agent-audit-kit 0.3.76__tar.gz → 0.3.78__tar.gz

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/.github/workflows/codeql.yml

@@ -27,14 +27,14 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: "/language:${{ matrix.language }}"

agent_audit_kit-0.3.78/.github/workflows/link-check.yml

@@ -0,0 +1,70 @@
+name: Link check
+
+# Catch a dead docs domain (the reason docs/CNAME -> docs.agentauditkit.io sat
+# broken for months) at build time instead of after the fact. Runs on doc
+# changes, on push to main, and weekly so a link that dies after merge still
+# fails a build. `mailto:` links are excluded on purpose: security@agentauditkit.io
+# is an aspirational contact whose domain is not registered yet, and we do not
+# want the contact address to block docs builds.
+
+on:
+  pull_request:
+    paths:
+      - '**/*.md'
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - '.github/workflows/link-check.yml'
+  push:
+    branches: [main]
+    paths:
+      - '**/*.md'
+      - 'docs/**'
+      - 'mkdocs.yml'
+  schedule:
+    - cron: '23 6 * * 1'  # Mondays 06:23 UTC
+
+permissions:
+  contents: read
+
+jobs:
+  links:
+    name: Check README + docs links
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - name: Check links with lychee
+        uses: lycheeverse/lychee-action@v2
+        with:
+          args: >-
+            --no-progress
+            --exclude 'mailto:|agentauditkit\.io|globenewswire\.com|asciinema\.org'
+            --exclude-path 'docs/changelog/archive'
+            --max-retries 3
+            --retry-wait-time 5
+            --timeout 30
+            'README.md'
+            'docs/**/*.md'
+          fail: true
+
+      # globenewswire.com is excluded above because lychee fails its HTTP/2
+      # negotiation from the runner ("HTTP/2 protocol error. Server may not
+      # support HTTP/2 properly") while the URL itself is alive — verified 200
+      # over both HTTP/1.1 and HTTP/2 from outside CI. Excluding a live host is
+      # normally the wrong call, so this is the narrow trade: one press-release
+      # citation stays unchecked rather than the whole job staying red and
+      # hiding real breakage. Revisit if lychee gains a per-host HTTP/1.1 flag.
+      #
+      # The deterministic half of this job — relative links to files in this
+      # repo — is also covered by tests/test_docs_links.py, which fails fast and
+      # locally and does not depend on the network at all.
+      #
+      # asciinema.org is excluded for the same reason, after the gentler fix was
+      # tried and did not work: the README's demo embed times out from the runner
+      # while answering 200 in ~0.9s from elsewhere, and raising --timeout from
+      # 20s to 30s did not change it — so it is being throttled or blocked by
+      # IP range, not merely slow. A timeout exits 2 exactly like a dead link, so
+      # leaving it in makes the job permanently red.
+      #
+      # --timeout stays at 30 regardless: it is a reasonable default for the
+      # remaining hosts and costs nothing.

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/.github/workflows/scorecard.yml

@@ -31,6 +31,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: results.sarif

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/CHANGELOG.cves.md

@@ -16,6 +16,24 @@ open.
 > issue. The per-CVE latency figures in the tables are **measurements recorded at
 > the time**, kept as dated facts, not a standing promise.
 
