PyPI - agent-audit-kit - Versions diffs - 0.3.49__tar.gz → 0.3.52__tar.gz - Mend

agent-audit-kit 0.3.49tar.gz → 0.3.52tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (715) hide show

{agent_audit_kit-0.3.49 → agent_audit_kit-0.3.52}/.github/workflows/cve-watcher.yml RENAMED Viewed

@@ -1,9 +1,12 @@
-name: AAK Response SLA — CVE watcher
+name: AAK CVE watcher — best-effort rule coverage
-# Implements the public 48-hour CVE-to-rule commitment described in
-# ROADMAP_2026.md §2.3. Queries NVD's keyword feed for recent MCP-related
-# CVEs, diffs against what's already in CHANGELOG.cves.md, and files an
-# issue tagged `cve-response` for anything new. Runs every 6 hours.
+# Best-effort disclosed-CVE rule coverage (ROADMAP_2026.md §2.3): triage newly
+# disclosed MCP CVEs and turn them into rules as fast as we responsibly can.
+# No public deadline is promised — a solo maintainer can't carry an unbounded
+# clock — but the CHANGELOG.cves.md ledger keeps actual coverage and timing
+# transparent. Queries NVD's keyword feed for recent MCP-related CVEs, diffs
+# against what's already in CHANGELOG.cves.md, and files an issue tagged
+# `cve-response` for anything new. Runs every 6 hours.
 on:
   schedule:
@@ -67,7 +70,7 @@ jobs:
                 ``,
                 cve.description || '(no description yet)',
                 ``,
-                `### AAK response checklist (48h SLA)`,
+                `### AAK response checklist (best-effort — no fixed deadline)`,
                 ``,
                 `- [ ] Verify CVE on NVD + vendor advisory`,
                 `- [ ] Author rule(s): \`AAK-XXX-XXX\``,
@@ -81,6 +84,9 @@ jobs:
                 repo: context.repo.repo,
                 title,
                 body,
-                labels: ['cve-response', 'sla-48h'],
+                // The release gate (release.yml) refuses to ship while any open
+                // `cve-response` issue exists. The old `sla-48h` label was
+                // retired with the 48h SLA (PR #432); it is no longer applied.
+                labels: ['cve-response'],
               });
             }

{agent_audit_kit-0.3.49 → agent_audit_kit-0.3.52}/.github/workflows/release.yml RENAMED Viewed

@@ -13,9 +13,10 @@ permissions:
 jobs:
   # --------------------------------------------------------------------------
-  # 0. Gate: refuse to release while any sla-48h CVE-response issue is open.
+  # 0. Gate: refuse to release while any cve-response issue is open.
   #    Implements CLAUDE_PROMPT.md §5(1) — "blocks release until the issue
-  #    is closed". (C14)
+  #    is closed". (C14). Keys off the `cve-response` label; the old `sla-48h`
+  #    label was retired with the 48h SLA (PR #432).
   # --------------------------------------------------------------------------
   cve-response-gate:
     name: CVE-response gate
@@ -29,13 +30,13 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          count=$(gh issue list --repo "$GITHUB_REPOSITORY" --label sla-48h --state open --json number --jq length)
+          count=$(gh issue list --repo "$GITHUB_REPOSITORY" --label cve-response --state open --json number --jq length)
           if [ "$count" != "0" ]; then
-            echo "::error ::cve-response gate: $count open sla-48h issue(s). Close them (or resolve with patch-release) before tagging."
-            gh issue list --repo "$GITHUB_REPOSITORY" --label sla-48h --state open
+            echo "::error ::cve-response gate: $count open cve-response issue(s). Triage + close them (pin or disposition) before tagging."
+            gh issue list --repo "$GITHUB_REPOSITORY" --label cve-response --state open
             exit 1
           fi
-          echo "cve-response gate: clean — 0 open sla-48h issues."
+          echo "cve-response gate: clean — 0 open cve-response issues."
   # --------------------------------------------------------------------------
   # 1. Publish to PyPI using trusted publishing (OIDC)

{agent_audit_kit-0.3.49 → agent_audit_kit-0.3.52}/CHANGELOG.cves.md RENAMED Viewed

@@ -1,20 +1,113 @@
-# AAK Response SLA — CVE-to-Rule Ledger
+# AAK CVE-to-Rule Ledger
-We publicly commit to shipping rule coverage for every disclosed MCP CVE
-within **48 hours of NVD disclosure**. This file is the audit trail.
+We triage newly disclosed MCP CVEs continuously and ship rule coverage as fast
+as we responsibly can — no fixed public deadline (see `ROADMAP_2026.md §2.3`).
+This file is the audit trail of what shipped and when.
 Format: one line per CVE, `CVE-YYYY-NNNNN` → `AAK-XXX-NNN` with the
 shipped-at timestamp. The GitHub Action `.github/workflows/cve-watcher.yml`
-diffs NVD's MCP keyword feed against this file and opens an
-`sla-48h`-labelled issue for anything new.
+diffs NVD's MCP keyword feed against this file and opens a `cve-response`
+issue for anything new; the release gate blocks a tag while any such issue is
+open.
+> **On the "48h" figures below:** AgentAuditKit does not commit to a 48-hour (or
+> any fixed) CVE-response SLA — that public commitment was retired in PR #432.
+> The `sla-48h` label is likewise retired and should be removed from any open
+> issue. The per-CVE latency figures in the tables are **measurements recorded at
+> the time**, kept as dated facts, not a standing promise.
+## Dispositioned 2026-07-19 (v0.3.52)
+| Incident / Anchor | Reference | AAK rule(s) / disposition | Dispositioned |
+|---|---|---|---|
+| CVE-2026-16133 (LiuMengxuan04 MiniCode 0.1.0 — `child_process.spawn` command injection in `mcp.ts`) | [NVD CVE-2026-16133](https://nvd.nist.gov/vuln/detail/CVE-2026-16133) (MEDIUM, CVSS 5) | **Class-covered** by `AAK-MCP-STDIO-CMD-INJ-*` (TS/JS MCP stdio `child_process.spawn` command injection). Not pinned — GitHub-only project (0.1.0), no released fix (upstream PR pending), no matching npm/PyPI artifact. | 2026-07-19 |
+## MCP 2026-07-28 ratification reconciliation — 2026-07-16 (v0.3.50)
+The 2026-07-28 MCP specification is still a **release candidate** as of this
+date: the RC was locked on 2026-05-21 (milestone `2026-07-28-RC`) and the final,
+ratified spec publishes on **2026-07-28** (12 days out). Every AAK rule shipped
+in July for that spec is therefore *correctly* labelled "release candidate" — no
+rule is relabelled "ratified" ahead of publication. This attestation records that
+each rule's cited SEP number was re-verified against primary sources and is
+accurate; nothing needed correcting.
