agent-audit-kit 0.3.46__tar.gz → 0.3.48__tar.gz

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.48}/CHANGELOG.cves.md

@@ -8,6 +8,19 @@ shipped-at timestamp. The GitHub Action `.github/workflows/cve-watcher.yml`
 diffs NVD's MCP keyword feed against this file and opens an
 `sla-48h`-labelled issue for anything new.
 
+## Shipped in v0.3.48 (2026-07-08)
+
+| Incident / Anchor | Reference | AAK rule(s) | Shipped | Latency |
+|---|---|---|---|---|
+| CVE-2026-49471 (Serena MCP toolkit `serena-agent` < 1.5.2 — unauthenticated Flask dashboard on a fixed port + DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to RCE; CWE-306 + CWE-352) | [NVD CVE-2026-49471](https://nvd.nist.gov/vuln/detail/CVE-2026-49471) (HIGH, CVSS 8.3, published 2026-07-07) | **AAK-MCP-SERENA-CVE-2026-49471-001** (NEW: HIGH, MCP_CONFIG — version-pin, fires < 1.5.2 / unpinned / unpinned `oraios/serena` launch ref) | 2026-07-08 | <24h on NVD |
+| CVE-2026-14748 (AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary` — SSRF: the `url` argument of the tool handler is fetched server-side with no host/scheme allow-list, CWE-918; rolling-release project, no fixed version) | [NVD CVE-2026-14748](https://nvd.nist.gov/vuln/detail/CVE-2026-14748) (MEDIUM, CVSS 6.3, published 2026-07-05) | **AAK-MCP-SSRF-001** (NEW: MEDIUM, MCP_CONFIG — `ast` param→fetch taint / regex fallback, fires on unvalidated tool-arg URL) | 2026-07-08 | ~72h on NVD (past 48h target) |
+
+## Shipped in v0.3.47 (2026-07-07)
+
+| Incident / Anchor | Reference | AAK rule(s) | Shipped | Latency |
+|---|---|---|---|---|
+| CVE-2026-14471 (Amazon mcp-gateway-registry < 1.0.13 — SQL injection: crafted `table_name` interpolated into an SQL identifier in the metrics-service retention policy, CWE-89) | [NVD CVE-2026-14471](https://nvd.nist.gov/vuln/detail/CVE-2026-14471) (HIGH, CVSS 8.1, published 2026-07-06) | **AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001** (NEW: HIGH, SUPPLY_CHAIN — version-pin, fires < 1.0.13 / unpinned) | 2026-07-07 | <24h on NVD |
+
 ## Shipped in v0.3.46 (2026-07-06)
 