+## 2026-08-15 (v0.3.77)
+
+Five `cve-response` issues from the 2026-08-14 watcher wave. All five in scope and pinned, as three rules — the three CKAN defects share one package and one fix version. Two of the five had a fix version in the NVD text that the vendor advisory contradicts; both are pinned to the advisory.
+
+| CVE | Reference | AAK rule / disposition | Triaged |
+|---|---|---|---|
+| CVE-2026-50027 (mcp-memory-service < 10.67.1 — every HTTP route under `/api/documents/*` is served with no authentication dependency attached, even when the server is configured with an API key (`MCP_API_KEY`) or OAuth, so an unauthenticated remote caller can write arbitrary content into the memory store, read stored documents back, and permanently delete other users' memories; the sibling `/api/memories` routes do enforce auth, which is what makes this an inconsistent boundary rather than an obviously-open server; CRITICAL, CVSS 9.8) | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-50027) | **In scope, pinned** `AAK-MCP-MEMSERVICE-CVE-2026-50027-001` (SUPPLY_CHAIN, CRITICAL): floor `mcp-memory-service >= 10.67.1`. Resolves on PyPI (10.67.1 published; 11.8.0 latest). [GHSA-84hp-mqvj-3p8h](https://github.com/advisories/GHSA-84hp-mqvj-3p8h) confirms `< 10.67.1`. (#589) | 2026-08-15 |
+| CVE-2026-49986 (Cortex / `neuro-cortex-memory` <= 3.17.0 — `_find_dev_source()` treats the `CLAUDE_PROJECT_DIR` environment variable, which Claude Code sets to whatever project is currently open, as a candidate Cortex developer checkout; `_is_cortex_root()` validates it by checking only for an `mcp_server/` subdirectory and a `ui/unified-viz.html` file, so an attacker who ships those two marker paths in a repository gets `mcp_server/server/visualize_bootstrap.py` executed from it via `subprocess.run([sys.executable, ...])` with the victim's privileges, merely because the victim opened the repo; HIGH) | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-49986) | **In scope, pinned** `AAK-MCP-CORTEX-CVE-2026-49986-001` (SUPPLY_CHAIN, HIGH): floor `neuro-cortex-memory >= 3.18.0`. **Not the 3.17.1 the NVD text names as the fix** — [GHSA-gvpp-v77h-5w8g](https://github.com/advisories/GHSA-gvpp-v77h-5w8g) records `<= 3.17.0` affected with `3.18.0` first patched, and 3.17.1 was never published to PyPI at all, so a floor taken from the prose would point at a version that does not exist. The distribution was later renamed to `hypermnesia-mcp`, whose earliest release is 3.24.0 and is therefore always above this floor — no second pin needed. The npm package of the same name is the same project (`cdeust/Cortex`) on a separate 2.x train that GHSA does not cover. (#585) | 2026-08-15 |
+| CVE-2026-73846, CVE-2026-73845, CVE-2026-73844 (`@aborruso/ckan-mcp-server` < 0.4.112 — `canonicalizeParams` in `src/utils/cache.ts` serialises request parameters without escaping `&`, `=` or `\|`, so distinct logical parameter sets collide in `buildCacheKey` and an attacker can prime the shared cache with a response another user's query then receives (6.5); `isValidMqaServer` in `src/tools/quality.ts` validates the `server_url` parameter with a prefix-only regex for `dati.gov.it`, which suffix-host and URL-userinfo forms defeat, letting a caller point the tool at an attacker-controlled host (5.3); and error paths reflect raw upstream bodies and internal exception text — hostnames, internal IPs, DB errors, stack fragments — back to the caller (3.7)) | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-73846) | **In scope, pinned** `AAK-MCP-CKAN-CVE-2026-73846-001` (SUPPLY_CHAIN, MEDIUM): floor `@aborruso/ckan-mcp-server >= 0.4.112`, one pin carrying all three CVEs since they share a package and a fix version. The package name is not in any advisory — no GHSA exists for these three — and had to be identified from the `dati.gov.it` detail in the description; `ckan-mcp-server` on PyPI is an unrelated 0.0.1 placeholder and nothing resolves under the obvious npm spellings. Resolves on npm (0.4.112 published; 0.4.118 latest). (#586, #587, #588) | 2026-08-15 |
+
+## 2026-08-15 (unreleased)
+
+Backlog item, not a watcher issue: the Agent-Zero row deferred from the 2026-05-01 OX MCP batch (#160). Re-verified against NVD and the registries before authoring, which turned up three stale assumptions in the roadmap row.
+
+| CVE | Reference | AAK rule / disposition | Triaged |
+|---|---|---|---|
+| CVE-2026-30624 (Agent Zero 0.9.8 — the External MCP Servers feature accepts a JSON config carrying arbitrary `command` and `args` and executes them when the config is applied, with no validation or restriction, so a malicious MCP config is remote code execution with the Agent Zero process's privileges; HIGH, CVSS 8.6) | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-30624) | **In scope, pinned** `AAK-AGENT-ZERO-CVE-2026-30624-PIN-001` (SUPPLY_CHAIN, HIGH), git-reference-only, floor at the 1.x line. NVD's CPE scopes the CVE to exactly `agent-zero:0.9.8` with no `versionEndExcluding` and names no fixed release; the only reference is the OX advisory. Three corrections to the roadmap row: the repository moved `frdel/agent-zero` → `agent0ai/agent-zero` (both spellings matched, since existing manifests carry the old one); `agent-zero` now **does** resolve on PyPI but as an unrelated "AI outbound voice agent framework" (0.1.2, different author), so the rule matches git references only and never the bare distribution name; and the version scheme jumped 0.9.8 → 0.9.8.1/.2/.3 → v1.1 (2026-03-26) → v2.9, so the floor sits at 1.0 rather than a named fix. `_semver3` collapses 0.9.8.3 to (0, 9, 8), so the whole 0.9.8 patch line is treated as affected — the conservative reading, since no advisory says which patch carries a fix. (#160) | 2026-08-15 |
+
 ## 2026-08-14 (v0.3.76, second wave)
 
 Eight `cve-response` issues from the 2026-08-13 NVD wave. Three in scope (two new pins, one carried by a rule that already floors the same version); five adjudicated out of scope after a registry check — four because no resolvable artifact exists to pin, one because it is a web-application XSS with no MCP surface for a static config scan to see.

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/CHANGELOG.md

@@ -7,14 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.78] - 2026-08-15
+
+### Fixed
+
+- The CVE watcher no longer files CVEs from outside the ecosystem it tracks. NVD's `keywordSearch` matches indexed fields rather than only the description, and two of the watcher's keywords are short enough to hit unrelated CVEs: `mcp` (NVIDIA nForce parts are literally "MCP", so kernel CVEs match) and `claude` (increasingly appears in commit messages crediting the model for writing a patch). CVE-2026-68456 arrived via both at once — a `ueagle-atm` USB driver race whose description contains "mcp" zero times and ends "(The latter two were written by Claude...)". Every filed CVE opens a `cve-response` issue and the release gate blocks any tag while one is open, so an unrelated kernel CVE stopped a publish. Results are now corroborated against the description before filing.
+
+### Changed
+
+- `AAK-MCP-STDIO-CMD-INJ-002` now decides by data flow instead of proximity (#22). It previously fired when a network-controlled marker appeared anywhere in the 1024 characters before a `new StdioClientTransport({...})`, which both over-fires (an unrelated source that happens to sit nearby) and under-fires (a real source reaching the sink from beyond the window). A tree-sitter pass now traces the `command`/`args` value back to its source through assignment, destructuring, template literals and single-hop helper returns. **What the rule reports is unchanged** — same rule_id, severity and framework mappings; only the decision moved. `tree-sitter` and `tree-sitter-typescript` are a new **optional** extra (`pip install "agent-audit-kit[taint]"`), lazy-imported, with the proximity heuristic retained as the fallback when the grammar is absent — so the default install stays dependency-light and fully offline.
+
+### Fixed
+
+- Corrected the remediation on `AAK-DOCSGPT-MCP-STDIO-MITM-001` and `AAK-GPTRESEARCHER-MCP-STDIO-MITM-001`. Both told users to set `"deny_stdio_transport": true` or `"allowed_transports": ["sse"]` "so a MITM cannot flip the transport mid-session". Those keys are AgentAuditKit conventions, not MCP specification fields — they appear in **0 of the 748** public MCP configs in `benchmarks/data`, and searching the repo finds them only in AAK's own `rules.json`, tests and fixtures. Following that advice added a key the user's MCP client ignores, silenced the rule, and left them believing they were protected. The remediation now leads with the controls that work (the vendor version pin; TLS with certificate verification so the handshake cannot be rewritten) and states plainly what those keys are. Found while running the empirical false-positive study #162 asks for.
+
+### Fixed
+
+- `ssrf_patterns` (AAK-SSRF-001..005) now requires reachability instead of deciding file-wide. It previously reported CRITICAL when the word `fetch` appeared anywhere in a file and a user-input marker appeared anywhere else — neither had to be code, related, or nearby — so a match inside a comment, a rule title or a regex literal counted. Against AAK's own source that produced three findings, all prose, including one where the SSRF scanner flagged **its own detection pattern**. Each rule now hangs off a real outbound call site whose URL argument is traced: Python via `ast`, TS/JS via comment-stripped def-use. String literals are deliberately kept, since a genuine metadata URL lives in one. Measured across `agent_audit_kit/`, `tests/fixtures`, `benchmarks/data`, `examples` and `vscode-extension`: **3 false positives removed, all 4 true positives preserved**. Closes #593.
+
+## [0.3.77] - 2026-08-15
+
 ### Added
 