+Primary sources: [SEP-2596 PR #2596](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2596)
+(labelled `final`, milestone `2026-07-28-RC`),
+[SEP-2577/2596 spec-incorporation PR #2791](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2791),
+[2026-07-28 RC blog](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/).
+| Rule(s) | Cited SEP(s) | Verified meaning | Status |
+|---|---|---|---|
+| AAK-MCP-DEPRECATED-001..003 | SEP-2577 + SEP-2596 | SEP-2577 annotation-deprecates Roots/Sampling/Logging; SEP-2596 is the 12-month feature-lifecycle & deprecation policy | ✓ accurate · RC label correct |
+| AAK-OAUTH-006 | SEP-2468 (RFC 9207) | `iss` authorization-response validation | ✓ accurate · RC label correct |
+| AAK-MCP-STATELESS-001 | SEP-2567, SEP-2575, SEP-1442 | session removal / stateless transport; optional initialization handshake | ✓ accurate · RC label correct |
+| AAK-MCP-STATELESS-002 | SEP-1686, SEP-2663 | experimental Tasks primitive → Tasks extension | ✓ accurate · RC label correct |
+Separately, **AAK-OAUTH-007** (new in v0.3.50) is cited to the **ratified** MCP
+2025-11-25 authorization spec — RFC 8707 Resource Indicators are mandatory today
+(`resource` parameter on authorization + token requests; server-side audience
+validation), independent of the 2026-07-28 RC. It is not part of this RC
+reconciliation.
+## Shipped in v0.3.50 (2026-07-18) — 2026-07-15..17 wave
+Response to a second 2026-07 disclosure wave (24 CVEs, issues #445–#468) the NVD
+watcher filed while the earlier backlog was being cleared. Fourteen CVEs cluster
+onto seven pinnable packages (many share one fix version) and ship as version-pins
+(`mcp_cve_pins_2026_07`, now 22 pins); one is covered by an existing pin; nine are
+dispositioned (PHP / GitHub Action / WordPress ecosystems, no vendor fix, or no NVD
+version data). Packages + floors verified against PyPI / npm; `mcp` and `n8n-mcp`
+pins use precise token regexes so they never trip `fastmcp` / `mcp-text-editor` /
+`n8n`.
+| Incident / Anchor | Reference | AAK rule(s) / disposition | Shipped |
+|---|---|---|---|
+| CVE-2026-52869 + CVE-2026-52870 + CVE-2026-59950 (MCP Python SDK `mcp` < 1.28.1 — cross-client session injection, task cross-access, WebSocket no-Origin) | [NVD CVE-2026-52869](https://nvd.nist.gov/vuln/detail/CVE-2026-52869) (HIGH, CVSS 7.1) | **AAK-MCP-SDK-CVE-2026-52869-001** (NEW: HIGH, SUPPLY_CHAIN — pin `mcp` >= 1.28.1) | 2026-07-18 |
+| CVE-2026-46339 + CVE-2026-49353 + CVE-2026-62312 (9Router `9router` < 0.5.2 — unauthenticated MCP bridge → command exec / RCE) | [NVD CVE-2026-46339](https://nvd.nist.gov/vuln/detail/CVE-2026-46339) (CRITICAL, CVSS 10) | **AAK-MCP-9ROUTER-CVE-2026-46339-001** (NEW: CRITICAL, SUPPLY_CHAIN — pin `9router` >= 0.5.2) | 2026-07-18 |
+| CVE-2026-54052 + CVE-2026-55608 (n8n-MCP `n8n-mcp` < 2.57.4 — multi-tenant workflow-backup isolation bypass) | [NVD CVE-2026-54052](https://nvd.nist.gov/vuln/detail/CVE-2026-54052) (CRITICAL, CVSS 9.9) | **AAK-MCP-N8NMCP-CVE-2026-54052-001** (NEW: CRITICAL, SUPPLY_CHAIN — pin `n8n-mcp` >= 2.57.4) | 2026-07-18 |
+| CVE-2026-44968 + CVE-2026-44970 + CVE-2026-44969 (dbt-mcp `dbt-mcp` < 1.17.1 — dbt-flag injection into subprocess argv; tool-arg leakage via telemetry + file logging) | [NVD CVE-2026-44968](https://nvd.nist.gov/vuln/detail/CVE-2026-44968) (MEDIUM, CVSS 6.3) | **AAK-MCP-DBTMCP-CVE-2026-44968-001** (NEW: MEDIUM, SUPPLY_CHAIN — pin `dbt-mcp` >= 1.17.1) | 2026-07-18 |
+| CVE-2026-46341 (Apify MCP `@apify/actors-mcp-server` < 0.9.21 — `fetch-apify-docs` `startsWith()` allowlist bypass → SSRF) | [NVD CVE-2026-46341](https://nvd.nist.gov/vuln/detail/CVE-2026-46341) (MEDIUM, CVSS 6.1) | **AAK-MCP-APIFY-CVE-2026-46341-001** (NEW: MEDIUM, SUPPLY_CHAIN — pin `@apify/actors-mcp-server` >= 0.9.21) | 2026-07-18 |
+| CVE-2026-58195 (Agentic-Flow `agentic-flow` < 2.0.14 — MCP tool params interpolated into `execSync()` → OS command injection) | [NVD CVE-2026-58195](https://nvd.nist.gov/vuln/detail/CVE-2026-58195) (HIGH, CVSS 8.8) | **AAK-MCP-AGENTICFLOW-CVE-2026-58195-001** (NEW: HIGH, SUPPLY_CHAIN — pin `agentic-flow` >= 2.0.14) | 2026-07-18 |
+| CVE-2026-15415 (AWS HealthOmics MCP `awslabs.aws-healthomics-mcp-server` < 0.0.36 — `workflow_files` directory traversal writes outside the bundle dir) | [NVD CVE-2026-15415](https://nvd.nist.gov/vuln/detail/CVE-2026-15415) (MEDIUM, CVSS 5.5) | **AAK-MCP-HEALTHOMICS-CVE-2026-15415-001** (NEW: MEDIUM, SUPPLY_CHAIN — pin >= 0.0.36) | 2026-07-18 |
