agent-audit-kit 0.3.52__tar.gz → 0.3.56__tar.gz

{agent_audit_kit-0.3.52 → agent_audit_kit-0.3.56}/CHANGELOG.cves.md

@@ -16,6 +16,19 @@ open.
 > issue. The per-CVE latency figures in the tables are **measurements recorded at
 > the time**, kept as dated facts, not a standing promise.
 
+## 2026-07-21 (v0.3.56)
+
+Five `cve-response` issues triaged for the v0.3.56 cut — two pinned, three
+dispositioned with rationale.
+
+| CVE | Reference | AAK rule / disposition | Triaged |
+|---|---|---|---|
+| CVE-2026-46555 (whatsapp-mcp < 0.2.1 — `whatsapp-bridge` unauthenticated loopback HTTP API + no Host validation + absolute `media_path` → arbitrary file exfil as WhatsApp attachments, DNS-rebinding; CVSS 7.7) | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-46555) | **Pinned** `AAK-MCP-WHATSAPP-CVE-2026-46555-001` (fix floor 0.2.1; fires on manifest/lockfile references below 0.2.1) | 2026-07-21 |
+| CVE-2026-57495 (AgenticMail bridge-wake indirect prompt injection — external mail resumes the operator's Claude Code session with `permissionMode: bypassPermissions`, embedding attacker-controlled `from`/`subject`/`preview` into a fully-privileged agent) | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-57495) | **Pinned** `AAK-MCP-AGENTICMAIL-CVE-2026-57495-001` — one rule, per-package fix floors: `@agenticmail/claudecode` ≥ 0.2.39, `@agenticmail/codex` ≥ 0.1.33, `@agenticmail/core` ≥ 0.9.43, `@agenticmail/openclaw` ≥ 0.5.71 | 2026-07-21 |
+| CVE-2026-53378 (Linux kernel `drm/colorop` blob-property reference leak) | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-53378) | **Out of scope** — a Linux-kernel DRM reference-counting memory leak, not an MCP/agent artifact. Surfaced only because the NVD keyword feed matched; there is no AAK config/dependency surface. No rule. | 2026-07-21 |
+| CVE-2026-55544 (NextCRM 0.12.1 — MCP campaign tools ignore the authenticated user ID → BOLA/IDOR across campaigns; fixed 0.12.2; CVSS 7.6) | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-55544) | **Not pinnable** — server-side broken-object-level-authorization in a self-hosted Next.js app (`nextcrm-app`), which is not an npm/PyPI dependency a scanned project pins, and the flaw has no client `.mcp.json` or dependency-manifest signal. Outside AAK's detection surface; no rule. | 2026-07-21 |
+| CVE-2026-55550 (NextCRM 0.12.1 — MCP product tools skip role checks → any low-priv user mutates the shared catalog; fixed 0.12.3; CVSS 7.1) | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-55550) | **Not pinnable** — same class and app as CVE-2026-55544 (self-hosted server-side authorization logic). Outside AAK's detection surface; no rule. | 2026-07-21 |
+
 ## Dispositioned 2026-07-19 (v0.3.52)
 
