konnect_mcp_pin(project_root, scanned_files))
+    findings.extend(_check_mcp_gateway_registry_pin(project_root, scanned_files))
     findings.extend(_check_excel_mcp_pin(project_root, scanned_files))
     findings.extend(_check_azure_mcp_auth(project_root, scanned_files))
     findings.extend(_check_astro_mcp_pin(project_root, scanned_files))
@@ -596,6 +597,65 @@ def _check_kong_konnect_mcp_pin(project_root: Path, scanned_files: set[str]) ->
     return findings
 
 
+# ---------------------------------------------------------------------------
+# AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001 — Amazon mcp-gateway-registry
+# < 1.0.13 (CVE-2026-14471, HIGH 7.x/8.1). SQL injection in the metrics-service
+# retention-policy component: a crafted `table_name` is interpolated into SQL in
+# identifier position (CWE-89). Fixed in 1.0.13.
+# ---------------------------------------------------------------------------
+
+_MCP_GATEWAY_REGISTRY_PATCHED = (1, 0, 13)
+_MCP_GATEWAY_REGISTRY_RE = re.compile(
+    r"mcp-gateway-registry"
+    r"\s*(?:==|>=|~=|<=|<|>|@|:|\"?\s*version\"?\s*[:=])?\s*v?([0-9][\w.\-]*)?",
+    re.IGNORECASE,
+)
+
+
+def _check_mcp_gateway_registry_pin(project_root: Path, scanned_files: set[str]) -> list[Finding]:
+    findings: list[Finding] = []
+
+    def _fire(rel: str, raw: str | None) -> None:
+        shown = f"{raw!r}" if raw else "unpinned"
+        findings.append(make_finding(
+            "AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001",
+            rel,
+            f"Amazon mcp-gateway-registry referenced at {shown} — CVE-2026-14471 "
+            "SQL injection (crafted table_name interpolated into an SQL "
+            "identifier in the metrics-service retention policy) is fixed in "
+            "1.0.13; pin >= 1.0.13.",
+        ))
+
+    candidates: list[Path] = []
+    candidates.extend(project_root.glob("requirements*.txt"))
+    for name in (
+        "pyproject.toml", "Pipfile", "Pipfile.lock", "poetry.lock", "uv.lock",
+        "package.json", "package-lock.json",
+        ".mcp.json", "mcp.json", "claude_desktop_config.json",
+    ):
+        p = project_root / name
+        if p.is_file():
+            candidates.append(p)
+    candidates.extend(project_root.glob("*.mcp.yaml"))
+    candidates.extend(project_root.glob("*.mcp.yml"))
+
+    for path in candidates:
+        try:
+            text = path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        m = _MCP_GATEWAY_REGISTRY_RE.search(text)
+        if not m:
+            continue
+        raw = m.group(1)
+        version = _semver3(raw) if raw else None
+        if version is None or version < _MCP_GATEWAY_REGISTRY_PATCHED:
+            rel = str(path.relative_to(project_root))
+            scanned_files.add(rel)
+            _fire(rel, raw)
+    return findings
+
+
 # ---------------------------------------------------------------------------
 # AAK-EXCEL-MCP-001 — excel-mcp-server <= 0.1.7 (CVE-2026-40576).
 # Path-traversal in get_excel_path(). Fixed in 0.1.8.

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/docs/ci-cd.md

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.46
+      - uses: sattyamjjain/agent-audit-kit@v0.3.47
         with:
           severity: low
           fail-on: high
@@ -22,7 +22,7 @@ jobs:
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.46
+    rev: v0.3.47
     hooks:
       - id: agent-audit-kit
       # Or strict mode:

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/docs/coverage/owasp-agentic-top10.md