+- `AAK-MCP-MEMSERVICE-CVE-2026-50027-001` (SUPPLY_CHAIN, CRITICAL) — mcp-memory-service < 10.67.1 serves every `/api/documents/*` route with no auth dependency even when `MCP_API_KEY` or OAuth is configured; the sibling `/api/memories` routes do enforce it, making this an inconsistent boundary. Floor `>= 10.67.1`. Closes #589.
+- `AAK-MCP-CORTEX-CVE-2026-49986-001` (SUPPLY_CHAIN, HIGH) — Cortex `<= 3.17.0` treats `CLAUDE_PROJECT_DIR` as a trusted source root, validated only by two marker files, then executes `visualize_bootstrap.py` from it. Floor `>= 3.18.0` per GHSA — **not** the 3.17.1 the NVD text names, which was never published. Closes #585.
+- `AAK-MCP-CKAN-CVE-2026-73846-001` (SUPPLY_CHAIN, MEDIUM) — `@aborruso/ckan-mcp-server` < 0.4.112: cache-key collision, prefix-only host validation, and verbose error reflection. One pin, three CVEs. Closes #586, #587, #588.
+- `aak` is now an installed console script, aliasing `agent-audit-kit`. The docs, changelogs and release notes have used `aak scan` / `aak score` / `aak watch-cve` as shorthand for many releases, but it was never declared in `[project.scripts]`, so every one of those snippets exited 127 when copied. Both names share a single entry point, and `tests/test_console_scripts.py` asserts they stay in step — plus that every `` `aak <cmd>` `` in the docs names a command that actually exists.
+- `AAK-AGENT-ZERO-CVE-2026-30624-PIN-001` (SUPPLY_CHAIN, HIGH) — Agent Zero 0.9.8 executes the `command`/`args` of a user-supplied MCP server config without validation (CVE-2026-30624, CVSS 8.6). Git-reference-only pin with the floor at 1.0: `agent-zero` on PyPI is an unrelated voice-agent framework, and the repo moved `frdel/` → `agent0ai/`. Closes #160.
+- `AAK-POLICY-TRUNCATION-001` (TRUST_BOUNDARY, HIGH) — a deny policy evaluated against a truncated copy of the value the executor receives, so anything past the cut point bypasses the deny list. CVE-2026-73614 (ClaudeHookBridge, CVSS 8.8) is the disclosed instance — truncation to 500 chars before `denyPatterns` while Claude Code ran the full command — but that package resolves on neither npm, PyPI nor GitHub, so the rule is written against the shape rather than the vendor. Fires only when the untruncated source is still used elsewhere in the file, which is what separates a policy/executor split from ordinary display truncation. Covers JS/TS `slice`/`substring`/`substr` and Python slicing. Zero findings against AAK's own source, the VS Code extension, and the benchmark corpus.
 - `AAK-MCP-AUTHFETCH-CVE-2026-49857-001` (SUPPLY_CHAIN, HIGH) — auth-fetch-mcp `<= 3.0.1`: `isPrivateV6()` misses IPv4-mapped IPv6 loopback in hex-normalised form, so `http://[::ffff:127.0.0.1]/` normalises to `[::ffff:7f00:1]`, `net.isIPv4('7f00:1')` is false, and the SSRF guard passes the URL through to loopback. Floor `>= 3.0.2` per GHSA-pvrj-8cg3-j5f8 — **not** the 3.0.1 the NVD prose names as the fix, which is inside the affected range. (#578)
 - `AAK-MCP-JSHOOK-CVE-2026-49856-001` (SUPPLY_CHAIN, MEDIUM) — @jshookmcp/jshook 0.3.1 enforces its SSRF authorization policy only on the raw HTTP/TCP/TLS tools; ICMP probe and traceroute call the native sink directly, giving internal reachability mapping with private-network access disabled. Floor `>= 0.3.2`. (#577)
 - `CVE-2026-73601` added to `AAK-FLOWISE-001` — the Custom MCP node stdio RCE shares Flowise's 3.1.3 fix floor, which that rule's detector already enforces, so it is a reference addition rather than a duplicate pin. (#575)
 