 | Incident / Anchor | Reference | AAK rule(s) / disposition | Dispositioned |

{agent_audit_kit-0.3.52 → agent_audit_kit-0.3.56}/CHANGELOG.md

@@ -7,6 +7,127 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added — 2026-07-19..20 CVE-response pins (262 → 264 rules)
+
+- `AAK-MCP-WHATSAPP-CVE-2026-46555-001` — whatsapp-mcp < 0.2.1 (unauthenticated
+  loopback `whatsapp-bridge` + `media_path` traversal → arbitrary file exfil /
+  DNS-rebinding; CVSS 7.7). Fix floor 0.2.1.
+- `AAK-MCP-AGENTICMAIL-CVE-2026-57495-001` — AgenticMail bridge-wake indirect
+  prompt injection into a `bypassPermissions` agent; one rule, per-package fix
+  floors (`@agenticmail/claudecode` ≥ 0.2.39, `/codex` ≥ 0.1.33, `/core` ≥
+  0.9.43, `/openclaw` ≥ 0.5.71).
+- Triaged three more `cve-response` issues without a new rule (dispositioned in
+  `CHANGELOG.cves.md`): CVE-2026-53378 (Linux-kernel DRM leak — out of scope) and
+  CVE-2026-55544 / CVE-2026-55550 (NextCRM server-side MCP-tool authorization in a
+  self-hosted app — no pinnable dependency or client-config surface). Clearing the
+  `cve-response` backlog unblocks the release gate for the v0.3.56 tag.
+
+### Added — frozen, citable MCP security baseline v1.0 (`research/state-of-mcp-2026/baseline.py`)
+
+- A `baseline` command that emits an **immutable, byte-deterministic** research
+  snapshot, `mcp-security-baseline-v1.0-2026-07-27`, recording — per config and in
+  aggregate — corpus size + collection window, the auth-posture distribution
+  (no-auth / bearer / OAuth 2.1 / unknown), transport distribution (stdio / SSE /
+  streamable-HTTP), per-rule HIGH/CRITICAL hit counts, and the benign-slice
+  HIGH/CRITICAL false-positive rate with its denominator (4/368; 2/4 adjudicated).
+  Adds **no** detection rules — reuses `engine.run_scan`, `scoring.compute_score`,
+  and the `oauth_misconfig` signals. Offline, no network, no account.
+- **Determinism + tamper-evidence:** sorted keys, stable float rounding, and no
+  wall-clock in the payload (the collection window is data from the corpus
+  manifest). Two runs over the same corpus produce identical bytes; the snapshot
+  is fixed under **SHA-256
+  `320b43072d930edbc18f050795939dbee3831e4da2f88b3483ea12ec7bb6551f`**, cited in
+  the report doc and guarded by `tests/test_mcp_security_baseline.py`.
+- **`--compare BASELINE_FILE`** re-scans the corpus and prints a per-dimension
+  delta table (absolute + percentage-point) against v1.0, so the post-2026-07-28
+  re-measure (scheduled **2026-08-11**) is one command.
+- Docs: `docs/research/mcp-security-baseline-v1.0.md` (what was measured, the exact
+  collection window, methodology, the FP-rate caveat, the reproducibility caveat,
+  and the explicit pre-spec statement), linked from the README research section.
+  This is the **pre-2026-07-28-spec** baseline; **no** post-spec comparison is
+  claimed until the spec ships.
+
+Version 0.3.55 → 0.3.56.
+
+### Fixed — P0/P1 integration bugs (SARIF upload, lockfile-aware pins)
+
+- **P0 — invalid SARIF `fixes[]` broke `codeql-action/upload-sarif`.** Every
+  result emitted a `fixes` object with only `description` and no
+  `artifactChanges` (required for a machine-applicable patch), so GitHub rejected
+  the whole file. Removed it — the remediation is already in the rule-level
+  `help`/`helpMarkdown`; the per-finding copy now goes in a valid `properties`
+  bag. The SARIF regression test now enforces the `fixes`-require-`artifactChanges`
+  invariant, so this can't recur silently.
+- **P0/P1 — the Docker action's SARIF upload was a silent no-op.** `upload-sarif`
+  was defined but never used; the action only emits the SARIF (`sarif-file`
+  output). It now prints a loud notice and the README/Quick Start document the
+  canonical `github/codeql-action/upload-sarif` step (with `security-events:
+  write`) instead of implying the action uploads.
+- **P1 — version-pin CVE rules were false-positive-after-fix on lockfiles.**
+  `mcp_cve_pins_2026_07` and `supply_chain`'s Serena pin fired on a lockfile