+| CVE-2026-62208 (OpenClaw before 2026.6.5 — Authorization headers forwarded during MCP SSE redirects) | [NVD CVE-2026-62208](https://nvd.nist.gov/vuln/detail/CVE-2026-62208) (MEDIUM, CVSS 6.5) | **Covered** by `AAK-MCP-OPENCLAW-CVE-2026-62195-001` (fires < 2026.6.6, which includes the < 2026.6.5 affected range); CVE added to that rule's references | 2026-07-18 |
+| CVE-2026-46512 / 46513 / 46514 / 46515 (Frogman headless-PBX MCP < 1.6.2 / 1.6.3 — dialplan injection → Asterisk RCE, raw API-token storage, plaintext creds in audit log, PERM_READ over-exposure) | [NVD CVE-2026-46512](https://nvd.nist.gov/vuln/detail/CVE-2026-46512) (CRITICAL, CVSS 9.9) | **Documented, not pinned** — Frogman is a PHP application (`Tools/*.php`, `oc_*` tables); AAK's pin detector reads PyPI/npm manifests only | 2026-07-18 |
+| CVE-2026-47751 (Claude Code Action < 1.0.74 — checks out attacker PR head + auto-enables all project MCP servers from a malicious `.mcp.json` → runner RCE + secret exfil) | [NVD CVE-2026-47751](https://nvd.nist.gov/vuln/detail/CVE-2026-47751) (CVSS n/a) | **Documented, not pinned** — a GitHub Action pinned in `.github/workflows` (`uses: anthropics/claude-code-action@vX`), not a PyPI/npm manifest artifact | 2026-07-18 |
+| CVE-2026-9810 (AI Copilot WordPress plugin < 1.5.4 — OAuth token not bound to a WP user → unauth admin MCP-tool execution) | [NVD CVE-2026-9810](https://nvd.nist.gov/vuln/detail/CVE-2026-9810) (CVSS n/a) | **Documented, not pinned** — a WordPress/PHP plugin; unsupported ecosystem for the pin detector | 2026-07-18 |
+| CVE-2026-57860 (ForgeCode `forgecode` — auto-loads + executes a repo's `.mcp.json` on startup with no confirmation → RCE from an untrusted repo) | [NVD CVE-2026-57860](https://nvd.nist.gov/vuln/detail/CVE-2026-57860) (HIGH, CVSS 7.8) | **Documented, not pinned** — NVD/advisory name no fixed version (design-level auto-exec); untrusted-`.mcp.json`-launch class | 2026-07-18 |
+| CVE-2026-9135 + CVE-2026-7755 (IBM Langflow OSS — ToolGuard dynamic-CodeInput code injection bypassing `allow_custom_components=false`; RCE via incomplete MCP-config validation) | [NVD CVE-2026-9135](https://nvd.nist.gov/vuln/detail/CVE-2026-9135) (CRITICAL, CVSS 9.9) | **Documented, not pinned** — NVD published no CPE data and the affected range is ambiguous (`1.0.0`–`1.10.0` vs "up to 1.9.2"); will pin once the fixed version is confirmed (tracked) | 2026-07-18 |
+## Shipped in v0.3.50 (2026-07-16)
+Response to the 2026-07-13..15 disclosure wave (13 CVEs, issues #429–#442).
+Eight have a vendor fix + a pinnable PyPI/npm artifact and ship as version-pins
+(`mcp_cve_pins_2026_07`); five have no pinnable artifact, no vendor fix, or an
+unsupported ecosystem and are dispositioned below. Package names, fix floors, and
+(where NVD published CPE data) affected ranges were verified against PyPI / npm /
+NVD before shipping.
+| Incident / Anchor | Reference | AAK rule(s) / disposition | Shipped |
+|---|---|---|---|
+| CVE-2026-15643 (AWS HealthLake MCP `awslabs.healthlake-mcp-server` < 0.0.14 — `next_token` pagination SSRF exfiltrates AWS temporary credentials to an attacker endpoint) | [NVD CVE-2026-15643](https://nvd.nist.gov/vuln/detail/CVE-2026-15643) (HIGH, CVSS 7.3) | **AAK-MCP-HEALTHLAKE-CVE-2026-15643-001** (NEW: HIGH, SUPPLY_CHAIN — pin >= 0.0.14) | 2026-07-16 |
+| CVE-2026-61427 (PraisonAI `praisonai` < 4.6.78 — MCP HTTP-stream unauthenticated by default; `--api-key` defaults to None → `tools/list` + `tools/call`) | [NVD CVE-2026-61427](https://nvd.nist.gov/vuln/detail/CVE-2026-61427) (HIGH, CVSS 7.3) | **AAK-MCP-PRAISONAI-CVE-2026-61427-001** (NEW: HIGH, SUPPLY_CHAIN — pin >= 4.6.78) | 2026-07-16 |
+| CVE-2026-58500 (MCP Appium `appium-mcp` < 1.85.10 — `createLocatorGeneratorUI` HTML/JS injection → `window.parent.postMessage` invokes arbitrary MCP tools) | [NVD CVE-2026-58500](https://nvd.nist.gov/vuln/detail/CVE-2026-58500) (HIGH, CVSS 8.2) | **AAK-MCP-APPIUM-CVE-2026-58500-001** (NEW: HIGH, SUPPLY_CHAIN — pin >= 1.85.10) | 2026-07-16 |
+| CVE-2026-45805 (Penpot MCP `@penpot/mcp` < 2.15.0 — ReplServer on `0.0.0.0:4403` exposes unauthenticated `/execute` → JS RCE) | [NVD CVE-2026-45805](https://nvd.nist.gov/vuln/detail/CVE-2026-45805) (HIGH, CVSS 8.8) | **AAK-MCP-PENPOT-CVE-2026-45805-001** (NEW: CRITICAL, SUPPLY_CHAIN — pin >= 2.15.0) | 2026-07-16 |
+| CVE-2026-62195 (OpenClaw `openclaw` 2026.5.20–<2026.6.6 — MCP loopback authorization bypass lets lower-trust callers run owner-only tools) | [NVD CVE-2026-62195](https://nvd.nist.gov/vuln/detail/CVE-2026-62195) (HIGH, CVSS 8.3; NVD CPE `2026.5.20` <= v < `2026.6.6`) | **AAK-MCP-OPENCLAW-CVE-2026-62195-001** (NEW: HIGH, SUPPLY_CHAIN — pin >= 2026.6.6, introduced 2026.5.20) | 2026-07-16 |