@@ -11,7 +11,7 @@ Every row is derived from the live AAK rule registry (`agent_audit_kit/rules/bui
 | OWASP | Title | Coverage | # rules | Rule IDs |
 | --- | --- | :---: | :---: | --- |
 | **ASI01** | Goal Hijack | Full | 12 | `AAK-AGENT-001`, `AAK-AGENT-002`, `AAK-AGENT-003`, `AAK-AGENT-004`, `AAK-AGENT-005`, `AAK-CREWAI-CHAIN-2026-04-001`, `AAK-DEEPSEEK-V4-MOE-TOOL-INJ-001`, `AAK-MCP-KONG-CVE-2026-13341-001`, `AAK-MCPWN-001`, `AAK-METIS-REFUSAL-REFEED-001`, `AAK-METIS-SCORING-SINK-001`, `AAK-SKILL-005` |
-| **ASI02** | Tool Misuse | Full | 38 | `AAK-AGENT-SHARED-RES-AUTHZ-001`, `AAK-ANTHROPIC-SDK-001`, `AAK-ASTROMCP-SQLI-CVE-2026-7591-001`, `AAK-CHATGPT-MCP-CVE-2026-7061-PIN-001`, `AAK-CREWAI-CVE-2026-2285-001`, `AAK-DOCSGPT-MCP-STDIO-MITM-001`, `AAK-DORIS-001`, `AAK-EXCEL-MCP-001`, `AAK-FLOWISE-001`, `AAK-GPTRESEARCHER-MCP-STDIO-MITM-001`, `AAK-HOOK-007`, `AAK-LANGCHAIN-PROMPT-LOADER-PATH-001`, `AAK-LITELLM-CVE-2026-30623-PIN-001`, `AAK-LLM-SQL-RCE-001`, `AAK-MCP-004`, `AAK-MCP-009`, `AAK-MCP-010`, `AAK-MCP-ARGV-TOCTOU-001`, `AAK-MCP-ATLASSIAN-CVE-2026-27825-001`, `AAK-MCP-ATLASSIAN-CVE-2026-27826-001`, `AAK-MCP-STDIO-CMD-INJ-001`, `AAK-MCP-STDIO-CMD-INJ-002`, `AAK-MCP-STDIO-CMD-INJ-003`, `AAK-MCP-STDIO-CMD-INJ-004`, `AAK-MCP-STDIO-LAUNCHER-INJECT-001`, `AAK-MCP-TOOL-UNSAFE-EVAL-001`, `AAK-MCP-TOOLGATE-ASYMMETRY-001`, `AAK-MCP-TUNNEL-001`, `AAK-MCPCALC-CVE-2026-44717-PIN-001`, `AAK-MCPWN-001`, `AAK-METIS-REFUSAL-REFEED-001`, `AAK-METIS-SCORING-SINK-001`, `AAK-SK-INMEMORY-VECTORSTORE-FILTER-CVE-2026-26030-PIN-001`, `AAK-STDIO-001`, `AAK-TAINT-005`, `AAK-TAINT-007`, `AAK-TAINT-008`, `AAK-TOXICFLOW-001` |