+  reference without parsing the resolved version, so a correct upgrade couldn't
+  clear the finding (forcing users to suppress the CVE rule). Added a shared
+  lockfile resolver (uv.lock, poetry.lock, Pipfile.lock, package-lock.json,
+  pnpm-lock.yaml, yarn.lock) — pins now fire only when the resolved version is
+  below the fix floor.
+
+### Fixed — P2 rule-scoping precision (drives the benign-slice FP rate)
+
+Seven critical/high rules were firing on safe or benign patterns. Each fix
+narrows the scope so the rule still fires on the real shape but clears the
+false positive; each ships a benign-passes regression guard and a
+malicious-still-fires guard.
+
+- **AAK-STDIO-001** — an argv-list `subprocess.run(["cmd", tainted], shell=False)`
+  is the *safe* form (a tainted element is an argument, not a shell-injection
+  vector). It no longer fires on argv lists; only `shell=True` or a
+  string/dynamic command does.
+- **AAK-MCP-STDIO-CMD-INJ-001** — fired on *any* `StdioServerParameters(...)`
+  inside a function that merely had a generically-named arg (`config`, `data`).
+  Now requires an actual source→sink taint path: a network-controlled value
+  (request/env/json, a suspicious param, or a var assigned from one) must flow
+  into `command`/`args`. Constant command/args never fire.
+- **AAK-AGENT-001** — the catch-all `` `...` `` arm flagged *every* inline-code
+  span in an agent-instruction file (`` `cargo build` ``, `` `make` ``,
+  `` `npx tsc` `` — dozens of hits per CLAUDE.md). Removed it; genuinely
+  dangerous directives (`sh -c`, `rm -rf`, `curl … | bash`) still match.
+- **AAK-HOOK-RCE-001** — scanned any `hooks/` directory, catching **React
+  hooks** (`src/hooks/use-audit.ts`) whose `` `${event}` `` template literals
+  collided with the "hook" keyword. Now scoped to `.claude/` hook scripts, and
+  a py/js/ts script's interpolation must reach a shell-exec sink.
+- **AAK-TASKS-002 / -003** — fired on any module mentioning a bare `task_id`
+  (every Celery/job-queue worker). Now gated on a concrete MCP Tasks primitive
+  (a task class/store/manager, SEP-1686, or a `tasks/*` method).
+- **AAK-HEALTHCARE-AI-004 / -005** — fired on any markdown using clinical or
+  incident words: an ops runbook ("in an emergency, page on-call") tripped the
+  crisis rule; a clinical dataset README tripped the disclosure rule. Both now
+  require a conversational-agent surface, and 005's trigger is restricted to
+  unambiguous self-harm terms (dropping bare "crisis"/"emergency").
+- **AAK-INDIA-PII-001** — a bare 12-digit number that coincidentally passes the
+  Verhoeff checksum (~1 in 10) fired as an Aadhaar. The unformatted form now
+  needs an Aadhaar/UID cue nearby; the grouped `XXXX XXXX XXXX` form still fires
+  on its own.
+
+No rule changes (still 262). Version 0.3.53 → 0.3.55.
+
+### Added — benign-slice false-positive benchmark (`benchmarks/false_positive/`)
+
+- A reproducible, offline, deterministic harness that measures and publishes
+  AAK's **benign-slice HIGH/CRITICAL false-positive rate** — nobody in this
+  category publishes one. Reuses `engine.run_scan` + `rules.builtin.RULES` (no
+  scanner/scorer reimplemented) over a **pre-registered 368-config benign slice**
+  of the MCP Registry (predicate: official + active + declares an auth mode + not
+  in a shipped CVE feed; non-circular — "benign" is registry metadata, not "AAK
+  found nothing"). `stats.py` adds a stdlib Wilson interval (no new runtime dep).
+- **Measured figure (2026-07-20 run):** 4 HIGH/CRITICAL findings across the 368
+  configs (1.1%); hand-adjudicated (single rater) to **2 FP / 1 TP / 1 ambiguous
+  → 2/4 = 50% benign-slice HIGH/CRITICAL FP rate, Wilson 95% CI [15%, 85%]**
+  (small n, wide interval — stated, not smoothed). Both FPs share one root cause:
+  `AAK-MCP-001` doesn't recognise custom API-key headers (`X-*-Key`) as auth —
+  filed as #475. Published bad-and-all; that is the credibility value.
+- README claim 1 (determinism) extended with the measured-precision line. No rule
+  changes (still 262).
+
 ## [0.3.52] - 2026-07-19
 