+| CVE-2026-49988 (Repomix `repomix` < 1.14.1 — MCP `attach_packed_output`/`read_repomix_output` reads local files without the `runSecretLint()` boundary) | [NVD CVE-2026-49988](https://nvd.nist.gov/vuln/detail/CVE-2026-49988) (CVSS n/a) | **AAK-MCP-REPOMIX-CVE-2026-49988-001** (NEW: MEDIUM, SUPPLY_CHAIN — pin >= 1.14.1) | 2026-07-16 |
+| CVE-2026-53512 + CVE-2026-53518 (Better Auth `better-auth` / `@better-auth/oauth-provider` < 1.6.11 — refresh-token grant skips `client_secret`; auth-code non-atomic find-then-delete → code replay; both reachable via `mcp`/`oidcProvider` plugins) | [NVD CVE-2026-53512](https://nvd.nist.gov/vuln/detail/CVE-2026-53512) (CVSS n/a) | **AAK-MCP-BETTERAUTH-CVE-2026-53512-001** (NEW: HIGH, SUPPLY_CHAIN — pin >= 1.6.11) | 2026-07-16 |
+| CVE-2026-61462 (mcp-gitlab — `job_id` path traversal in `build/index.js` redirects GitLab API calls using the operator PAT) | [NVD CVE-2026-61462](https://nvd.nist.gov/vuln/detail/CVE-2026-61462) (HIGH, CVSS 8.6) | **Documented, not pinned** — NVD has published no CPE/version data and the description names no fixed version; the "mcp-gitlab" npm name is ambiguous across several GitLab MCP servers. Will pin once the vendor fix version is confirmed (tracked). | 2026-07-16 |
+| CVE-2026-15749 (mastergo-design `mastergo-magic-mcp` <= 0.2.0 — `get-c2d.ts` `filePath` path traversal) | [NVD CVE-2026-15749](https://nvd.nist.gov/vuln/detail/CVE-2026-15749) (MEDIUM, CVSS 5.3) | **Documented, not pinned** — no PyPI/npm artifact (GitHub-only TS project) and NVD notes the vendor has not responded / released no fix, so there is no floor to pin. Path-traversal-in-tool-arg class. | 2026-07-16 |
+| CVE-2026-15750 (mastergo-design `mastergo-magic-mcp` <= 0.2.0 — `get-component-link.ts` `url` SSRF) | [NVD CVE-2026-15750](https://nvd.nist.gov/vuln/detail/CVE-2026-15750) (MEDIUM, CVSS 6.3) | **Class-covered** by `AAK-MCP-SSRF-001` (unvalidated tool-arg URL → fetch); no pinnable artifact / vendor fix | 2026-07-16 |
+| CVE-2026-15751 (mastergo-design `mastergo-magic-mcp` <= 0.2.0 — `component-workflow.md` `rootPath` path traversal) | [NVD CVE-2026-15751](https://nvd.nist.gov/vuln/detail/CVE-2026-15751) (MEDIUM, CVSS 5.3) | **Documented, not pinned** — same package/disposition as CVE-2026-15749 (no artifact, no vendor fix) | 2026-07-16 |
+| CVE-2026-15583 (Grafana MCP Server — `X-Grafana-URL` header confused-deputy exfiltrates the service-account token + SSRF to internal/metadata endpoints) | [NVD CVE-2026-15583](https://nvd.nist.gov/vuln/detail/CVE-2026-15583) (HIGH, CVSS 8.6) | **Documented, not pinned** — `mcp-grafana` is a Go module; AAK's pin detector reads PyPI/npm manifests only. SSRF / confused-deputy class. | 2026-07-16 |
 ## Shipped in v0.3.49 (2026-07-13)
 Batch response to the 2026-07-08..12 disclosure wave (13 CVEs). Eight have a
 vendor fix + a pinnable PyPI/npm artifact and ship as version-pins
 (`mcp_cve_pins_2026_07`); three have no pinnable artifact or a tractable version
-scheme and are dispositioned below. Latency exceeds the 48h target for the
-earlier CVEs — this backlog accumulated between the v0.3.48 and v0.3.49 releases
+scheme and are dispositioned below. Latency ran past 48 hours for the earlier
+CVEs — this backlog accumulated between the v0.3.48 and v0.3.49 releases
 and is recorded honestly.
 | Incident / Anchor | Reference | AAK rule(s) / disposition | Shipped |
@@ -231,6 +324,6 @@ Source: <https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critica
 | CVE-2026-34070 | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-34070) | AAK-LANGCHAIN-001, AAK-LANGCHAIN-002 | 2026-04-18 | retroactive |
 | CVE-2025-68664 | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-68664) | AAK-LANGCHAIN-003 | 2026-04-18 | retroactive |
-## Open (48h SLA ticking)
+## Open (best-effort — no committed SLA)
-_none — file response-tracking issues get posted here when the SLA fires._
+_none — newly-filed `cve-response` issues are tracked here until triaged._

{agent_audit_kit-0.3.49 → agent_audit_kit-0.3.52}/CHANGELOG.md RENAMED Viewed

@@ -7,6 +7,151 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
+## [0.3.52] - 2026-07-19
+### Added — State of MCP 2026 report: corpus expanded to 1,374 configs (closes #23)
+- **Corpus expansion.** Added the official MCP Registry as a corpus source
+  (`research/state-of-mcp-2026/fetch_registry.py` — cursor pagination, cached,
+  rate-limited) and combined it with the existing GitHub crawl. Deduped by config
+  content: **1,374 distinct configs** (664 crawl + 710 registry latest-version
+  servers) — past issue #23's 1,000-server target. Full provenance (name,
+  transport, auth mode, source URL, fetch date) is committed in
+  `corpus/registry-manifest.json`, so every number is reproducible from the
+  manifest.