+| **ASI02** | Tool Misuse | Full | 39 | `AAK-AGENT-SHARED-RES-AUTHZ-001`, `AAK-ANTHROPIC-SDK-001`, `AAK-ASTROMCP-SQLI-CVE-2026-7591-001`, `AAK-CHATGPT-MCP-CVE-2026-7061-PIN-001`, `AAK-CREWAI-CVE-2026-2285-001`, `AAK-DOCSGPT-MCP-STDIO-MITM-001`, `AAK-DORIS-001`, `AAK-EXCEL-MCP-001`, `AAK-FLOWISE-001`, `AAK-GPTRESEARCHER-MCP-STDIO-MITM-001`, `AAK-HOOK-007`, `AAK-LANGCHAIN-PROMPT-LOADER-PATH-001`, `AAK-LITELLM-CVE-2026-30623-PIN-001`, `AAK-LLM-SQL-RCE-001`, `AAK-MCP-004`, `AAK-MCP-009`, `AAK-MCP-010`, `AAK-MCP-ARGV-TOCTOU-001`, `AAK-MCP-ATLASSIAN-CVE-2026-27825-001`, `AAK-MCP-ATLASSIAN-CVE-2026-27826-001`, `AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001`, `AAK-MCP-STDIO-CMD-INJ-001`, `AAK-MCP-STDIO-CMD-INJ-002`, `AAK-MCP-STDIO-CMD-INJ-003`, `AAK-MCP-STDIO-CMD-INJ-004`, `AAK-MCP-STDIO-LAUNCHER-INJECT-001`, `AAK-MCP-TOOL-UNSAFE-EVAL-001`, `AAK-MCP-TOOLGATE-ASYMMETRY-001`, `AAK-MCP-TUNNEL-001`, `AAK-MCPCALC-CVE-2026-44717-PIN-001`, `AAK-MCPWN-001`, `AAK-METIS-REFUSAL-REFEED-001`, `AAK-METIS-SCORING-SINK-001`, `AAK-SK-INMEMORY-VECTORSTORE-FILTER-CVE-2026-26030-PIN-001`, `AAK-STDIO-001`, `AAK-TAINT-005`, `AAK-TAINT-007`, `AAK-TAINT-008`, `AAK-TOXICFLOW-001` |
 | **ASI03** | Memory Poisoning | Full | 56 | `AAK-A2A-005`, `AAK-A2A-006`, `AAK-CLAUDECODE-CVE-2026-40068-PIN-001`, `AAK-HOOK-002`, `AAK-HOOK-006`, `AAK-INDIA-PII-001`, `AAK-INDIA-PII-002`, `AAK-INDIA-PII-003`, `AAK-INDIA-PII-004`, `AAK-INDIA-PII-005`, `AAK-INDIA-PII-006`, `AAK-IPI-WILD-CORPUS-001`, `AAK-MCP-001`, `AAK-MCP-003`, `AAK-MCP-011`, `AAK-MCP-012`, `AAK-MCP-013`, `AAK-MCP-014`, `AAK-MCP-017`, `AAK-MCP-019`, `AAK-MCP-020`, `AAK-MCP-ATTEST-001`, `AAK-MCP-AUTH-PATHTRAVERSAL-001`, `AAK-MCP-CARD-002`, `AAK-MCP-ENV-PLACEHOLDER-EXFIL-001`, `AAK-MCP-HTTP-NOAUTH-SERVER-001`, `AAK-MCP-NOAUTH-DEFAULT`, `AAK-MCP-SAMPLING-001`, `AAK-MCP-STATELESS-001`, `AAK-MCP-TUNNEL-002`, `AAK-MCP-TUNNEL-003`, `AAK-OAUTH-001`, `AAK-OAUTH-002`, `AAK-OAUTH-003`, `AAK-OAUTH-004`, `AAK-OAUTH-005`, `AAK-OPENCLAW-PRIVESC-001`, `AAK-PRTITLE-IPI-001`, `AAK-SECRET-001`, `AAK-SECRET-002`, `AAK-SECRET-003`, `AAK-SECRET-004`, `AAK-SECRET-005`, `AAK-SECRET-006`, `AAK-SECRET-007`, `AAK-SECRET-008`, `AAK-SECRET-009`, `AAK-TASKS-001`, `AAK-TASKS-002`, `AAK-TASKS-003`, `AAK-TRANSPORT-001`, `AAK-TRANSPORT-002`, `AAK-TRANSPORT-004`, `AAK-TRUST-003`, `AAK-TRUST-004`, `AAK-TRUST-007` |