 ### Added — State of MCP 2026 report: corpus expanded to 1,374 configs (closes #23)

{agent_audit_kit-0.3.52 → agent_audit_kit-0.3.56}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-audit-kit
-Version: 0.3.52
+Version: 0.3.56
 Summary: Security scanner for MCP-connected AI agent pipelines
 Project-URL: Homepage, https://github.com/sattyamjjain/agent-audit-kit
 Project-URL: Repository, https://github.com/sattyamjjain/agent-audit-kit
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
   <a href="https://pypi.org/project/agent-audit-kit/"><img src="https://img.shields.io/pypi/v/agent-audit-kit.svg" alt="PyPI"></a>
   <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.9+-blue.svg" alt="Python 3.9+"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-262-blue.svg" alt="Rules: 262"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-264-blue.svg" alt="Rules: 264"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -58,10 +58,10 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 
 **Two things it does that hosted scanners can't:**
 
-1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry.
+1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry. Precision is measured the same way, not asserted: we publish a reproducible, hand-adjudicated [benign-slice HIGH/CRITICAL false-positive rate](benchmarks/false_positive/RESULTS.md) — with a Wilson confidence interval and any offending rule filed as an issue.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 13 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
 
-- **<!-- rule-count:total -->262<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->264<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
 - **<!-- scanner-count:total -->84<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
 - **16 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `watch`, plus `export-rules`, `verify-bundle`, `sbom`, `report`, `install-precommit`, and the Security-Advisories scan flag
@@ -101,12 +101,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.52
+      - uses: sattyamjjain/agent-audit-kit@v0.3.56
+        id: scan
         with:
           fail-on: high
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()   # upload even if the scan failed the build
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif-file }}
 ```
 
-Findings appear as **inline PR annotations** in the GitHub Security tab via SARIF.
+The scan step emits SARIF; the `upload-sarif` step publishes it, so findings
+appear as **inline PR annotations** and in the **Security tab**. See
+[SARIF Integration](#sarif-integration).
 
 ### CLI
 
@@ -121,7 +128,7 @@ agent-audit-kit scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.52
+    rev: v0.3.56
     hooks:
       - id: agent-audit-kit
 ```
@@ -146,7 +153,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
 | **MCP Configuration** | <!-- category-count:MCP_CONFIG -->61<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1), MCP tool-argument URL SSRF (an MCP tool handler passing a caller-supplied `url`/`endpoint`/`target` argument straight into an outbound `requests`/`httpx`/`urllib`/`aiohttp` fetch with no host/scheme allow-list — `ast` parameter→fetch taint for Python, regex fallback for TS/JS/Rust — `AAK-MCP-SSRF-001`, **CWE-918 / CVE-2026-14748**, AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary`), Serena MCP toolkit unauthenticated-dashboard RCE (`serena-agent` < 1.5.2 — an unauthenticated Flask dashboard on a fixed port reachable via DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to remote code execution — `AAK-MCP-SERENA-CVE-2026-49471-001`, **CWE-306 + CWE-352 / CVE-2026-49471**, HIGH 8.3), MCP 2026-07-28 deprecated features (the `roots` / `sampling` / `logging` capabilities annotation-deprecated under the RC's new 12-month deprecation policy — flagged across config + server source so authors migrate before removal — `AAK-MCP-DEPRECATED-001..003`, **SEP-2577 / SEP-2596**), OAuth `iss`-validation gap (an authorization-code client that handles the auth response but never validates the RFC 9207 `iss` parameter, the RC's actual new OAuth requirement — `AAK-OAUTH-006`, **RFC 9207 / SEP-2468**), RFC 8707 Resource-Indicator absence (an OAuth 2.1 flow / MCP client config that never sets the `resource` parameter, so issued tokens aren't audience-bound and a token minted for one MCP server can be replayed at another — the confused-deputy / audience-confusion class; mandatory in the **ratified** MCP 2025-11-25 auth spec, independent of the 2026-07-28 RC — `AAK-OAUTH-007`, **RFC 8707 / RFC 9728 §7.4**), RFC 9728 Protected-Resource-Metadata discovery gap (a remote MCP server config that embeds a static `Authorization`/`Bearer`/`auth` credential with no `/.well-known/oauth-protected-resource` discovery path, or server source enforcing bearer auth without serving PRM — the resource-discovery arm of the 2026-07-28 auth profile — `AAK-OAUTH-008`, **RFC 9728**) |
-| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->64<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->66<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
 | **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->27<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->15<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
@@ -158,7 +165,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->12<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
 | **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
 