+- **Report harness extended, not duplicated.** `run_report.py` now also emits the
+  auth-profile metrics — no-auth %, RFC 9728 PRM %, remote-auth static-credential
+  %, transport distribution, rule-family distribution, and the 2026-07-28 /
+  2027-07-28 migration-exposure proxies — each with n + denominator + coverage,
+  reusing `engine.run_scan` / `scoring.compute_score`. Output is deterministic
+  across Python hash seeds (ties break on a stable secondary key).
+- **`research/state-of-mcp-2026/REPORT.md`** — the publishable report: **35.1%
+  (482/1,374) no-auth, 0% (0/1,374) RFC 9728 discovery, 100% (318/318) inline-auth
+  static credential**, 36.0% critical, median grade B. Plus factual Black Hat
+  Arsenal + Briefings abstract skeletons (rewrite-before-submit markers, per
+  Black Hat's no-LLM-text rule).
+- **`make report`** regenerates the numbers from the committed manifest, offline
+  and deterministically, so the report is a build artifact that cannot drift.
+  Adds no rules (still 262).
+### Changed — retire the residual 48h CVE-response SLA wording
+- Reconciled the leftover 48h-SLA framing in `CHANGELOG.cves.md` to best-effort,
+  no committed SLA (completing the retirement from PR #432). Historical per-CVE
+  latency measurements are left as dated facts; only the live-SLA framing (the
+  "Open (48h SLA ticking)" heading, the ledger preamble) was reworded. The
+  `sla-48h` label is retired — it should be removed from open issues; the release
+  gate keys off the `cve-response` label instead.
+### Added — AAK-OAUTH-008 (RFC 9728) + `mcp-2026-07-28` auth-profile + readiness report
+- **AAK-OAUTH-008** (LOW, MCP_CONFIG) — RFC 9728 Protected-Resource-Metadata
+  discovery gap: a remote MCP server config that embeds a static
+  `Authorization`/`Bearer`/`auth` credential with no
+  `/.well-known/oauth-protected-resource` discovery path, or server source
+  enforcing bearer auth without serving PRM. Detection in `oauth_misconfig` runs
+  independent of the client-flow hint so it evaluates `.mcp.json` configs.
+- **Anti-duplicate note:** RFC 9207 `iss`-validation was *not* added as a new
+  rule — it already ships as `AAK-OAUTH-006`, which was extended to reference the
+  2026-07-28 final auth profile (the proposed OAUTH-009 would have duplicated it).
+- **`--profile mcp-2026-07-28`** (alias of `--preset`) — one-command auth-profile
+  conformance check selecting exactly `AAK-OAUTH-006` (RFC 9207) + `AAK-OAUTH-007`
+  (RFC 8707) + `AAK-OAUTH-008` (RFC 9728). New preset YAML + docs + smoke tests.
+- **Readiness report** `docs/reports/mcp-2026-07-28-readiness.md` — a dated,
+  reproducible scan of 748 public MCP configs (`benchmarks/data/`): **0 reference
+  RFC 9728 PRM discovery; 100% of the 36 remote-auth configs hardcode a static
+  credential.** Numbers come from a real scan (`scripts/mcp_2026_07_28_readiness.py`,
+  deterministic), with explicit limitations (a config corpus can't exercise the
+  code-level `iss`/`resource` checks). Rule count 261 → **262**.
+### Added — 2026-07-15..17 MCP/agent CVE disclosure-wave pins (7 rules, closes 24 cve-response issues)
+CVE-response for a second 2026-07 wave (issues #445–#468). 14 CVEs cluster onto 7
+pinnable packages (many share one fix version) → version-pins in
+`mcp_cve_pins_2026_07` (now 22 pins); 1 covered by an existing pin; 9 dispositioned
+in `CHANGELOG.cves.md` (PHP / GitHub-Action / WordPress ecosystems, no vendor fix,
+or no NVD version data). The `mcp` and `n8n-mcp` pins use precise token regexes so
+they never trip `fastmcp` / `mcp-text-editor` / `n8n` (also fixed a latent
+substring false-positive in the existing `n8n` pin).
+- **AAK-MCP-SDK-CVE-2026-52869-001** (HIGH) — `mcp` (MCP Python SDK) >= 1.28.1: session injection + task cross-access + WS no-Origin (CVE-2026-52869/52870/59950).
+- **AAK-MCP-9ROUTER-CVE-2026-46339-001** (CRITICAL) — `9router` >= 0.5.2: unauth MCP bridge → RCE (CVE-2026-46339/49353/62312).
+- **AAK-MCP-N8NMCP-CVE-2026-54052-001** (CRITICAL) — `n8n-mcp` >= 2.57.4: multi-tenant backup isolation bypass (CVE-2026-54052/55608).
+- **AAK-MCP-DBTMCP-CVE-2026-44968-001** (MEDIUM) — `dbt-mcp` >= 1.17.1: dbt-flag injection + tool-arg leakage (CVE-2026-44968/44970/44969).
+- **AAK-MCP-APIFY-CVE-2026-46341-001** (MEDIUM) — `@apify/actors-mcp-server` >= 0.9.21: `startsWith()` allowlist bypass SSRF.
+- **AAK-MCP-AGENTICFLOW-CVE-2026-58195-001** (HIGH) — `agentic-flow` >= 2.0.14: MCP params → `execSync()` command injection.
+- **AAK-MCP-HEALTHOMICS-CVE-2026-15415-001** (MEDIUM) — `awslabs.aws-healthomics-mcp-server` >= 0.0.36: `workflow_files` path traversal.
+CVE-2026-62208 (OpenClaw) added to the existing `AAK-MCP-OPENCLAW-CVE-2026-62195-001`
+pin (already covers the affected range). Dispositioned: Frogman ×4 (PHP),
+Claude Code Action (GitHub Action), AI Copilot (WordPress), ForgeCode (no fix
+version), Langflow ×2 (no NVD data). Rule count 254 → **261**.
+### Added — 2026-07-13..15 MCP/agent CVE disclosure-wave pins (7 rules, closes 13 cve-response issues)
+CVE-response for the 2026-07-13..15 disclosure wave (issues #429–#442). Eight
+CVEs have a vendor fix + a pinnable PyPI/npm artifact and ship as version-pins in
+`mcp_cve_pins_2026_07` (now 15 pins total); five are dispositioned in
+`CHANGELOG.cves.md`. Package names, fix floors, and NVD CPE ranges (where
+published) were verified before shipping.