 ### Changed
 
+- Fixed four dangling relative links in `docs/`: one written a directory level too shallow, two pointing at per-rule pages that were never authored (for rules that do exist in the registry), and one to a doc explicitly marked "queued for v0.4.0". `tests/test_docs_links.py` now asserts every relative link under `docs/` resolves — the deterministic half of the link check, without the network flakiness.
+- Launch copy and `CLAUDE_PROMPT.md` now point at `https://sattyamjjain.github.io/agent-audit-kit/` instead of `mcp-security-index.com`, which never resolved and had been failing the docs link check on every PR (6 files).
 - Adjudicated out of scope after a registry check, with reasons recorded in `CHANGELOG.cves.md`: CVE-2026-73614 (ClaudeHookBridge — absent from npm, PyPI and GitHub, so nothing to key a detector on), CVE-2026-19751 / CVE-2026-19752 (mcp-dominican-layer — rolling release, NVD states version details cannot be specified), CVE-2026-19753 (mcp-rdf-explorer — unresolvable, no published fix), CVE-2026-73037 (Next AI Draw.io — reflected XSS in a web app, no MCP surface and no XSS detector here). (#576, #579, #580, #581, #582)
 
 - `AAK-MCP-UFO-CVE-2026-73296-001` (MCP_CONFIG, CRITICAL) — Microsoft UFO < 3.0.8 serves its mobile MCP data-collection (8020) and action (8021) Streamable-HTTP endpoints without inbound auth, handing an unauthenticated caller the ADB device-control tools. New `ufo_mobile_mcp` scanner over vendored source, MCP config, and git dependency; a detection rule rather than a pin, because UFO ships as a git checkout and `ufo` on npm is an unrelated package. (#573)

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/CLAUDE.md

@@ -5,8 +5,8 @@
 
 **AgentAuditKit** (version tracked in `pyproject.toml` / `agent_audit_kit.__version__`) — Security scanner for MCP-connected AI agent pipelines. The "npm audit" for AI agents.
 
-- **298 rules** across 12 security categories
-- **89 scanner modules** including AST-based Python taint analysis plus regex dangerous-sink pattern scanners for TypeScript/JavaScript and Rust (pattern matching, not taint flow)
+- **303 rules** across 12 security categories
+- **90 scanner modules** including AST-based Python taint analysis plus regex dangerous-sink pattern scanners for TypeScript/JavaScript and Rust (pattern matching, not taint flow)
 - **26 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `diff`, `suggest`, `watch`, `watch-cve`, `notify`, `install-precommit`, `export-rules`, `verify-bundle`, `sbom`, `report`, `coverage`, `inspect-ide`, `parity`, `corpus`, `pipelock`, `rule`, `scanners`
 - **OWASP coverage**: Agentic Top 10 (10/10), MCP Top 10 (10/10), Adversa AI Top 25
 - **Compliance mapping** (12 frameworks): EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, NSA MCP CSI, + regional (India DPDP, Singapore, Alabama, Tennessee)
@@ -79,7 +79,7 @@ agent_audit_kit/
   vuln_db.py, advisories.py, feeds/, watch.py   # CVE DB, advisories, live feeds, watch/watch-cve
   coverage.py, bundle.py         # Framework coverage; signed rule-bundle export/verify
   rules/
-    builtin.py         # 298 RuleDefinition entries (rule registry)
+    builtin.py         # 303 RuleDefinition entries (rule registry)
   scanners/            # 89 registered scanners, each exports scan() -> (list[Finding], set[str])
     mcp_config.py      # MCP configuration checks
     hook_injection.py  # Hook injection detection
@@ -138,7 +138,7 @@ benchmarks/            # Benchmark crawler
 ## Detected Patterns
 
 - **Scanner registry**: `engine.py` lazy-builds a list of `ScannerRegistration` dataclasses; each wraps a `scan_fn` callable. New scanners are registered via try/except ImportError blocks for backward compatibility.
-- **Rule registry**: `rules/builtin.py` defines all 298 rules as `RuleDefinition` dataclasses in a global `RULES` dict, populated by `_r()` helper.
+- **Rule registry**: `rules/builtin.py` defines all 303 rules as `RuleDefinition` dataclasses in a global `RULES` dict, populated by `_r()` helper.
 - **Counts are generated, never hand-typed**: `agent_audit_kit/__init__.py` holds `RULE_COUNT` / `SCANNER_COUNT`; `scripts/sync_rule_count.py` and `scripts/sync_scanner_count.py` regenerate them. `scripts/check_counts.py` (`make count-check`) fails if any tracked `*.md` — **including this file** — carries a stale count. Regenerate; do not hand-fix. Dated/historical docs are exempted via the exclusion list in `check_counts.py`.
 - **Count invariants under test**: `tests/test_repo_metadata_sync.py` asserts `SCANNER_COUNT` equals the real `engine._build_registry()` size, so the scanner constant tracks the registry, not the file count in `scanners/`.
 - **Finding model**: All scanners produce `Finding` dataclasses with rule_id, severity, category, evidence, remediation, and framework references (OWASP, CVE, Adversa).

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/CLAUDE_PROMPT.md

@@ -22,8 +22,8 @@ Read in order:
 2. `../agent-airlock/ECOSYSTEM_STATE_2026-04.md` — shared ecosystem brief
 3. `ROADMAP_2026.md` — 90-day plan for this repo
 4. `../agent-airlock/LAUNCH_PLAYBOOK_2026.md` — shared growth tactics
-5. `agent_audit_kit/rules/builtin.py` — understand the 298 existing rules
-6. `agent_audit_kit/scanners/*.py` — understand the 89 scanner modules
+5. `agent_audit_kit/rules/builtin.py` — understand the 303 existing rules
+6. `agent_audit_kit/scanners/*.py` — understand the 90 scanner modules
 7. `tests/conftest.py` — fixture patterns
 8. Run `pytest -v` and `agent-audit-kit scan .` on the repo's own fixtures to confirm baseline
 
@@ -81,7 +81,7 @@ This is the leaderboard-ownership growth play.
 