 | Incident / Anchor | Reference | AAK rule(s) | Shipped | Latency |

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.48}/CHANGELOG.md

@@ -7,6 +7,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added — AAK-MCP-SERENA-CVE-2026-49471-001: pin CVE-2026-49471 (Serena MCP unauthenticated-dashboard RCE)
+
+CVE-response (closes #411). New **HIGH** rule + version-pin detector for
+[CVE-2026-49471](https://nvd.nist.gov/vuln/detail/CVE-2026-49471) (CVSS 8.3,
+CWE-306 + CWE-352): the Serena MCP coding toolkit (`serena-agent`) before 1.5.2
+ships an unauthenticated Flask dashboard on a fixed port (no auth, no CSRF, no
+Host-header validation); a DNS-rebinding attack writes arbitrary content into
+the agent's persistent memory store, which — combined with
+`execute_shell_command(shell=True)` — is a remote-code-execution chain. Fires on
+`serena-agent < 1.5.2` / unpinned, and on an unpinned `oraios/serena` /
+`serena-mcp-server` launch reference, across manifests + MCP config files.
+Fixture-backed test; `rules.json` regenerated. Rule count **233 → 234**.
+
+### Added — AAK-MCP-SSRF-001: pin CVE-2026-14748 (MCP-server SSRF via unvalidated tool-arg URL, CWE-918)
+
+New **MEDIUM** rule + scanner (`mcp_ssrf_toolarg`) for
+[CVE-2026-14748](https://nvd.nist.gov/vuln/detail/CVE-2026-14748) (CVSS 6.3
+MEDIUM, CWE-918): an MCP tool handler that passes an attacker-controllable `url` /
+`endpoint` / `target` argument straight into an outbound `requests` / `httpx` /
+`urllib` / `aiohttp` fetch with no host/scheme allow-list — AIAnytime
+Awesome-MCP-Server's `mcp-wiki/wiki-summary` is the anchor. Detection uses a
+stdlib `ast` parameter→fetch taint path for Python (the same mechanism as
+`mcp_auth_pathtraversal`; no new engine) with a comment-stripped regex fallback
+for TS/JS/Rust. Complements the generic `AAK-SSRF-001..005` text family, which
+keys on request-object accessors and misses the bare-parameter CVE shape.
+Committed fixture pair (`tests/fixtures/mcp_ssrf/` — vulnerable + host-allow-listed
+safe handler); cross-referenced to OWASP MCP09:2025 + Agentic ASI06;
+`rules.json` regenerated. Rule count **232 → 233**, scanners **81 → 82**.
+
+### Added — AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001 (Amazon mcp-gateway-registry SQLi)
+
+CVE-response (closes #408). New **HIGH** rule + version-pin detector for
+[CVE-2026-14471](https://nvd.nist.gov/vuln/detail/CVE-2026-14471) (CVSS 8.1):
+Amazon `mcp-gateway-registry` before 1.0.13 interpolates a caller-supplied
+`table_name` into an SQL identifier position in the metrics-service retention
+policy (CWE-89), letting an authenticated remote user run arbitrary SQL. Fires
+on `< 1.0.13` or an unpinned reference across manifests + MCP config files;
+fixture-backed test; `rules.json` regenerated. Rule count **231 → 232**.
+
+### Fixed — correct SEP citations on the AAK-MCP-STATELESS-* pack
+
+Citation-accuracy pass on the shipped stateless-migration rules (no detection
+change, rule count stays 231). The `Mcp-Session-Id` / protocol-session removal
+was mis-attributed to SEP-1442; it is actually **SEP-2567** ("Sessionless MCP
+via Explicit State Handles"), with SEP-1442 / **SEP-2575** making the init
+handshake optional so stateless is the default. The `tasks/list` removal cited
+a **non-existent SEP-1359**; corrected to the experimental Tasks primitive
+(**SEP-1686**) moving out of core into the Extensions framework (redesigned as
+**SEP-2663**). Updated `AAK-MCP-STATELESS-001`/`-002` descriptions, the
+`mcp_stateless_migration` scanner docstring + engine label, and `rules.json`.
+Verified against modelcontextprotocol.io + the MCP GitHub SEPs. Version
+**0.3.46 → 0.3.47**.
+
 ### Security — Flowise CVE-2026-58057 (closes #372)
 
 Bumped `AAK-FLOWISE-001`'s pin floor **3.1.2 → 3.1.3** and added

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-audit-kit
-Version: 0.3.46
+Version: 0.3.48
 Summary: Security scanner for MCP-connected AI agent pipelines
 Project-URL: Homepage, https://github.com/sattyamjjain/agent-audit-kit
 Project-URL: Repository, https://github.com/sattyamjjain/agent-audit-kit
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
   <a href="https://pypi.org/project/agent-audit-kit/"><img src="https://img.shields.io/pypi/v/agent-audit-kit.svg" alt="PyPI"></a>
   <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.9+-blue.svg" alt="Python 3.9+"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-231-blue.svg" alt="Rules: 231"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-234-blue.svg" alt="Rules: 234"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -61,9 +61,9 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 13 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
 