+- **AAK-MCP-HEALTHLAKE-CVE-2026-15643-001** (HIGH) — `awslabs.healthlake-mcp-server` >= 0.0.14: `next_token` pagination SSRF → AWS credential exfil.
+- **AAK-MCP-PRAISONAI-CVE-2026-61427-001** (HIGH) — `praisonai` >= 4.6.78: MCP HTTP-stream unauthenticated by default.
+- **AAK-MCP-APPIUM-CVE-2026-58500-001** (HIGH) — `appium-mcp` >= 1.85.10: locator-UI HTML/JS injection → `postMessage` tool exec.
+- **AAK-MCP-PENPOT-CVE-2026-45805-001** (CRITICAL) — `@penpot/mcp` >= 2.15.0: ReplServer unauthenticated `/execute` → JS RCE.
+- **AAK-MCP-OPENCLAW-CVE-2026-62195-001** (HIGH) — `openclaw` >= 2026.6.6 (NVD range 2026.5.20–<2026.6.6): MCP loopback authorization bypass.
+- **AAK-MCP-REPOMIX-CVE-2026-49988-001** (MEDIUM) — `repomix` >= 1.14.1: MCP file-read bypasses the secret-lint boundary.
+- **AAK-MCP-BETTERAUTH-CVE-2026-53512-001** (HIGH) — `better-auth` / `@better-auth/oauth-provider` >= 1.6.11: refresh-token grant skips `client_secret` (CVE-2026-53512) + auth-code replay (CVE-2026-53518).
+Dispositioned (no pinnable artifact / vendor fix / supported ecosystem, documented
+in `CHANGELOG.cves.md`): CVE-2026-61462 (mcp-gitlab — no NVD version data yet),
+CVE-2026-15749/15750/15751 (mastergo-magic-mcp — GitHub-only, no vendor fix;
+15750 class-covered by `AAK-MCP-SSRF-001`), CVE-2026-15583 (Grafana MCP — Go
+ecosystem). Rule count 247 → **254**.
+### Added — AAK-OAUTH-007 (RFC 8707 Resource Indicators) + ratified-spec reconciliation
+- **AAK-OAUTH-007** (MEDIUM, MCP_CONFIG) — flags an OAuth 2.1 flow, or an MCP
+  client/server config advertising OAuth 2.1, that never sets the RFC 8707
+  `resource` parameter. Without Resource Indicators the issued token is not
+  audience-bound, so a token minted for one MCP server can be replayed at
+  another (confused-deputy / audience confusion). Cited to the **ratified** MCP
+  2025-11-25 authorization spec (RFC 8707 §2 / RFC 9728 §7.4) — a requirement
+  today, not a 2026-07-28 change. Deterministic regex detection in
+  `oauth_misconfig` (fires when a token-acquisition flow lacks `resource`;
+  silent when it is present, including RFC 9728 protected-resource-metadata).
+  Rule count 246 → **247**.
+- **MCP 2026-07-28 ratification reconciliation.** Re-verified every July rule's
+  cited SEP against primary sources (modelcontextprotocol PRs #2596/#2791, the
+  RC blog, the `2026-07-28-RC` milestone): `AAK-MCP-DEPRECATED-001..003`
+  (SEP-2577 + SEP-2596), `AAK-OAUTH-006` (SEP-2468), `AAK-MCP-STATELESS-001..004`
+  (SEP-2567/2575/1442/1686/2663) — all accurate, no corrections. The 2026-07-28
+  spec is still a **release candidate** (ratifies 2026-07-28), so the rules keep
+  their "release candidate" labelling rather than being relabelled "ratified"
+  prematurely. Attestation recorded in `CHANGELOG.cves.md`. Also softened the
+  ledger's leftover 48h-SLA header to best-effort (completing the retirement
+  started in the docs pass).
+### Changed — docs: single-source rule count + retire unbounded 48h CVE-SLA claim
+- **Single source of truth for the rule count.** `scripts/sync_rule_count.py`
+  now also drives `docs/rules.md` (the per-category Summary table is
+  regenerated wholesale from the live registry between `<!-- BEGIN/END
+  rules-summary -->` markers) and the rule-count cells in `docs/comparison.md`
+  and `docs/comparison-gitlab-agentic-sast.md` (via `<!-- rule-count:total -->`
+  anchors). These docs had drifted to a stale **221** (and silently dropped the
+  12th category, `MCP_SERVER_CARD`) while the registry was at 246. New
+  regression tests in `tests/test_rule_count_sync.py` fail CI if any of these
+  surfaces diverge from `len(RULES)`.
+- **Retired the unbounded 48-hour CVE→rule SLA.** The public commitment is now
+  a best-effort statement ("triaged continuously, shipped as fast as we
+  responsibly can, no fixed deadline"), matching `ROADMAP_2026.md §2.3`. Updated
+  the `cve-watcher` workflow name/header/checklist and the launch/application
+  copy. The NVD watcher, the `cve-response` issue flow, the `CHANGELOG.cves.md`
+  ledger, and the release gate (which keys off the retained `sla-48h` label) are
+  unchanged. Separate, bounded 48h commitments — the SECURITY.md report
+  acknowledgment and the coordinated-disclosure repo-notify window — are kept.
 ### Added — 2026-07 MCP/agent CVE disclosure-wave pins (8 rules, closes 13 sla-48h issues)
 CVE-response for the 2026-07-08..12 disclosure backlog. New table-driven scanner

agent_audit_kit-0.3.52/Makefile ADDED Viewed

@@ -0,0 +1,43 @@
+# AgentAuditKit task runner.
+#
+# The State of MCP report is a build artifact: `make report` regenerates
+# results.json from the committed corpus manifest, deterministically and
+# offline, so the numbers in research/state-of-mcp-2026/REPORT.md cannot drift
+# from the code. `make corpus` is the single network step (refreshes the
+# manifest from the MCP Registry); it is intentionally separate from `report`.