 1. **Crawler**: discovers MCP servers from `anthropics/claude-plugins-official`, `claudemarketplaces.com`, `aitmpl.com`, `buildwithclaude.com`, and the top 500 GitHub results for `topic:mcp-server`. Store in `benchmarks/crawler/`.
 2. **Scanner runner**: runs the full agent-audit-kit rule catalog against each MCP server weekly.
-3. **Index site**: publish `mcp-security-index.com` (or `index.agentauditkit.dev`) as a static site with per-server grades A–F, rule-hit breakdown, and week-over-week trends. Hosted on Cloudflare Pages.
+3. **Index site**: publish `sattyamjjain.github.io/agent-audit-kit` (or `index.agentauditkit.dev`) as a static site with per-server grades A–F, rule-hit breakdown, and week-over-week trends. Hosted on Cloudflare Pages.
 4. **Disclosure policy**: every discovered vuln goes to the maintainer first with a 90-day disclosure window. Publish the policy at `docs/disclosure-policy.md` before crawling.
 5. **Weekly State of MCP Security** blog post summarizing new findings, trends, and the worst-graded servers. This is the Aider-leaderboard play.
 

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agent-audit-kit
-Version: 0.3.76
+Version: 0.3.78
 Summary: Security scanner for MCP-connected AI agent pipelines
 Project-URL: Homepage, https://github.com/sattyamjjain/agent-audit-kit
 Project-URL: Repository, https://github.com/sattyamjjain/agent-audit-kit
@@ -28,8 +28,13 @@ Provides-Extra: dev
 Requires-Dist: mypy>=1.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.0; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
-Requires-Dist: ruff<0.16,>=0.15; extra == 'dev'
+Requires-Dist: ruff<0.17,>=0.15; extra == 'dev'
+Requires-Dist: tree-sitter-typescript>=0.21; extra == 'dev'
+Requires-Dist: tree-sitter>=0.21; extra == 'dev'
 Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
+Provides-Extra: taint
+Requires-Dist: tree-sitter-typescript>=0.21; extra == 'taint'
+Requires-Dist: tree-sitter>=0.21; extra == 'taint'
 Description-Content-Type: text/markdown
 
 <p align="center">
@@ -45,7 +50,7 @@ Description-Content-Type: text/markdown
   <a href="benchmarks/determinism/RESULTS.md"><img src="https://img.shields.io/badge/determinism-0%25%20variance%20(20%2F20)-brightgreen.svg" alt="Determinism: 0% variance across 20/20 runs"></a>
   <a href="benchmarks/false_positive/RESULTS.md"><img src="https://img.shields.io/badge/benign--slice%20HIGH%2FCRIT%20FP-0%2F1%20(n%3D1)-blue.svg" alt="Benign-slice HIGH/CRITICAL false-positive rate: 0/1, n=1"></a>
   <a href="docs/benchmarks/third-party-grading.md"><img src="https://img.shields.io/badge/third--party%20grade-see%20notes-lightgrey.svg" alt="Third-party grading notes"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-298-blue.svg" alt="Rules: 298"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-303-blue.svg" alt="Rules: 303"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -64,9 +69,9 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry. Precision is measured the same way, not asserted: we publish a reproducible, hand-adjudicated [benign-slice HIGH/CRITICAL false-positive rate](benchmarks/false_positive/RESULTS.md) — with a Wilson confidence interval and any offending rule filed as an issue.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 12 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
 
-- **<!-- rule-count:total -->298<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->303<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
-- **<!-- scanner-count:total -->89<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
+- **<!-- scanner-count:total -->90<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
 - **26 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `diff`, `suggest`, `watch`, `watch-cve`, `notify`, `install-precommit`, `export-rules`, `verify-bundle`, `sbom`, `report`, `coverage`, `inspect-ide`, `parity`, `corpus`, `pipelock`, `rule`, `scanners`
 - **OWASP coverage**: Agentic Top 10 (10/10), MCP Top 10 (10/10), Adversa AI Top 25
 - **Compliance mapping** (12 frameworks): EU AI Act Art. 15 + 55, SOC 2, ISO 27001, ISO/IEC 42001, HIPAA, NIST AI RMF, **NSA MCP Security CSI (U/OO/6030316-26, May 2026)**, Singapore Agentic AI, India DPDP 2023, **Alabama Personal Data Protection Act (HB 351, 2026)**, **Tennessee SB 1580 Health Care AI (PRA)** — PDF reports via `agent-audit-kit report --format pdf --framework <name>`; plus `agent-audit-kit scan . --compliance mcp-2026-roadmap` for **MCP 2026 Roadmap (May 2026)** conformance (a scan-time mapping, not a PDF evidence pack)
@@ -105,7 +110,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.76
+      - uses: sattyamjjain/agent-audit-kit@v0.3.78
         id: scan
         with:
           fail-on: high
@@ -124,6 +129,9 @@ appear as **inline PR annotations** and in the **Security tab**. See
 ```bash
 pip install agent-audit-kit
 agent-audit-kit scan .
+
+# `aak` is installed as a shorthand for the same command
+aak scan .
 ```
 