-- **<!-- rule-count:total -->231<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->234<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
-- **<!-- scanner-count:total -->81<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
+- **<!-- scanner-count:total -->82<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
 - **16 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `watch`, plus `export-rules`, `verify-bundle`, `sbom`, `report`, `install-precommit`, and the Security-Advisories scan flag
 - **OWASP coverage**: Agentic Top 10 (10/10), MCP Top 10 (10/10), Adversa AI Top 25
 - **Compliance mapping** (13 frameworks): EU AI Act Art. 15 + 55, SOC 2, ISO 27001, ISO/IEC 42001, HIPAA, NIST AI RMF, **NSA MCP Security CSI (U/OO/6030316-26, May 2026)**, Singapore Agentic AI, India DPDP 2023, **Alabama Personal Data Protection Act (HB 351, 2026)**, **Tennessee SB 1580 Health Care AI (PRA)**, **MCP 2026 Roadmap (May 2026)** — PDF reports via `agent-audit-kit report --format pdf --framework <name>`
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.46
+      - uses: sattyamjjain/agent-audit-kit@v0.3.48
         with:
           fail-on: high
 ```
@@ -120,7 +120,7 @@ agent-audit-kit scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.46
+    rev: v0.3.48
     hooks:
       - id: agent-audit-kit
 ```
@@ -144,8 +144,8 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
-| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->53<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1) |
-| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->41<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**) |
+| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->55<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1), MCP tool-argument URL SSRF (an MCP tool handler passing a caller-supplied `url`/`endpoint`/`target` argument straight into an outbound `requests`/`httpx`/`urllib`/`aiohttp` fetch with no host/scheme allow-list — `ast` parameter→fetch taint for Python, regex fallback for TS/JS/Rust — `AAK-MCP-SSRF-001`, **CWE-918 / CVE-2026-14748**, AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary`), Serena MCP toolkit unauthenticated-dashboard RCE (`serena-agent` < 1.5.2 — an unauthenticated Flask dashboard on a fixed port reachable via DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to remote code execution — `AAK-MCP-SERENA-CVE-2026-49471-001`, **CWE-306 + CWE-352 / CVE-2026-49471**, HIGH 8.3) |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->42<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**) |
 | **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->27<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->15<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
@@ -157,7 +157,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->12<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
 | **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
 
-**<!-- rule-count:total -->231<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->234<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
 
 ### MCP Server Card scanning (SEP-1649)
 
@@ -352,11 +352,11 @@ cross-reference, not a head-to-head benchmark.
 | ASI | Title | # rules |
 | --- | --- | --- |
 | **ASI01** | Goal Hijack | 12 |
-| **ASI02** | Tool Misuse | 38 |
+| **ASI02** | Tool Misuse | 39 |
 | **ASI03** | Memory Poisoning | 56 |
-| **ASI04** | Identity & Privilege Abuse | 38 |
+| **ASI04** | Identity & Privilege Abuse | 39 |
 | **ASI05** | Cascading Failures | 33 |
-| **ASI06** | Unauthorized Capability Acquisition | 30 |
+| **ASI06** | Unauthorized Capability Acquisition | 31 |
 | **ASI07** | Plan Injection | 9 |
 | **ASI08** | Agent Communication Poisoning | 4 |
 | **ASI09** | Resource Abuse | 14 |
@@ -398,7 +398,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->231<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->234<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.48}/README.md

@@ -8,7 +8,7 @@
   <a href="https://pypi.org/project/agent-audit-kit/"><img src="https://img.shields.io/pypi/v/agent-audit-kit.svg" alt="PyPI"></a>
   <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.9+-blue.svg" alt="Python 3.9+"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-231-blue.svg" alt="Rules: 231"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-234-blue.svg" alt="Rules: 234"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -27,9 +27,9 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 13 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
 