-**<!-- rule-count:total -->262<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->264<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
 
 ### MCP Server Card scanning (SEP-1649)
 
@@ -295,12 +302,34 @@ CLI flags always take precedence over config file values.
 
 ## SARIF Integration
 
-With `upload-sarif: true` (default), findings appear:
-- As **inline annotations** on PR diffs showing exactly which line has the issue
-- In the **Security tab** under Code Scanning with full remediation guidance
-- With **OWASP references** and **CVE links** for each finding
+This action **emits** SARIF (the `sarif-file` output); it does **not** upload to
+Code Scanning itself. Add the canonical `github/codeql-action/upload-sarif` step
+so findings appear in the **Security tab** and as **inline PR annotations**:
+
+```yaml
+permissions:
+  security-events: write   # required for the upload
+  contents: read
+
+steps:
+  - uses: actions/checkout@v4
+  - uses: sattyamjjain/agent-audit-kit@v0.3.56
+    id: scan
+    with:
+      fail-on: high
+  - uses: github/codeql-action/upload-sarif@v3
+    if: always()           # upload even when the scan step failed the build
+    with:
+      sarif_file: ${{ steps.scan.outputs.sarif-file }}
+```
 
-SARIF output conforms to [SARIF 2.1.0](https://json.schemastore.org/sarif-2.1.0.json) with `fingerprints`, `partialFingerprints`, `fixes[]`, `security-severity` scores, and `%SRCROOT%` relative paths.
+SARIF output conforms to [SARIF 2.1.0](https://json.schemastore.org/sarif-2.1.0.json)
+with `fingerprints`, `partialFingerprints`, `security-severity` scores, and
+`%SRCROOT%` relative paths. Each finding carries **OWASP references** and **CVE
+links** via the rule-level `help`; per-finding remediation is in result
+`properties`. (No SARIF `fixes[]` — those require machine-applicable
+`artifactChanges`, so emitting prose there would make Code Scanning reject the
+upload.)
 