 ### Pre-commit Hook
@@ -132,7 +140,7 @@ agent-audit-kit scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.76
+    rev: v0.3.78
     hooks:
       - id: agent-audit-kit
 ```
@@ -157,7 +165,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
 | **MCP Configuration** | <!-- category-count:MCP_CONFIG -->63<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1), MCP tool-argument URL SSRF (an MCP tool handler passing a caller-supplied `url`/`endpoint`/`target` argument straight into an outbound `requests`/`httpx`/`urllib`/`aiohttp` fetch with no host/scheme allow-list — `ast` parameter→fetch taint for Python, regex fallback for TS/JS/Rust — `AAK-MCP-SSRF-001`, **CWE-918 / CVE-2026-14748**, AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary`), Serena MCP toolkit unauthenticated-dashboard RCE (`serena-agent` < 1.5.2 — an unauthenticated Flask dashboard on a fixed port reachable via DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to remote code execution — `AAK-MCP-SERENA-CVE-2026-49471-001`, **CWE-306 + CWE-352 / CVE-2026-49471**, HIGH 8.3), MCP 2026-07-28 deprecated features (the `roots` / `sampling` / `logging` capabilities annotation-deprecated under the RC's new 12-month deprecation policy — flagged across config + server source so authors migrate before removal — `AAK-MCP-DEPRECATED-001..003`, **SEP-2577 / SEP-2596**), OAuth `iss`-validation gap (an authorization-code client that handles the auth response but never validates the RFC 9207 `iss` parameter, the RC's actual new OAuth requirement — `AAK-OAUTH-006`, **RFC 9207 / SEP-2468**), RFC 8707 Resource-Indicator absence (an OAuth 2.1 flow / MCP client config that never sets the `resource` parameter, so issued tokens aren't audience-bound and a token minted for one MCP server can be replayed at another — the confused-deputy / audience-confusion class; mandatory in the **ratified** MCP 2025-11-25 auth spec, independent of the 2026-07-28 RC — `AAK-OAUTH-007`, **RFC 8707 / RFC 9728 §7.4**), RFC 9728 Protected-Resource-Metadata discovery gap (a remote MCP server config that embeds a static `Authorization`/`Bearer`/`auth` credential with no `/.well-known/oauth-protected-resource` discovery path, or server source enforcing bearer auth without serving PRM — the resource-discovery arm of the 2026-07-28 auth profile — `AAK-OAUTH-008`, **RFC 9728**) |
-| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->85<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->89<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
 | **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->29<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->18<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
@@ -166,10 +174,10 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Taint Analysis** | <!-- category-count:TAINT_ANALYSIS -->13<!-- /category-count --> | `@tool` param flows to shell/eval/SQL/SSRF/file/deserialization sinks (Python AST), `load_prompt()` user-path reachability, transport-flip MITM (DocsGPT + GPT-Researcher). SQL-injection sinks (`AAK-TAINT-005`) now detected in TypeScript/JS MCP servers too — interpolated/concatenated `.query()`/`.execute()`, `knex.raw`, Prisma `$queryRawUnsafe` — matching the Python + Rust scanners (OX MCP-SDK disclosure class). LLM-generated SQL executed on an RCE-capable DB role (`AAK-LLM-SQL-RCE-001`, **CVE-2026-25879**) — model output reaching `cursor.execute`/`text(...)`/`.query()` as the query itself with no allow-list, plus superuser/`COPY ... FROM PROGRAM`/`xp_cmdshell`/`FILE`-privilege connection roles that turn SQL injection into shell |
 | **Transport Security** | <!-- category-count:TRANSPORT_SECURITY -->12<!-- /category-count --> | HTTP endpoints, TLS disabled, deprecated SSE, tokens in URL query strings, transport body-size limits (CVE-2026-39313), SSRF redirect bypass (CVE-2026-41481), DNS-rebinding (CVE-2025-66414/66416, CVE-2026-35568/35577) |
 | **Legal Compliance** | <!-- category-count:LEGAL_COMPLIANCE -->12<!-- /category-count --> | Copyleft licenses (AGPL/SSPL), missing licenses, DMCA-flagged packages, India PII surface, US-state consumer privacy (Alabama HB 351, Tennessee SB 1580), Singapore Agentic AI, healthcare AI triggers, EU AI Act Article 15 multilingual-eval coverage advisory (Annex III high-risk binding 2027-12-02, Annex I 2028-08-02 — AI Omnibus) |
-| **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->14<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
+| **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->15<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
 | **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
 
-**<!-- rule-count:total -->298<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->303<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
 
 ### MCP Server Card scanning (SEP-1649)
 
@@ -320,7 +328,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v4
-  - uses: sattyamjjain/agent-audit-kit@v0.3.76
+  - uses: sattyamjjain/agent-audit-kit@v0.3.78
     id: scan
     with:
       fail-on: high
@@ -408,15 +416,15 @@ cross-reference, not a head-to-head benchmark.
 | ASI | Title | # rules |
 | --- | --- | --- |
 | **ASI01** | Goal Hijack | 13 |
-| **ASI02** | Tool Misuse | 39 |
+| **ASI02** | Tool Misuse | 42 |
 | **ASI03** | Memory Poisoning | 68 |
-| **ASI04** | Identity & Privilege Abuse | 63 |
+| **ASI04** | Identity & Privilege Abuse | 64 |
 | **ASI05** | Cascading Failures | 42 |
-| **ASI06** | Unauthorized Capability Acquisition | 43 |
+| **ASI06** | Unauthorized Capability Acquisition | 44 |
 | **ASI07** | Plan Injection | 9 |
 | **ASI08** | Agent Communication Poisoning | 5 |
 | **ASI09** | Resource Abuse | 18 |
-| **ASI10** | Supply-Chain | 20 |
+| **ASI10** | Supply-Chain | 21 |
 <!-- owasp-coverage:end -->
 
 </details>
@@ -454,7 +462,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->298<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->303<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/README.md

@@ -11,7 +11,7 @@
   <a href="benchmarks/determinism/RESULTS.md"><img src="https://img.shields.io/badge/determinism-0%25%20variance%20(20%2F20)-brightgreen.svg" alt="Determinism: 0% variance across 20/20 runs"></a>
   <a href="benchmarks/false_positive/RESULTS.md"><img src="https://img.shields.io/badge/benign--slice%20HIGH%2FCRIT%20FP-0%2F1%20(n%3D1)-blue.svg" alt="Benign-slice HIGH/CRITICAL false-positive rate: 0/1, n=1"></a>
   <a href="docs/benchmarks/third-party-grading.md"><img src="https://img.shields.io/badge/third--party%20grade-see%20notes-lightgrey.svg" alt="Third-party grading notes"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-298-blue.svg" alt="Rules: 298"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-303-blue.svg" alt="Rules: 303"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -30,9 +30,9 @@ Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations,