-- **<!-- rule-count:total -->231<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->234<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
-- **<!-- scanner-count:total -->81<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
+- **<!-- scanner-count:total -->82<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
 - **16 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `watch`, plus `export-rules`, `verify-bundle`, `sbom`, `report`, `install-precommit`, and the Security-Advisories scan flag
 - **OWASP coverage**: Agentic Top 10 (10/10), MCP Top 10 (10/10), Adversa AI Top 25
 - **Compliance mapping** (13 frameworks): EU AI Act Art. 15 + 55, SOC 2, ISO 27001, ISO/IEC 42001, HIPAA, NIST AI RMF, **NSA MCP Security CSI (U/OO/6030316-26, May 2026)**, Singapore Agentic AI, India DPDP 2023, **Alabama Personal Data Protection Act (HB 351, 2026)**, **Tennessee SB 1580 Health Care AI (PRA)**, **MCP 2026 Roadmap (May 2026)** — PDF reports via `agent-audit-kit report --format pdf --framework <name>`
@@ -66,7 +66,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.46
+      - uses: sattyamjjain/agent-audit-kit@v0.3.48
         with:
           fail-on: high
 ```
@@ -86,7 +86,7 @@ agent-audit-kit scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.46
+    rev: v0.3.48
     hooks:
       - id: agent-audit-kit
 ```
@@ -110,8 +110,8 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
-| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->53<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1) |
-| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->41<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**) |
+| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->55<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1), MCP tool-argument URL SSRF (an MCP tool handler passing a caller-supplied `url`/`endpoint`/`target` argument straight into an outbound `requests`/`httpx`/`urllib`/`aiohttp` fetch with no host/scheme allow-list — `ast` parameter→fetch taint for Python, regex fallback for TS/JS/Rust — `AAK-MCP-SSRF-001`, **CWE-918 / CVE-2026-14748**, AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary`), Serena MCP toolkit unauthenticated-dashboard RCE (`serena-agent` < 1.5.2 — an unauthenticated Flask dashboard on a fixed port reachable via DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to remote code execution — `AAK-MCP-SERENA-CVE-2026-49471-001`, **CWE-306 + CWE-352 / CVE-2026-49471**, HIGH 8.3) |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->42<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**) |
 | **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->27<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->15<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
@@ -123,7 +123,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->12<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
 | **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
 
-**<!-- rule-count:total -->231<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->234<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
 
 ### MCP Server Card scanning (SEP-1649)
 
@@ -318,11 +318,11 @@ cross-reference, not a head-to-head benchmark.
 | ASI | Title | # rules |
 | --- | --- | --- |
 | **ASI01** | Goal Hijack | 12 |
-| **ASI02** | Tool Misuse | 38 |
+| **ASI02** | Tool Misuse | 39 |
 | **ASI03** | Memory Poisoning | 56 |
-| **ASI04** | Identity & Privilege Abuse | 38 |
+| **ASI04** | Identity & Privilege Abuse | 39 |
 | **ASI05** | Cascading Failures | 33 |
-| **ASI06** | Unauthorized Capability Acquisition | 30 |
+| **ASI06** | Unauthorized Capability Acquisition | 31 |
 | **ASI07** | Plan Injection | 9 |
 | **ASI08** | Agent Communication Poisoning | 4 |
 | **ASI09** | Resource Abuse | 14 |
@@ -364,7 +364,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->231<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->234<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.48}/action.yml

@@ -1,5 +1,5 @@
 name: 'AgentAuditKit MCP Security Scan'
-description: 'AgentAuditKit — MCP Security Scan (231 rules, OWASP Agentic Top 10 + MCP Top 10)'
+description: 'AgentAuditKit — MCP Security Scan (234 rules, OWASP Agentic Top 10 + MCP Top 10)'
 author: 'sattyamjjain'
 
 branding:

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.48}/agent_audit_kit/__init__.py

@@ -1,6 +1,6 @@
 """AgentAuditKit — Security scanner for MCP-connected AI agent pipelines."""
 from __future__ import annotations
 
-__version__ = "0.3.46"
-RULE_COUNT = 231
-SCANNER_COUNT = 81
+__version__ = "0.3.48"
+RULE_COUNT = 234
+SCANNER_COUNT = 82

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.48}/agent_audit_kit/engine.py

@@ -84,7 +84,7 @@ _OPTIONAL_SCANNERS: list[tuple[str, str, list[str]]] = [
     ("skill_lifecycle_attribution", "Skill lifecycle outcome-attribution (SkillsVote, arXiv:2605.18401)", []),
     ("agent_harness_shared_state", "Multi-agent shared-state lock (Code-as-Harness, arXiv:2605.18747)", []),
     ("mcp_sampling_capability", "MCP `sampling` capability consent guard (MCP07:2025)", []),
-    ("mcp_stateless_migration", "MCP 2026-07-28 stateless-migration smells (SEP-1442/1359)", []),
+    ("mcp_stateless_migration", "MCP 2026-07-28 stateless-migration smells (SEP-2567/1442/2575)", []),
     ("eu_ai_act_art15_locale", "EU AI Act Art. 15 multilingual-eval coverage (advisory)", []),
     ("mcp_tunnel", "MCP Tunnels gateway config + credential exposure (Anthropic 2026-05-19 research preview)", []),
     ("sandbox_self_disable", "Tool-schema sandbox self-disable parameter (CVE-2026-42074)", []),
@@ -99,6 +99,7 @@ _OPTIONAL_SCANNERS: list[tuple[str, str, list[str]]] = [
     ("mcp_noauth_default", "MCP server unauthenticated-by-default / fail-open auth (CVE-2026-48814)", []),
     ("mcp_auth_pathtraversal", "MCP bearer-token joined into session file path (CVE-2026-52830)", []),
     ("mcp_server_card", "MCP Server Card static audit (SEP-1649 /.well-known/mcp/server-card.json)", []),
+    ("mcp_ssrf_toolarg", "MCP tool-arg URL SSRF (CVE-2026-14748)", []),
 ]
 