+RESEARCH := research/state-of-mcp-2026
+CORPUS   := benchmarks/data
+MANIFEST := $(RESEARCH)/corpus/registry-manifest.json
+RESULTS  := $(RESEARCH)/results.json
+.PHONY: report corpus report-check test lint typecheck
+## report: regenerate results.json from the corpus + manifest (offline, deterministic)
+report:
+	python $(RESEARCH)/run_report.py \
+	  --corpus $(CORPUS) \
+	  --registry-manifest $(MANIFEST) \
+	  --out $(RESULTS)
+## corpus: refresh the MCP Registry corpus manifest (the one network step)
+corpus:
+	python $(RESEARCH)/fetch_registry.py --target 700
+## report-check: fail if results.json is not byte-identical to a fresh run (drift guard)
+report-check:
+	@python $(RESEARCH)/run_report.py --corpus $(CORPUS) --registry-manifest $(MANIFEST) --out /tmp/aak-report-check.json >/dev/null
+	@diff -q $(RESULTS) /tmp/aak-report-check.json >/dev/null && echo "report is up to date" \
+	  || (echo "results.json is stale — run 'make report' and commit" && exit 1)
+## test: run the test suite
+test:
+	python -m pytest -q
+## lint: ruff
+lint:
+	ruff check .
+## typecheck: mypy the package
+typecheck:
+	mypy agent_audit_kit

{agent_audit_kit-0.3.49 → agent_audit_kit-0.3.52}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-audit-kit
-Version: 0.3.49
+Version: 0.3.52
 Summary: Security scanner for MCP-connected AI agent pipelines
 Project-URL: Homepage, https://github.com/sattyamjjain/agent-audit-kit
 Project-URL: Repository, https://github.com/sattyamjjain/agent-audit-kit
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
   <a href="https://pypi.org/project/agent-audit-kit/"><img src="https://img.shields.io/pypi/v/agent-audit-kit.svg" alt="PyPI"></a>
   <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.9+-blue.svg" alt="Python 3.9+"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-246-blue.svg" alt="Rules: 246"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-262-blue.svg" alt="Rules: 262"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -61,7 +61,7 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 13 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
-- **<!-- rule-count:total -->246<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->262<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
 - **<!-- scanner-count:total -->84<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
 - **16 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `watch`, plus `export-rules`, `verify-bundle`, `sbom`, `report`, `install-precommit`, and the Security-Advisories scan flag
@@ -70,6 +70,7 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 - **Supply chain**: deterministic rule bundle (`export-rules`), Sigstore-signed releases, CycloneDX + SPDX SBOM (`sbom`)
 - **MCP Security Index**: weekly public leaderboard at [sattyamjjain.github.io/agent-audit-kit](https://sattyamjjain.github.io/agent-audit-kit/) — per-server grade cards (A–F), 90-day [disclosure policy](docs/disclosure-policy.md)
 - **CVE coverage**: newly disclosed MCP CVEs are triaged and turned into rules as they land — surfaced automatically by the NVD watcher ([`cve-watcher.yml`](.github/workflows/cve-watcher.yml)) and logged in [CHANGELOG.cves.md](CHANGELOG.cves.md)
+- **OAuth / spec coverage**: the **2026-07-28 final auth profile** as a one-command check — `agent-audit-kit scan . --profile mcp-2026-07-28` runs RFC 9207 `iss` validation (`AAK-OAUTH-006`), RFC 8707 resource indicators (`AAK-OAUTH-007`), and RFC 9728 Protected-Resource-Metadata discovery (`AAK-OAUTH-008`). We scanned 748 public MCP configs with it: **0 use RFC 9728 discovery; 100% of remote-auth configs hardcode a static credential** — see the dated [2026-07-28 readiness report](docs/reports/mcp-2026-07-28-readiness.md). The July 2026-07-28 deprecation/stateless pack stays labelled **release candidate** (the spec ratifies 2026-07-28); every cited SEP was re-verified in the [ratification reconciliation](CHANGELOG.cves.md)
 - **Zero cloud dependencies** — runs fully offline, zero network calls in the default scan path
 ### Why This Exists
@@ -100,7 +101,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.49
+      - uses: sattyamjjain/agent-audit-kit@v0.3.52
         with:
           fail-on: high
 ```
@@ -120,7 +121,7 @@ agent-audit-kit scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.49
+    rev: v0.3.52
     hooks:
       - id: agent-audit-kit
 ```
@@ -144,8 +145,8 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
-| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->59<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1), MCP tool-argument URL SSRF (an MCP tool handler passing a caller-supplied `url`/`endpoint`/`target` argument straight into an outbound `requests`/`httpx`/`urllib`/`aiohttp` fetch with no host/scheme allow-list — `ast` parameter→fetch taint for Python, regex fallback for TS/JS/Rust — `AAK-MCP-SSRF-001`, **CWE-918 / CVE-2026-14748**, AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary`), Serena MCP toolkit unauthenticated-dashboard RCE (`serena-agent` < 1.5.2 — an unauthenticated Flask dashboard on a fixed port reachable via DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to remote code execution — `AAK-MCP-SERENA-CVE-2026-49471-001`, **CWE-306 + CWE-352 / CVE-2026-49471**, HIGH 8.3), MCP 2026-07-28 deprecated features (the `roots` / `sampling` / `logging` capabilities annotation-deprecated under the RC's new 12-month deprecation policy — flagged across config + server source so authors migrate before removal — `AAK-MCP-DEPRECATED-001..003`, **SEP-2577 / SEP-2596**), OAuth `iss`-validation gap (an authorization-code client that handles the auth response but never validates the RFC 9207 `iss` parameter, the RC's actual new OAuth requirement — `AAK-OAUTH-006`, **RFC 9207 / SEP-2468**) |
-| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->50<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
+| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->61<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1), MCP tool-argument URL SSRF (an MCP tool handler passing a caller-supplied `url`/`endpoint`/`target` argument straight into an outbound `requests`/`httpx`/`urllib`/`aiohttp` fetch with no host/scheme allow-list — `ast` parameter→fetch taint for Python, regex fallback for TS/JS/Rust — `AAK-MCP-SSRF-001`, **CWE-918 / CVE-2026-14748**, AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary`), Serena MCP toolkit unauthenticated-dashboard RCE (`serena-agent` < 1.5.2 — an unauthenticated Flask dashboard on a fixed port reachable via DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to remote code execution — `AAK-MCP-SERENA-CVE-2026-49471-001`, **CWE-306 + CWE-352 / CVE-2026-49471**, HIGH 8.3), MCP 2026-07-28 deprecated features (the `roots` / `sampling` / `logging` capabilities annotation-deprecated under the RC's new 12-month deprecation policy — flagged across config + server source so authors migrate before removal — `AAK-MCP-DEPRECATED-001..003`, **SEP-2577 / SEP-2596**), OAuth `iss`-validation gap (an authorization-code client that handles the auth response but never validates the RFC 9207 `iss` parameter, the RC's actual new OAuth requirement — `AAK-OAUTH-006`, **RFC 9207 / SEP-2468**), RFC 8707 Resource-Indicator absence (an OAuth 2.1 flow / MCP client config that never sets the `resource` parameter, so issued tokens aren't audience-bound and a token minted for one MCP server can be replayed at another — the confused-deputy / audience-confusion class; mandatory in the **ratified** MCP 2025-11-25 auth spec, independent of the 2026-07-28 RC — `AAK-OAUTH-007`, **RFC 8707 / RFC 9728 §7.4**), RFC 9728 Protected-Resource-Metadata discovery gap (a remote MCP server config that embeds a static `Authorization`/`Bearer`/`auth` credential with no `/.well-known/oauth-protected-resource` discovery path, or server source enforcing bearer auth without serving PRM — the resource-discovery arm of the 2026-07-28 auth profile — `AAK-OAUTH-008`, **RFC 9728**) |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->64<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
 | **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->27<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->15<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
@@ -157,7 +158,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->12<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
 | **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
-**<!-- rule-count:total -->246<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->262<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
 ### MCP Server Card scanning (SEP-1649)
@@ -353,13 +354,13 @@ cross-reference, not a head-to-head benchmark.