 ---
 
@@ -354,8 +383,8 @@ cross-reference, not a head-to-head benchmark.
 | --- | --- | --- |
 | **ASI01** | Goal Hijack | 13 |
 | **ASI02** | Tool Misuse | 39 |
-| **ASI03** | Memory Poisoning | 62 |
-| **ASI04** | Identity & Privilege Abuse | 50 |
+| **ASI03** | Memory Poisoning | 63 |
+| **ASI04** | Identity & Privilege Abuse | 51 |
 | **ASI05** | Cascading Failures | 33 |
 | **ASI06** | Unauthorized Capability Acquisition | 35 |
 | **ASI07** | Plan Injection | 9 |
@@ -399,7 +428,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->262<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->264<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |
@@ -472,6 +501,25 @@ manifest; the corpus refresh is the one network step, `fetch_registry.py`):
 make report   # regenerate the report numbers, offline + deterministic
 ```
 
+### Frozen baseline (pre-2026-07-28-spec)
+
+The same measurement, **frozen and citable** as
+**[`docs/research/mcp-security-baseline-v1.0.md`](docs/research/mcp-security-baseline-v1.0.md)**:
+an immutable, byte-deterministic snapshot
+([`mcp-security-baseline-v1.0-2026-07-27.json`](research/state-of-mcp-2026/baseline/mcp-security-baseline-v1.0-2026-07-27.json))
+recording, per config and in aggregate, the corpus size + collection window, the
+auth-posture distribution (no-auth / bearer / OAuth 2.1 / unknown), the transport
+distribution, the per-rule HIGH/CRITICAL hit counts, and the benign-slice
+false-positive rate with its denominator — tamper-evident under
+**SHA-256 `320b43072d930edbc18f050795939dbee3831e4da2f88b3483ea12ec7bb6551f`**. It
+is the **pre-2026-07-28-spec** reference; the re-measure is scheduled for
+**2026-08-11** and is one command:
+
+```bash
+python research/state-of-mcp-2026/baseline.py \
+    --compare research/state-of-mcp-2026/baseline/mcp-security-baseline-v1.0-2026-07-27.json
+```
+
 Scan your own in 30s, fully offline: `pip install agent-audit-kit && agent-audit-kit scan .`
 See which AAK rules cover each OWASP MCP slot in the
 [public coverage leaderboard](docs/coverage/owasp-mcp-top10.md).

{agent_audit_kit-0.3.52 → agent_audit_kit-0.3.56}/README.md

@@ -8,7 +8,7 @@
   <a href="https://pypi.org/project/agent-audit-kit/"><img src="https://img.shields.io/pypi/v/agent-audit-kit.svg" alt="PyPI"></a>
   <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.9+-blue.svg" alt="Python 3.9+"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-262-blue.svg" alt="Rules: 262"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-264-blue.svg" alt="Rules: 264"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -24,10 +24,10 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 
 **Two things it does that hosted scanners can't:**
 
-1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry.
+1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry. Precision is measured the same way, not asserted: we publish a reproducible, hand-adjudicated [benign-slice HIGH/CRITICAL false-positive rate](benchmarks/false_positive/RESULTS.md) — with a Wilson confidence interval and any offending rule filed as an issue.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 13 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
 
-- **<!-- rule-count:total -->262<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->264<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
 - **<!-- scanner-count:total -->84<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
 - **16 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `watch`, plus `export-rules`, `verify-bundle`, `sbom`, `report`, `install-precommit`, and the Security-Advisories scan flag
@@ -67,12 +67,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.52
+      - uses: sattyamjjain/agent-audit-kit@v0.3.56
+        id: scan
         with:
           fail-on: high
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()   # upload even if the scan failed the build
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif-file }}
 ```
 
-Findings appear as **inline PR annotations** in the GitHub Security tab via SARIF.
+The scan step emits SARIF; the `upload-sarif` step publishes it, so findings
+appear as **inline PR annotations** and in the **Security tab**. See
+[SARIF Integration](#sarif-integration).
 