 

{agent_audit_kit-0.3.46 → agent_audit_kit-0.3.48}/agent_audit_kit/rules/builtin.py

@@ -125,6 +125,9 @@ _AICM_TAGS: dict[str, list[str]] = {
     "AAK-AZURE-MCP-NOAUTH-001": ["IAM-01", "IAM-16"],
     "AAK-MCP-AUTH-PATHTRAVERSAL-001": ["IAM-01", "IVS-04"],
     "AAK-MCP-KONG-CVE-2026-13341-001": ["AIS-07", "AIS-12"],
+    "AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001": ["AIS-07", "DSP-07"],
+    "AAK-MCP-SSRF-001": ["IVS-04", "AIS-08"],
+    "AAK-MCP-SERENA-CVE-2026-49471-001": ["IAM-01", "IAM-16"],
     "AAK-LMDEPLOY-VL-SSRF-001": ["IVS-04", "AIS-08"],
     "AAK-SPLUNK-MCP-TOKEN-LEAK-001": ["DSP-17", "LOG-06"],
     "AAK-MARKETPLACE-001": ["STA-10"],
@@ -525,22 +528,27 @@ _r(
 # ---------------------------------------------------------------------------
 # AAK-MCP-STATELESS-001..004 — 2026-07-28 stateless-MCP migration
 #
-# The MCP 2026-07-28 spec release candidate (locked 2026-05-21) makes the
-# protocol stateless by default: the `Mcp-Session-Id` header and the
-# protocol-level session are removed (SEP-1442), and the experimental
-# `tasks/list` method is removed because it can't be scoped safely without
-# sessions (SEP-1359). Server/client code that assumes the pre-RC stateful
-# protocol — relies on `Mcp-Session-Id`, dispatches `tasks/list`, requires
-# sticky routing or a shared session store, or skips client-side caching of
-# `tools/list` while holding per-session server state — will silently break
-# after 2026-07-28 once the final spec lands. These four rules surface the
-# migration surface so it can be fixed before the cutover.
+# The MCP 2026-07-28 spec release candidate makes the protocol stateless by
+# default: the `Mcp-Session-Id` header and the protocol-level session are
+# removed and replaced with explicit, server-minted state handles (SEP-2567),
+# while making the mandatory initialization handshake optional so stateless is
+# the default (SEP-1442 / SEP-2575). The experimental Tasks primitive (SEP-1686)
+# — including `tasks/list` — is moved out of the core spec into the Extensions
+# framework (redesigned as SEP-2663), so core `tasks/list` is removed. Server/
+# client code that assumes the pre-RC stateful protocol — relies on
+# `Mcp-Session-Id`, dispatches `tasks/list`, requires sticky routing or a shared
+# session store, or skips client-side caching of `tools/list` while holding
+# per-session server state — will silently break after 2026-07-28 once the final
+# spec lands. These four rules surface the migration surface so it can be fixed
+# before the cutover.
 #
 # Sources:
 #   https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/
-#   https://blog.modelcontextprotocol.io/posts/2025-12-19-mcp-transport-future/
+#   https://modelcontextprotocol.io/seps/2567-sessionless-mcp
 #   https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1442
-#   https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1359
+#   https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2575
+#   https://modelcontextprotocol.io/community/seps/1686-tasks
+#   https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2663
 # ---------------------------------------------------------------------------
 