 | **ASI04** | Identity & Privilege Abuse | Full | 38 | `AAK-AGENT-HARNESS-SHARED-STATE-001`, `AAK-AGENT-SHARED-RES-AUTHZ-001`, `AAK-AZURE-MCP-001`, `AAK-AZURE-MCP-NOAUTH-001`, `AAK-CREWAI-CVE-2026-2286-001`, `AAK-DNS-REBIND-001`, `AAK-EXCEL-MCP-001`, `AAK-LANGCHAIN-003`, `AAK-LANGCHAIN-SSRF-REDIR-001`, `AAK-LEGAL-001`, `AAK-LEGAL-002`, `AAK-LEGAL-003`, `AAK-LMDEPLOY-VL-SSRF-001`, `AAK-MARKETPLACE-001`, `AAK-MARKETPLACE-002`, `AAK-MARKETPLACE-003`, `AAK-MARKETPLACE-004`, `AAK-MCP-005`, `AAK-MCP-007`, `AAK-MCP-ATTEST-001`, `AAK-MCP-CARD-004`, `AAK-MCP-FHI-001`, `AAK-MCP-SANDBOX-SELFDISABLE-001`, `AAK-MCP-TOOLGATE-ASYMMETRY-001`, `AAK-NEO4J-001`, `AAK-OAUTH-3P-001`, `AAK-OAUTH-SCOPE-001`, `AAK-SEC-MD-001`, `AAK-SKILL-LIFECYCLE-ATTRIBUTION-001`, `AAK-SPLUNK-MCP-TOKEN-LEAK-001`, `AAK-SPLUNK-TOKLOG-001`, `AAK-SSRF-TOCTOU-001`, `AAK-SUPPLY-001`, `AAK-SUPPLY-002`, `AAK-SUPPLY-003`, `AAK-SUPPLY-004`, `AAK-SUPPLY-005`, `AAK-SUPPLY-006` |
 | **ASI05** | Cascading Failures | Full | 33 | `AAK-CREWAI-CHAIN-2026-04-001`, `AAK-CREWAI-CVE-2026-2275-001`, `AAK-HEALTHCARE-AI-001`, `AAK-HEALTHCARE-AI-002`, `AAK-HEALTHCARE-AI-003`, `AAK-HEALTHCARE-AI-004`, `AAK-HEALTHCARE-AI-005`, `AAK-HOOK-001`, `AAK-HOOK-003`, `AAK-HOOK-004`, `AAK-HOOK-005`, `AAK-HOOK-008`, `AAK-HOOK-009`, `AAK-LLM-SQL-RCE-001`, `AAK-LOGINJ-001`, `AAK-MCP-002`, `AAK-MCP-006`, `AAK-MCP-008`, `AAK-MCP-016`, `AAK-MCP-018`, `AAK-MCP-STDIO-LAUNCHER-INJECT-001`, `AAK-MCP-TOOL-UNSAFE-EVAL-001`, `AAK-MCP-TUNNEL-001`, `AAK-MCPCALC-CVE-2026-44717-PIN-001`, `AAK-ROUTINE-001`, `AAK-ROUTINE-002`, `AAK-ROUTINE-003`, `AAK-SK-INMEMORY-VECTORSTORE-FILTER-CVE-2026-26030-PIN-001`, `AAK-TAINT-001`, `AAK-TAINT-002`, `AAK-TAINT-003`, `AAK-TAINT-004`, `AAK-TAINT-006` |