 ### CLI
 
@@ -87,7 +94,7 @@ agent-audit-kit scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.52
+    rev: v0.3.56
     hooks:
       - id: agent-audit-kit
 ```
@@ -112,7 +119,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
 | **MCP Configuration** | <!-- category-count:MCP_CONFIG -->61<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1), MCP tool-argument URL SSRF (an MCP tool handler passing a caller-supplied `url`/`endpoint`/`target` argument straight into an outbound `requests`/`httpx`/`urllib`/`aiohttp` fetch with no host/scheme allow-list — `ast` parameter→fetch taint for Python, regex fallback for TS/JS/Rust — `AAK-MCP-SSRF-001`, **CWE-918 / CVE-2026-14748**, AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary`), Serena MCP toolkit unauthenticated-dashboard RCE (`serena-agent` < 1.5.2 — an unauthenticated Flask dashboard on a fixed port reachable via DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to remote code execution — `AAK-MCP-SERENA-CVE-2026-49471-001`, **CWE-306 + CWE-352 / CVE-2026-49471**, HIGH 8.3), MCP 2026-07-28 deprecated features (the `roots` / `sampling` / `logging` capabilities annotation-deprecated under the RC's new 12-month deprecation policy — flagged across config + server source so authors migrate before removal — `AAK-MCP-DEPRECATED-001..003`, **SEP-2577 / SEP-2596**), OAuth `iss`-validation gap (an authorization-code client that handles the auth response but never validates the RFC 9207 `iss` parameter, the RC's actual new OAuth requirement — `AAK-OAUTH-006`, **RFC 9207 / SEP-2468**), RFC 8707 Resource-Indicator absence (an OAuth 2.1 flow / MCP client config that never sets the `resource` parameter, so issued tokens aren't audience-bound and a token minted for one MCP server can be replayed at another — the confused-deputy / audience-confusion class; mandatory in the **ratified** MCP 2025-11-25 auth spec, independent of the 2026-07-28 RC — `AAK-OAUTH-007`, **RFC 8707 / RFC 9728 §7.4**), RFC 9728 Protected-Resource-Metadata discovery gap (a remote MCP server config that embeds a static `Authorization`/`Bearer`/`auth` credential with no `/.well-known/oauth-protected-resource` discovery path, or server source enforcing bearer auth without serving PRM — the resource-discovery arm of the 2026-07-28 auth profile — `AAK-OAUTH-008`, **RFC 9728**) |
-| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->64<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->66<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
 | **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->27<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->15<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
@@ -124,7 +131,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->12<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
 | **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
 
-**<!-- rule-count:total -->262<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->264<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
 
 ### MCP Server Card scanning (SEP-1649)
 
@@ -261,12 +268,34 @@ CLI flags always take precedence over config file values.
 
 ## SARIF Integration
 
-With `upload-sarif: true` (default), findings appear:
-- As **inline annotations** on PR diffs showing exactly which line has the issue
-- In the **Security tab** under Code Scanning with full remediation guidance
-- With **OWASP references** and **CVE links** for each finding
+This action **emits** SARIF (the `sarif-file` output); it does **not** upload to
+Code Scanning itself. Add the canonical `github/codeql-action/upload-sarif` step
+so findings appear in the **Security tab** and as **inline PR annotations**:
+
+```yaml
+permissions:
+  security-events: write   # required for the upload
+  contents: read
+
+steps:
+  - uses: actions/checkout@v4
+  - uses: sattyamjjain/agent-audit-kit@v0.3.56
+    id: scan
+    with:
+      fail-on: high
+  - uses: github/codeql-action/upload-sarif@v3
+    if: always()           # upload even when the scan step failed the build
+    with:
+      sarif_file: ${{ steps.scan.outputs.sarif-file }}
+```
 
-SARIF output conforms to [SARIF 2.1.0](https://json.schemastore.org/sarif-2.1.0.json) with `fingerprints`, `partialFingerprints`, `fixes[]`, `security-severity` scores, and `%SRCROOT%` relative paths.
+SARIF output conforms to [SARIF 2.1.0](https://json.schemastore.org/sarif-2.1.0.json)
+with `fingerprints`, `partialFingerprints`, `security-severity` scores, and
+`%SRCROOT%` relative paths. Each finding carries **OWASP references** and **CVE
+links** via the rule-level `help`; per-finding remediation is in result
+`properties`. (No SARIF `fixes[]` — those require machine-applicable
+`artifactChanges`, so emitting prose there would make Code Scanning reject the
+upload.)
 
 ---
 
@@ -320,8 +349,8 @@ cross-reference, not a head-to-head benchmark.
 | --- | --- | --- |
 | **ASI01** | Goal Hijack | 13 |
 | **ASI02** | Tool Misuse | 39 |
-| **ASI03** | Memory Poisoning | 62 |
-| **ASI04** | Identity & Privilege Abuse | 50 |
+| **ASI03** | Memory Poisoning | 63 |
+| **ASI04** | Identity & Privilege Abuse | 51 |
 | **ASI05** | Cascading Failures | 33 |
 | **ASI06** | Unauthorized Capability Acquisition | 35 |
 | **ASI07** | Plan Injection | 9 |
@@ -365,7 +394,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->262<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->264<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |
@@ -438,6 +467,25 @@ manifest; the corpus refresh is the one network step, `fetch_registry.py`):
 make report   # regenerate the report numbers, offline + deterministic
 ```
 