 1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry. Precision is measured the same way, not asserted: we publish a reproducible, hand-adjudicated [benign-slice HIGH/CRITICAL false-positive rate](benchmarks/false_positive/RESULTS.md) — with a Wilson confidence interval and any offending rule filed as an issue.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 12 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
 
-- **<!-- rule-count:total -->298<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->303<!-- /rule-count --> rules** across 12 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
-- **<!-- scanner-count:total -->89<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
+- **<!-- scanner-count:total -->90<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
 - **26 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `diff`, `suggest`, `watch`, `watch-cve`, `notify`, `install-precommit`, `export-rules`, `verify-bundle`, `sbom`, `report`, `coverage`, `inspect-ide`, `parity`, `corpus`, `pipelock`, `rule`, `scanners`
 - **OWASP coverage**: Agentic Top 10 (10/10), MCP Top 10 (10/10), Adversa AI Top 25
 - **Compliance mapping** (12 frameworks): EU AI Act Art. 15 + 55, SOC 2, ISO 27001, ISO/IEC 42001, HIPAA, NIST AI RMF, **NSA MCP Security CSI (U/OO/6030316-26, May 2026)**, Singapore Agentic AI, India DPDP 2023, **Alabama Personal Data Protection Act (HB 351, 2026)**, **Tennessee SB 1580 Health Care AI (PRA)** — PDF reports via `agent-audit-kit report --format pdf --framework <name>`; plus `agent-audit-kit scan . --compliance mcp-2026-roadmap` for **MCP 2026 Roadmap (May 2026)** conformance (a scan-time mapping, not a PDF evidence pack)
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.76
+      - uses: sattyamjjain/agent-audit-kit@v0.3.78
         id: scan
         with:
           fail-on: high
@@ -90,6 +90,9 @@ appear as **inline PR annotations** and in the **Security tab**. See
 ```bash
 pip install agent-audit-kit
 agent-audit-kit scan .
+
+# `aak` is installed as a shorthand for the same command
+aak scan .
 ```
 
 ### Pre-commit Hook
@@ -98,7 +101,7 @@ agent-audit-kit scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.76
+    rev: v0.3.78
     hooks:
       - id: agent-audit-kit
 ```
@@ -123,7 +126,7 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
 | **MCP Configuration** | <!-- category-count:MCP_CONFIG -->63<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1), MCP tool-argument URL SSRF (an MCP tool handler passing a caller-supplied `url`/`endpoint`/`target` argument straight into an outbound `requests`/`httpx`/`urllib`/`aiohttp` fetch with no host/scheme allow-list — `ast` parameter→fetch taint for Python, regex fallback for TS/JS/Rust — `AAK-MCP-SSRF-001`, **CWE-918 / CVE-2026-14748**, AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary`), Serena MCP toolkit unauthenticated-dashboard RCE (`serena-agent` < 1.5.2 — an unauthenticated Flask dashboard on a fixed port reachable via DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to remote code execution — `AAK-MCP-SERENA-CVE-2026-49471-001`, **CWE-306 + CWE-352 / CVE-2026-49471**, HIGH 8.3), MCP 2026-07-28 deprecated features (the `roots` / `sampling` / `logging` capabilities annotation-deprecated under the RC's new 12-month deprecation policy — flagged across config + server source so authors migrate before removal — `AAK-MCP-DEPRECATED-001..003`, **SEP-2577 / SEP-2596**), OAuth `iss`-validation gap (an authorization-code client that handles the auth response but never validates the RFC 9207 `iss` parameter, the RC's actual new OAuth requirement — `AAK-OAUTH-006`, **RFC 9207 / SEP-2468**), RFC 8707 Resource-Indicator absence (an OAuth 2.1 flow / MCP client config that never sets the `resource` parameter, so issued tokens aren't audience-bound and a token minted for one MCP server can be replayed at another — the confused-deputy / audience-confusion class; mandatory in the **ratified** MCP 2025-11-25 auth spec, independent of the 2026-07-28 RC — `AAK-OAUTH-007`, **RFC 8707 / RFC 9728 §7.4**), RFC 9728 Protected-Resource-Metadata discovery gap (a remote MCP server config that embeds a static `Authorization`/`Bearer`/`auth` credential with no `/.well-known/oauth-protected-resource` discovery path, or server source enforcing bearer auth without serving PRM — the resource-discovery arm of the 2026-07-28 auth profile — `AAK-OAUTH-008`, **RFC 9728**) |
-| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->85<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->89<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
 | **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->29<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->18<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
@@ -132,10 +135,10 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Taint Analysis** | <!-- category-count:TAINT_ANALYSIS -->13<!-- /category-count --> | `@tool` param flows to shell/eval/SQL/SSRF/file/deserialization sinks (Python AST), `load_prompt()` user-path reachability, transport-flip MITM (DocsGPT + GPT-Researcher). SQL-injection sinks (`AAK-TAINT-005`) now detected in TypeScript/JS MCP servers too — interpolated/concatenated `.query()`/`.execute()`, `knex.raw`, Prisma `$queryRawUnsafe` — matching the Python + Rust scanners (OX MCP-SDK disclosure class). LLM-generated SQL executed on an RCE-capable DB role (`AAK-LLM-SQL-RCE-001`, **CVE-2026-25879**) — model output reaching `cursor.execute`/`text(...)`/`.query()` as the query itself with no allow-list, plus superuser/`COPY ... FROM PROGRAM`/`xp_cmdshell`/`FILE`-privilege connection roles that turn SQL injection into shell |
 | **Transport Security** | <!-- category-count:TRANSPORT_SECURITY -->12<!-- /category-count --> | HTTP endpoints, TLS disabled, deprecated SSE, tokens in URL query strings, transport body-size limits (CVE-2026-39313), SSRF redirect bypass (CVE-2026-41481), DNS-rebinding (CVE-2025-66414/66416, CVE-2026-35568/35577) |
 | **Legal Compliance** | <!-- category-count:LEGAL_COMPLIANCE -->12<!-- /category-count --> | Copyleft licenses (AGPL/SSPL), missing licenses, DMCA-flagged packages, India PII surface, US-state consumer privacy (Alabama HB 351, Tennessee SB 1580), Singapore Agentic AI, healthcare AI triggers, EU AI Act Article 15 multilingual-eval coverage advisory (Annex III high-risk binding 2027-12-02, Annex I 2028-08-02 — AI Omnibus) |
-| **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->14<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
+| **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->15<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
 | **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
 