 _r(
@@ -548,8 +556,10 @@ _r(
     "Reliance on `Mcp-Session-Id` header / protocol-level session id",
     "Server or client code reads, writes, asserts, or constants the "
     "`Mcp-Session-Id` header. The MCP 2026-07-28 spec release candidate "
-    "(SEP-1442) makes the protocol stateless and removes the "
-    "`Mcp-Session-Id` header along with the protocol-level session. After "
+    "removes the `Mcp-Session-Id` header and the protocol-level session, "
+    "replacing them with explicit server-minted state handles (SEP-2567); "
+    "SEP-1442 / SEP-2575 make the initialization handshake optional so "
+    "stateless is the default. After "
     "the final spec lands on 2026-07-28, code that depends on this header "
     "(or on the session it represented) will silently break: any MCP "
     "request can land on any server instance, and sticky routing / shared "
@@ -572,10 +582,11 @@ _r(
     "Use of removed `tasks/list` method",
     "Server or client code dispatches, handles, or names the `tasks/list` "
     "JSON-RPC method. The MCP 2026-07-28 spec release candidate removes "
-    "`tasks/list` outright because it cannot be scoped safely without the "
-    "protocol-level session. Tasks moves out of the core specification into "
-    "the new Extensions framework; the stateful list surface has no "
-    "stateless successor.",
+    "`tasks/list` from the core because it cannot be scoped safely without "
+    "the protocol-level session: the experimental Tasks primitive (SEP-1686) "
+    "moves out of the core specification into the Extensions framework "
+    "(redesigned as SEP-2663), and the stateful list surface has no "
+    "stateless successor in core.",
     Severity.HIGH,
     Category.MCP_CONFIG,
     "Stop calling and handling `tasks/list`. If your application needs an "
@@ -5196,6 +5207,108 @@ _r(
     adversa_references=["ADV-INJECT-01"],
 )
 