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/docs/coverage/owasp-mcp-top10.md

@@ -13,7 +13,7 @@ Every row is derived from the live AAK rule registry (`agent_audit_kit/rules/bui
 | **MCP01:2025** | Token & Credential Mismanagement | Full | 48 | `AAK-A2A-005`, `AAK-A2A-008`, `AAK-A2A-011`, `AAK-AGENT-004`, `AAK-ANTHROPIC-SDK-001`, `AAK-ASTROMCP-SQLI-CVE-2026-7591-001`, `AAK-CHATGPT-MCP-CVE-2026-7061-PIN-001`, `AAK-DOCSGPT-MCP-STDIO-MITM-001`, `AAK-FLOWISE-001`, `AAK-GPTRESEARCHER-MCP-STDIO-MITM-001`, `AAK-HOOK-002`, `AAK-IPI-WILD-CORPUS-001`, `AAK-LITELLM-CVE-2026-30623-PIN-001`, `AAK-MCP-003`, `AAK-MCP-011`, `AAK-MCP-012`, `AAK-MCP-014`, `AAK-MCP-019`, `AAK-MCP-020`, `AAK-MCP-ATLASSIAN-CVE-2026-27825-001`, `AAK-MCP-ATLASSIAN-CVE-2026-27826-001`, `AAK-MCP-ENV-PLACEHOLDER-EXFIL-001`, `AAK-MCP-STDIO-CMD-INJ-001`, `AAK-MCP-STDIO-CMD-INJ-002`, `AAK-MCP-STDIO-CMD-INJ-003`, `AAK-MCP-STDIO-CMD-INJ-004`, `AAK-MCP-TOOL-UNSAFE-EVAL-001`, `AAK-MCPCALC-CVE-2026-44717-PIN-001`, `AAK-NEO4J-001`, `AAK-OAUTH-001`, `AAK-OAUTH-002`, `AAK-OAUTH-003`, `AAK-OAUTH-004`, `AAK-OAUTH-005`, `AAK-PRTITLE-IPI-001`, `AAK-SECRET-001`, `AAK-SECRET-002`, `AAK-SECRET-003`, `AAK-SECRET-004`, `AAK-SECRET-005`, `AAK-SECRET-006`, `AAK-SECRET-007`, `AAK-SECRET-008`, `AAK-SECRET-009`, `AAK-STDIO-001`, `AAK-TRANSPORT-004`, `AAK-TRUST-002`, `AAK-TRUST-005` |
 | **MCP02:2025** | Context Over-Sharing / Tool Sprawl | Full | 12 | `AAK-A2A-001`, `AAK-A2A-009`, `AAK-A2A-010`, `AAK-AZURE-MCP-001`, `AAK-AZURE-MCP-NOAUTH-001`, `AAK-DNS-REBIND-001`, `AAK-EXCEL-MCP-001`, `AAK-HOOK-007`, `AAK-MCP-004`, `AAK-MCP-SAMPLING-001`, `AAK-MCP-TUNNEL-003`, `AAK-MCPWN-001` |
 | **MCP03:2025** | Supply Chain Attacks | Full | 27 | `AAK-CLAUDE-WIN-001`, `AAK-INDIA-PII-001`, `AAK-INDIA-PII-002`, `AAK-INDIA-PII-003`, `AAK-INDIA-PII-004`, `AAK-INDIA-PII-005`, `AAK-INDIA-PII-006`, `AAK-LANGCHAIN-003`, `AAK-LEGAL-001`, `AAK-LEGAL-002`, `AAK-LEGAL-003`, `AAK-MARKETPLACE-001`, `AAK-MARKETPLACE-002`, `AAK-MARKETPLACE-003`, `AAK-MARKETPLACE-004`, `AAK-MCP-005`, `AAK-MCP-007`, `AAK-MCP-CARD-003`, `AAK-NEO4J-001`, `AAK-SEC-MD-001`, `AAK-SUPPLY-001`, `AAK-SUPPLY-002`, `AAK-SUPPLY-003`, `AAK-SUPPLY-004`, `AAK-SUPPLY-005`, `AAK-SUPPLY-006`, `AAK-WINDSURF-001` |
-| **MCP04:2025** | Command Injection | Full | 21 | `AAK-A2A-003`, `AAK-A2A-012`, `AAK-AGENT-001`, `AAK-AGENT-002`, `AAK-DORIS-001`, `AAK-HOOK-001`, `AAK-HOOK-005`, `AAK-HOOK-008`, `AAK-HOOK-009`, `AAK-LLM-SQL-RCE-001`, `AAK-LOGINJ-001`, `AAK-MCP-002`, `AAK-MCP-006`, `AAK-MCP-008`, `AAK-MCP-STDIO-LAUNCHER-INJECT-001`, `AAK-MCP-TUNNEL-001`, `AAK-TAINT-001`, `AAK-TAINT-002`, `AAK-TAINT-005`, `AAK-TAINT-006`, `AAK-TAINT-007` |