-**<!-- rule-count:total -->298<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->303<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
 
 ### MCP Server Card scanning (SEP-1649)
 
@@ -286,7 +289,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v4
-  - uses: sattyamjjain/agent-audit-kit@v0.3.76
+  - uses: sattyamjjain/agent-audit-kit@v0.3.78
     id: scan
     with:
       fail-on: high
@@ -374,15 +377,15 @@ cross-reference, not a head-to-head benchmark.
 | ASI | Title | # rules |
 | --- | --- | --- |
 | **ASI01** | Goal Hijack | 13 |
-| **ASI02** | Tool Misuse | 39 |
+| **ASI02** | Tool Misuse | 42 |
 | **ASI03** | Memory Poisoning | 68 |
-| **ASI04** | Identity & Privilege Abuse | 63 |
+| **ASI04** | Identity & Privilege Abuse | 64 |
 | **ASI05** | Cascading Failures | 42 |
-| **ASI06** | Unauthorized Capability Acquisition | 43 |
+| **ASI06** | Unauthorized Capability Acquisition | 44 |
 | **ASI07** | Plan Injection | 9 |
 | **ASI08** | Agent Communication Poisoning | 5 |
 | **ASI09** | Resource Abuse | 18 |
-| **ASI10** | Supply-Chain | 20 |
+| **ASI10** | Supply-Chain | 21 |
 <!-- owasp-coverage:end -->
 
 </details>
@@ -420,7 +423,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->298<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->303<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/action.yml

@@ -1,5 +1,5 @@
 name: 'AgentAuditKit MCP Security Scan'
-description: 'AgentAuditKit — MCP Security Scan (298 rules, OWASP Agentic Top 10 + MCP Top 10)'
+description: 'AgentAuditKit — MCP Security Scan (303 rules, OWASP Agentic Top 10 + MCP Top 10)'
 author: 'sattyamjjain'
 
 branding:

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/agent_audit_kit/__init__.py

@@ -1,9 +1,9 @@
 """AgentAuditKit — Security scanner for MCP-connected AI agent pipelines."""
 from __future__ import annotations
 
-__version__ = "0.3.76"
-RULE_COUNT = 298
-SCANNER_COUNT = 89
+__version__ = "0.3.78"
+RULE_COUNT = 303
+SCANNER_COUNT = 90
 # Distinct public MCP server configs in the State-of-MCP-2026 corpus, measured from
 # research/state-of-mcp-2026/results.json (distinct_configs_scanned), fetched
 # 2026-07-26. Published in REPORT.md/PREVALENCE.md/etc.; guarded by

{agent_audit_kit-0.3.76 → agent_audit_kit-0.3.78}/agent_audit_kit/engine.py

@@ -98,6 +98,7 @@ _OPTIONAL_SCANNERS: list[tuple[str, str, list[str]]] = [
     ("mcp_env_placeholder_exfil", "MCP ${VAR} env-placeholder secret exfiltration (CVE-2026-32625)", []),
     ("mcp_http_noauth_server", "Unauthenticated MCP HTTP/SSE server on 0.0.0.0 / wildcard CORS", []),
     ("ufo_mobile_mcp", "Microsoft UFO mobile MCP servers unauthenticated on 8020/8021 (CVE-2026-73296)", []),
+    ("policy_truncation", "Deny policy evaluated on a truncated copy of the executed value (CVE-2026-73614 class)", []),
     ("llm_sql_rce", "LLM-generated SQL on an RCE-capable DB role (CVE-2026-25879)", []),
     ("skill_untrusted_exec_path", "Untrusted-search-path exec override in skill/install flow (CVE-2026-53819)", []),
     ("argv_toctou", "Argv rebuilt after allowlist approval before spawn (CVE-2026-53822)", []),