+_r(
+    "AAK-MCP-GATEWAY-REGISTRY-CVE-2026-14471-001",
+    "Amazon mcp-gateway-registry < 1.0.13 (SQL injection)",
+    "The Amazon `mcp-gateway-registry` before 1.0.13 improperly neutralizes a "
+    "caller-supplied `table_name` in the metrics-service retention-policy "
+    "component: the value is interpolated directly into an SQL statement in "
+    "identifier position, so an authenticated remote user can execute arbitrary "
+    "SQL against the gateway's metrics store (CVE-2026-14471, HIGH CVSS 8.1, "
+    "CWE-89, published 2026-07-06). A project that depends on the gateway "
+    "registry at a version below 1.0.13 (or unpinned) is exposed.",
+    Severity.HIGH,
+    Category.SUPPLY_CHAIN,
+    "Upgrade `mcp-gateway-registry` to >= 1.0.13 and pin it explicitly. Never "
+    "interpolate a request-supplied value into an SQL identifier position; "
+    "validate `table_name` against a fixed allow-list of known table names, or "
+    "quote it with the driver's identifier-quoting API rather than string "
+    "formatting.",
+    sarif_name="McpGatewayRegistrySqlInjection",
+    cve_references=["CVE-2026-14471"],
+    owasp_mcp_references=["MCP04:2025"],
+    owasp_agentic_references=["ASI02"],
+    adversa_references=["ADV-SUPPLY-01"],
+)
+
+
+# ---------------------------------------------------------------------------
+# MCP tool-argument URL SSRF (CVE-2026-14748).
+#
+# The generic AAK-SSRF-001..005 family keys on request-object accessors
+# (`args[...]` / `req.query` / `request.json`) and misses the canonical
+# CVE-2026-14748 shape, where a bare tool-handler PARAMETER named `url` flows
+# straight into `requests.get(url)`. This CVE-pinned rule closes that gap with
+# an AST parameter->fetch taint path, mirroring how AAK-LANGCHAIN-SSRF-REDIR-001
+# and AAK-LMDEPLOY-VL-SSRF-001 sit alongside the generic SSRF class.
+# ---------------------------------------------------------------------------
+
+_r(
+    "AAK-MCP-SSRF-001",
+    "MCP tool handler fetches a caller-supplied URL without host/scheme allow-list",
+    "An MCP tool handler passes an attacker-controllable URL argument "
+    "(`url` / `endpoint` / `target` / `uri` and similar) straight into an "
+    "outbound fetch (`requests` / `httpx` / `urllib` / `aiohttp`) without "
+    "validating the host or scheme first, so a caller-supplied URL is fetched "
+    "server-side and can reach loopback, private-range, or cloud-metadata "
+    "endpoints (CWE-918, server-side request forgery). NVD, CVE-2026-14748: "
+    "\"A flaw has been found in AIAnytime Awesome-MCP-Server ... the file "
+    "mcp-wiki/src/mcp_wiki/server.py of the component mcp-wiki/wiki-summary. "
+    "This manipulation of the argument url causes server-side request forgery. "
+    "The attack may be initiated remotely. The exploit has been published.\" "
+    "(CVSS 6.3 MEDIUM, https://nvd.nist.gov/vuln/detail/CVE-2026-14748).",
+    Severity.MEDIUM,
+    Category.MCP_CONFIG,
+    "Deny by default: before fetching, parse the URL, require an https scheme, "
+    "resolve the host, and reject anything not on an explicit host allow-list "
+    "(also reject RFC 1918, 127.0.0.0/8, 169.254.0.0/16, ::1, fc00::/7). "
+    "Disable automatic redirects or re-validate every hop, and pin the resolved "
+    "IP for the actual request to defeat DNS rebinding.",
+    sarif_name="McpToolArgUrlSsrf",
+    cve_references=["CVE-2026-14748"],
+    owasp_mcp_references=["MCP09:2025"],
+    owasp_agentic_references=["ASI06"],
+    adversa_references=["ADV-SSRF-01"],
+)
+
+
+# ---------------------------------------------------------------------------
+# Serena MCP toolkit unauthenticated-dashboard → RCE (CVE-2026-49471).
+# Delivered as a dependency version-pin (fixed in serena-agent 1.5.2), mirroring
+# the gateway-registry / Kong CVE pins, but the underlying weakness is CWE-306
+# missing authentication (+ CWE-352 CSRF / DNS-rebinding) — same MCP_CONFIG
+# no-auth class as AAK-AZURE-MCP-NOAUTH-001.
+# ---------------------------------------------------------------------------
+
+_r(
+    "AAK-MCP-SERENA-CVE-2026-49471-001",
+    "Serena MCP toolkit < 1.5.2 (unauthenticated dashboard → DNS-rebinding RCE)",
+    "The Serena MCP coding toolkit (`serena-agent`) before 1.5.2 ships a "
+    "built-in web dashboard that \"exposes an unauthenticated Flask API on a "
+    "fixed, predictable port, with no authentication, no CSRF protection, and "
+    "no Host header validation. A DNS rebinding attack allows a malicious "
+    "webpage to reach this API from any browser and write arbitrary content to "
+    "the agent's persistent memory store, which the agent reads and acts on "
+    "autonomously. Combined with execute_shell_command using shell=True, this "
+    "creates a remote code execution chain requiring only that the victim visit "
+    "a malicious webpage while Serena is running.\" (NVD, CVE-2026-49471, HIGH "
+    "CVSS 8.3, CWE-306 + CWE-352, published 2026-07-07). A project depending on "
+    "`serena-agent` below 1.5.2 (or unpinned, or launched from an unpinned "
+    "`oraios/serena` / `serena-mcp-server` reference) is exposed. Fixed in 1.5.2.",
+    Severity.HIGH,
+    Category.MCP_CONFIG,
+    "Upgrade `serena-agent` to >= 1.5.2 and pin it explicitly. 1.5.2 binds the "
+    "dashboard to loopback, adds a random per-session token, validates the Host "
+    "header, and enforces CSRF — which together break the DNS-rebinding path. "
+    "Do not expose the Serena dashboard on a routable interface, and keep "
+    "`execute_shell_command` behind an explicit approval gate.",
+    sarif_name="SerenaMcpUnauthDashboardRce",
+    cve_references=["CVE-2026-49471"],
+    owasp_mcp_references=["MCP02:2025"],
+    owasp_agentic_references=["ASI04"],
+    adversa_references=["ADV-AUTH-01"],
+)
+
 
 # ---------------------------------------------------------------------------
 # Internal / meta rules (surfaced when the scanner itself has a problem)