 | --- | --- | --- |
 | **ASI01** | Goal Hijack | 13 |
 | **ASI02** | Tool Misuse | 39 |
-| **ASI03** | Memory Poisoning | 57 |
-| **ASI04** | Identity & Privilege Abuse | 43 |
+| **ASI03** | Memory Poisoning | 62 |
+| **ASI04** | Identity & Privilege Abuse | 50 |
 | **ASI05** | Cascading Failures | 33 |
-| **ASI06** | Unauthorized Capability Acquisition | 33 |
+| **ASI06** | Unauthorized Capability Acquisition | 35 |
 | **ASI07** | Plan Injection | 9 |
 | **ASI08** | Agent Communication Poisoning | 4 |
-| **ASI09** | Resource Abuse | 15 |
+| **ASI09** | Resource Abuse | 17 |
 | **ASI10** | Supply-Chain | 20 |
 <!-- owasp-coverage:end -->
@@ -398,7 +399,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->246<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->262<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |
@@ -447,41 +448,33 @@ Public leaderboard of MCP servers we scan weekly:
 - **90-day coordinated disclosure** before anything lands on a public card — see [`docs/disclosure-policy.md`](docs/disclosure-policy.md)
 - Maintainer-fix earlier gets published the day the fix lands, with credit
-## State of MCP Security 2026
-A reproducible data report: we scanned **664 distinct public MCP server configs**
-and found **1 in 4 ships a critical-severity flaw** — the **median config scores
-a B, the top 10% an A**, and **24.2% declare a remote server with no auth**. It
-exists because of AAK's two defensible wedges — the scan is **offline and
-deterministic** (no code or configs leave the machine; same input, same result),
-and it yields **auditor-ready compliance evidence**, which is what makes a report
-reproducible and an audit defensible. Full distribution, score calibration,
-OWASP-MCP-Top-10 hit rate, top-10 findings, external anchors (MCP Registry 9,652
-servers; Knostic 1,862 exposed / 119-of-119 unauthenticated; the 2,614-server
-82%-path-traversal survey), and honest limitations are in
-**[`research/state-of-mcp-2026/PREVALENCE.md`](research/state-of-mcp-2026/PREVALENCE.md)**
-(raw aggregate: [`results.json`](research/state-of-mcp-2026/results.json)).
-Mapped to the OWASP MCP Top 10, **99.4% of configs trip MCP07 (authorization /
-excessive permissions)** — see which AAK rules cover each slot in the
-[public coverage leaderboard](docs/coverage/owasp-mcp-top10.md). Scan your own in
-30s, fully offline:
-```bash
-pip install agent-audit-kit && agent-audit-kit scan .
-```
+## Research: State of MCP Server Authentication 2026
+A reproducible data report over **1,374 distinct public MCP server configs** — 664
+GitHub-crawled plus **710 official MCP Registry latest-version servers**, deduped by
+content and scanned offline and deterministically (scan date 2026-07-19). Headline:
+**35.1% (482/1,374) declare a remote server with no authentication, 0% (0/1,374) use
+RFC 9728 Protected-Resource-Metadata discovery, and 100% (318/318) of inline-auth
+configs hardcode a static credential.** 36.0% carry a critical-severity finding; the
+median config scores a **B**, and **99.7% trip OWASP MCP07 (authorization)**. Full
+method, per-metric findings (each with n + denominator), the 2026-07-28 / 2027-07-28
+migration exposure with explicit coverage notes, disclosure posture, and limitations:
+**[`research/state-of-mcp-2026/REPORT.md`](research/state-of-mcp-2026/REPORT.md)** —
+raw aggregate [`results.json`](research/state-of-mcp-2026/results.json), corpus
+provenance [`registry-manifest.json`](research/state-of-mcp-2026/corpus/registry-manifest.json).
 The harness contains no scanner — it reuses `agent_audit_kit.engine.run_scan` +
-`scoring.compute_score`. Regenerate the report:
+`scoring.compute_score`, so every number is reproducible offline and cannot drift
+from the code (`make report` regenerates `results.json` from the committed
+manifest; the corpus refresh is the one network step, `fetch_registry.py`):
 ```bash
-export GITHUB_TOKEN=$(gh auth token)
-python benchmarks/crawler.py --limit 500 --output benchmarks/results.json
-python research/state-of-mcp-2026/run_report.py --corpus benchmarks/data \
-    --out research/state-of-mcp-2026/results.json
+make report   # regenerate the report numbers, offline + deterministic
 ```
-Launch-ready copy for the report is in [`docs/DISTRIBUTION-CHECKLIST.md`](docs/DISTRIBUTION-CHECKLIST.md).
+Scan your own in 30s, fully offline: `pip install agent-audit-kit && agent-audit-kit scan .`
+See which AAK rules cover each OWASP MCP slot in the
+[public coverage leaderboard](docs/coverage/owasp-mcp-top10.md).
 ## CVE Response

agent-audit-kit 0.3.49__tar.gz → 0.3.52__tar.gz

agent-audit-kit 0.3.49tar.gz → 0.3.52tar.gz