+| **MCP04:2025** | Command Injection | Full | 22 | `AAK-A2A-003`, `AAK-A2A-012`, `AAK-AGENT-001`, `AAK-AGENT-002`, `AAK-DORIS-001`, `AAK-HOOK-001`, `AAK-HOOK-005`, `AAK-HOOK-008`, `AAK-HOOK-009`, `AAK-LLM-SQL-RCE-001`, `AAK-LOGINJ-001`, `AAK-MCP-002`, `AAK-MCP-006`, `AAK-MCP-008`, `AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001`, `AAK-MCP-STDIO-LAUNCHER-INJECT-001`, `AAK-MCP-TUNNEL-001`, `AAK-TAINT-001`, `AAK-TAINT-002`, `AAK-TAINT-005`, `AAK-TAINT-006`, `AAK-TAINT-007` |
 | **MCP05:2025** | Tool Poisoning / Trust Boundary | Full | 46 | `AAK-AGENT-003`, `AAK-AGENT-005`, `AAK-DNS-REBIND-002`, `AAK-DOCSGPT-MCP-STDIO-MITM-001`, `AAK-GHA-IMMUTABLE-001`, `AAK-GPTRESEARCHER-MCP-STDIO-MITM-001`, `AAK-HOOK-004`, `AAK-LANGCHAIN-SSRF-REDIR-001`, `AAK-LITELLM-CVE-2026-30623-PIN-001`, `AAK-LMDEPLOY-VL-SSRF-001`, `AAK-MCP-ARGV-TOCTOU-001`, `AAK-MCP-CARD-001`, `AAK-MCP-INSPECTOR-CVE-2026-23744-001`, `AAK-MCP-KONG-CVE-2026-13341-001`, `AAK-MCP-MARKETPLACE-CONFIG-FETCH-001`, `AAK-MCP-STDIO-CMD-INJ-001`, `AAK-MCP-STDIO-CMD-INJ-002`, `AAK-MCP-STDIO-CMD-INJ-003`, `AAK-MCP-STDIO-CMD-INJ-004`, `AAK-MCP-TOOL-UNSAFE-EVAL-001`, `AAK-MCPCALC-CVE-2026-44717-PIN-001`, `AAK-OAUTH-3P-001`, `AAK-OAUTH-SCOPE-001`, `AAK-POISON-001`, `AAK-POISON-002`, `AAK-POISON-003`, `AAK-POISON-004`, `AAK-POISON-005`, `AAK-POISON-006`, `AAK-RUGPULL-001`, `AAK-RUGPULL-002`, `AAK-RUGPULL-003`, `AAK-SKILL-001`, `AAK-SKILL-002`, `AAK-SKILL-003`, `AAK-SKILL-004`, `AAK-SKILL-UNTRUSTED-EXEC-PATH`, `AAK-SSRF-TOCTOU-001`, `AAK-TASKS-001`, `AAK-TASKS-002`, `AAK-TASKS-003`, `AAK-TRUST-001`, `AAK-TRUST-003`, `AAK-TRUST-004`, `AAK-TRUST-006`, `AAK-TRUST-007` |
 | **MCP06:2025** | Privilege Escalation | Full | 13 | `AAK-AGENT-SHARED-RES-AUTHZ-001`, `AAK-HOOK-003`, `AAK-HOOK-006`, `AAK-MCP-010`, `AAK-MCP-016`, `AAK-MCP-018`, `AAK-MCP-FHI-001`, `AAK-MCP-SANDBOX-SELFDISABLE-001`, `AAK-MCP-TOOLGATE-ASYMMETRY-001`, `AAK-MCP-TUNNEL-001`, `AAK-TAINT-003`, `AAK-TAINT-008`, `AAK-TOXICFLOW-001` |
 | **MCP07:2025** | Insufficient Authentication | Full | 25 | `AAK-A2A-002`, `AAK-A2A-004`, `AAK-A2A-006`, `AAK-A2A-007`, `AAK-DNS-REBIND-001`, `AAK-DNS-REBIND-002`, `AAK-MCP-001`, `AAK-MCP-011`, `AAK-MCP-017`, `AAK-MCP-ATTEST-001`, `AAK-MCP-AUTH-PATHTRAVERSAL-001`, `AAK-MCP-CARD-002`, `AAK-MCP-CARD-004`, `AAK-MCP-HTTP-NOAUTH-SERVER-001`, `AAK-MCP-NOAUTH-DEFAULT`, `AAK-MCP-SAMPLING-001`, `AAK-MCP-STATELESS-001`, `AAK-MCP-STATELESS-002`, `AAK-MCP-STATELESS-003`, `AAK-MCP-STATELESS-004`, `AAK-MCP-TUNNEL-002`, `AAK-MCP-TUNNEL-003`, `AAK-TRANSPORT-001`, `AAK-TRANSPORT-002`, `AAK-TRANSPORT-003` |