+### Frozen baseline (pre-2026-07-28-spec)
+
+The same measurement, **frozen and citable** as
+**[`docs/research/mcp-security-baseline-v1.0.md`](docs/research/mcp-security-baseline-v1.0.md)**:
+an immutable, byte-deterministic snapshot
+([`mcp-security-baseline-v1.0-2026-07-27.json`](research/state-of-mcp-2026/baseline/mcp-security-baseline-v1.0-2026-07-27.json))
+recording, per config and in aggregate, the corpus size + collection window, the
+auth-posture distribution (no-auth / bearer / OAuth 2.1 / unknown), the transport
+distribution, the per-rule HIGH/CRITICAL hit counts, and the benign-slice
+false-positive rate with its denominator — tamper-evident under
+**SHA-256 `320b43072d930edbc18f050795939dbee3831e4da2f88b3483ea12ec7bb6551f`**. It
+is the **pre-2026-07-28-spec** reference; the re-measure is scheduled for
+**2026-08-11** and is one command:
+
+```bash
+python research/state-of-mcp-2026/baseline.py \
+    --compare research/state-of-mcp-2026/baseline/mcp-security-baseline-v1.0-2026-07-27.json
+```
+
 Scan your own in 30s, fully offline: `pip install agent-audit-kit && agent-audit-kit scan .`
 See which AAK rules cover each OWASP MCP slot in the
 [public coverage leaderboard](docs/coverage/owasp-mcp-top10.md).

{agent_audit_kit-0.3.52 → agent_audit_kit-0.3.56}/action.yml

@@ -1,5 +1,5 @@
 name: 'AgentAuditKit MCP Security Scan'
-description: 'AgentAuditKit — MCP Security Scan (262 rules, OWASP Agentic Top 10 + MCP Top 10)'
+description: 'AgentAuditKit — MCP Security Scan (264 rules, OWASP Agentic Top 10 + MCP Top 10)'
 author: 'sattyamjjain'
 
 branding:
@@ -24,7 +24,7 @@ inputs:
     required: false
     default: 'sarif'
   upload-sarif:
-    description: 'Upload SARIF results to GitHub Code Scanning'
+    description: 'Emit SARIF for GitHub Code Scanning. NOTE: this action does not upload directly — it writes the SARIF (see the `sarif-file` output) and prints a notice; you add a `github/codeql-action/upload-sarif` step with `security-events: write`. See README > SARIF Integration.'
     required: false
     default: 'true'
   include-user-config:

{agent_audit_kit-0.3.52 → agent_audit_kit-0.3.56}/agent_audit_kit/__init__.py

@@ -1,6 +1,6 @@
 """AgentAuditKit — Security scanner for MCP-connected AI agent pipelines."""
 from __future__ import annotations
 
-__version__ = "0.3.52"
-RULE_COUNT = 262
+__version__ = "0.3.56"
+RULE_COUNT = 264
 SCANNER_COUNT = 84

{agent_audit_kit-0.3.52 → agent_audit_kit-0.3.56}/agent_audit_kit/output/sarif.py

@@ -204,8 +204,14 @@ def _finding_to_result(
     if finding.evidence:
         result["message"]["text"] += f"\n\nEvidence: {finding.evidence}"
 
+    # NOTE: do NOT emit a SARIF `fixes` object here. A `fixes[].fix` requires
+    # `artifactChanges` (it describes a machine-applicable patch, not prose);
+    # emitting one with only `description` makes every result invalid and
+    # GitHub's codeql-action/upload-sarif rejects the whole file. The remediation
+    # prose is already surfaced via the rule-level `help`/`helpMarkdown`; the
+    # per-finding copy goes in a valid property bag.
     if finding.remediation:
-        result["fixes"] = [{"description": {"text": finding.remediation}}]
+        result.setdefault("properties", {})["remediation"] = finding.remediation
 
     return result