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/docs/getting-started.md

@@ -51,7 +51,7 @@ Add to `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.46
+    rev: v0.3.47
     hooks:
       - id: agent-audit-kit
 ```
@@ -59,7 +59,7 @@ repos:
 ## GitHub Action
 
 ```yaml
-- uses: sattyamjjain/agent-audit-kit@v0.3.46
+- uses: sattyamjjain/agent-audit-kit@v0.3.47
   with:
     severity: low
     fail-on: high

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/docs/launch/hn.md

@@ -23,7 +23,7 @@
 > evidence output** — SARIF + OWASP MCP Top 10 + EU AI Act Article 15
 > + SOC 2 + ISO 27001 / 42001 + HIPAA + NIST AI RMF in one scan.
 >
-> agent-audit-kit is that. 231 deterministic rules. Zero cloud
+> agent-audit-kit is that. 232 deterministic rules. Zero cloud
 > dependencies, no auth required. MIT.
 >
 > The leaderboard: we run the scanner weekly against 500 public MCP
@@ -44,7 +44,7 @@
 - **"Does it use an LLM?"**
   → No. The moat is deterministic rules. We keep an optional
   `--llm-scan` flag for semantic tool-description checks, but the core
-  231 rules are regex + AST patterns that run in <50 ms on a normal
+  232 rules are regex + AST patterns that run in <50 ms on a normal
   project.
 - **"What's your false-positive rate?"**
   → We scan 500 public MCP servers weekly. Ground-truth is unknown

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/docs/launch/reddit.md

@@ -19,7 +19,7 @@ the #1 channel for this repo.
 > that default to allow-all, path traversal in resource handlers,
 > SSRF in outbound-fetch tools, tokens in query params.
 >
-> We built agent-audit-kit, an OSS scanner: 231 deterministic rules,
+> We built agent-audit-kit, an OSS scanner: 232 deterministic rules,
 > SARIF + OWASP MCP Top 10 + compliance report for EU AI Act /
 > SOC 2 / ISO 27001 / HIPAA / NIST AI RMF. No auth, no cloud. MIT.
 >
@@ -54,7 +54,7 @@ the #1 channel for this repo.
 > `pip install agent-audit-kit && agent-audit-kit scan .`
 > Finds misconfigured hooks (CVE-2025-59536 was the catalyst), MCP
 > servers without auth, skill poisoning in SKILL.md files, supply-chain
-> risks in marketplace manifests, missing OAuth 2.1 PKCE. 231 rules.
+> risks in marketplace manifests, missing OAuth 2.1 PKCE. 232 rules.
 > Outputs SARIF for GitHub Security tab.
 >
 > Repo: https://github.com/sattyamjjain/agent-audit-kit
@@ -78,7 +78,7 @@ the #1 channel for this repo.
 > OWASP MCP Top 10 reference scanner — 10/10 coverage, SARIF, EU AI Act evidence
 
 **Body:** developer-audience, technical:
-> If you maintain an MCP server, this is the linter. 231 rules mapped
+> If you maintain an MCP server, this is the linter. 232 rules mapped
 > to OWASP MCP Top 10 and OWASP Agentic 2026 (ASI01–ASI10). GitHub
 > Action that surfaces findings in the Security tab via SARIF. Docker
 > image at ghcr.io. VS Code extension with on-save diagnostics.

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.47}/docs/launch/x-thread.md

@@ -22,7 +22,7 @@ Post same Tuesday as HN, ~1h after HN submission.
 
 > agent-audit-kit — OSS static scanner for MCP-connected AI agents.
 >
-> 231 deterministic rules. SARIF → GitHub Security tab.
+> 232 deterministic rules. SARIF → GitHub Security tab.
 > Compliance evidence for EU AI Act Article 15, SOC 2, ISO 27001/42001,
 > HIPAA, NIST AI RMF.
 >
@@ -92,7 +92,7 @@ Post same Tuesday as HN, ~1h after HN submission.
 > • Repo: github.com/sattyamjjain/agent-audit-kit
 > • Leaderboard: mcp-security-index.com
 > • VS Code Marketplace: agent-audit-kit
-> • GitHub Action: uses: sattyamjjain/agent-audit-kit@v0.3.46
+> • GitHub Action: uses: sattyamjjain/agent-audit-kit@v0.3.47
 >
 > MIT. No strings.