agent-audit-kit 0.3.97__tar.gz → 0.3.99__tar.gz

{agent_audit_kit-0.3.97 → agent_audit_kit-0.3.99}/CHANGELOG.cves.md

@@ -16,6 +16,43 @@ open.
 > issue. The per-CVE latency figures in the tables are **measurements recorded at
 > the time**, kept as dated facts, not a standing promise.
 
+## 2026-09-09: the first JVM entry in the pin surface
+
+CVE-2026-53937 is the first CVE this repository has covered on a Gradle/Maven
+coordinate, and the reason it took a new module rather than a new row is worth
+recording. `mcp_cve_pins_2026_07` is the pin table, and its `_CANDIDATE_NAMES`
+reads Python and npm manifests only — its own docstring records the cost of that
+("the crates.io twin `codewhale-tui` has the same defect but Cargo manifests are
+not in `_CANDIDATE_NAMES`", and "ArcadeDB on Maven" sits in the handled-elsewhere
+list). Widening that tuple would put roughly sixty unrelated package regexes to
+work against `pom.xml` and `build.gradle` for the sake of one CVE, which buys
+false-positive surface rather than coverage. `jvm_mcp_sdk_pins.py` is the narrow
+alternative: JVM manifests, MCP SDK coordinates, nothing else.
+
+**Version resolution was the actual work.** A JVM coordinate rarely carries its
+version inline any more, so a matcher that only reads `group:artifact:version`
+would miss most real projects. Four forms are resolved: a Gradle KTS `val`, a
+Groovy inline coordinate, a version catalog's `version.ref` against
+`[versions]`, and Maven's `${property}` against `<properties>`. The catalog arm
+shipped broken in its first draft and was caught by the fixtures — one regex with
+a lazy `[^\n]*?` and an optional trailing version group matches happily with that
+group empty, so every catalog resolved to "no version" and the arm silently never
+fired. Splitting coordinate-match from version-match removed the ambiguity. That
+is the failure mode a fixture exists to catch, and it did.
+
+**Range boundaries came from Maven Central, not from the advisory prose.** NVD
+says "0.7.0 through 0.12.0"; `io.modelcontextprotocol:kotlin-sdk-core` publishes
+0.7.0 as its *first* release. The range does not start at 0.7.0 because the bug
+was introduced there — it starts there because that is where the module
+containing `ReadBuffer.kt` was split out. Recorded in the rule so nobody later
+"corrects" the floor down to 0.1.0 on the theory that older releases must also be
+affected. There are no releases between 0.12.0 and 0.13.0, so one floor covers
+the range with no second arm needed.
+
+| CVE | Reference | AAK rule / disposition | Triaged |
+|---|---|---|---|
+| CVE-2026-53937 (MCP Kotlin SDK 0.7.0–0.12.0, CVSS 6.2 - `ReadBuffer.append` writes every stdio chunk into a `kotlinx.io.Buffer` with no size cap and only extracts a frame on `\n`, so a peer that never sends a newline grows it until the JVM is OOM-killed; `StdioServerTransport` / `StdioClientTransport` amplify it by queueing raw chunks through a `Channel<ByteArray>(Channel.UNLIMITED)` with no backpressure) | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-53937) | **In scope, rule shipped** `AAK-MCP-STDIO-UNBOUNDED-BUFFER-001` (SUPPLY_CHAIN, **MEDIUM**): floor `io.modelcontextprotocol:kotlin-sdk >= 0.13.0`, `introduced=0.7.0`, matching `kotlin-sdk`, `kotlin-sdk-core` and `kotlin-sdk-jvm` and reporting once per manifest. First JVM pin in the repository; new scanner `jvm_mcp_sdk_pins.py` reads `build.gradle`, `build.gradle.kts`, `gradle/libs.versions.toml` and `pom.xml`. (#705) | 2026-09-09 |
+
 ## 2026-09-08: nine issues close on five pins, and three registry checks changed the fix
 
 The queue carried twelve open `cve-response` issues, eleven of them dated

{agent_audit_kit-0.3.97 → agent_audit_kit-0.3.99}/CHANGELOG.md

@@ -7,6 +7,166 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.99] - 2026-09-09
+
+### Added
+
+- **`AAK-MCP-STDIO-UNBOUNDED-BUFFER-001`** (MEDIUM, SUPPLY_CHAIN) — CVE-2026-53937,
+  closes #705. MCP Kotlin SDK 0.7.0–0.12.0 appends every stdio chunk into a
+  `kotlinx.io.Buffer` with no size cap and only extracts a frame once it sees a
+  `\n`, so a peer that streams bytes without ever sending a newline grows the
+  buffer until the JVM is OOM-killed. `StdioServerTransport` and
+  `StdioClientTransport` amplify it by queueing raw chunks through a
+  `Channel<ByteArray>(Channel.UNLIMITED)` with no backpressure. Fixed in 0.13.0.
+
+  **This is the repository's first JVM pin**, and it needed a new scanner rather
+  than a new row. `mcp_cve_pins_2026_07`'s `_CANDIDATE_NAMES` reads Python and npm
+  manifests only — its own docstring records what that costs, with the crates.io
+  twin of `codewhale` and "ArcadeDB on Maven" both listed as out of reach.
+  Widening that tuple would set roughly sixty unrelated package regexes loose on
+  `pom.xml` and `build.gradle` for one CVE. `jvm_mcp_sdk_pins.py` is the narrow
+  alternative: JVM manifests, MCP SDK coordinates, nothing else.
+
+  Version resolution is the substance. A JVM coordinate rarely carries its version
+  inline, so four forms resolve: a Gradle KTS `val`, a Groovy inline coordinate, a
+  version catalog's `version.ref` against `[versions]`, and Maven's `${property}`
+  against `<properties>`. The catalog arm shipped broken in its first draft and
+  the fixtures caught it — one regex with a lazy `[^\n]*?` and an optional
+  trailing version group matches with that group empty, so every catalog resolved
+  to "no version" and the arm silently never fired.
+
+  Boundaries came from Maven Central, not from advisory prose:
+  `io.modelcontextprotocol:kotlin-sdk-core` publishes **0.7.0 as its first
+  release**, so NVD's range start is a module-split boundary rather than the
+  commit that introduced the defect. Recorded in the rule so nobody later
+  "corrects" the floor down. No releases exist between 0.12.0 and 0.13.0, so one
+  floor covers the range with no second arm.
+
+  All three artifact names that publish the same code (`kotlin-sdk`,
+  `kotlin-sdk-core`, `kotlin-sdk-jvm`) are matched, and a manifest naming two of
+  them reports **once** — one dependency, not two.
+
+  Deliberately conservative: a finding requires a version that actually resolved
+  into 0.7.0–0.12.0. A dynamic version (`0.+`, `latest.release`) or a
+  `version.ref` pointing outside the scanned tree is not reported, and the rule's
+  `limitations` says so rather than leaving the reader to discover it.
+
+  Rules 339 → 340, scanners 100 → 101.
+
+### Fixed
+
+- **`Link check` had been red on `main` since 2026-09-06 and three releases
+  shipped over it.** Not a broken link — the same workflow carries the MCP
+  Security Index staleness guard, and `scripts/index_cadence.py --check` was
+  failing because the README's rendered cadence line said "2026-08-31 (4
+  snapshots)" while the live history had published a fifth on 2026-09-07. The
+  guard fires on the *mismatch*, not only on age, which is why 8 days inside a
+  10-day tolerance still failed.
+
+  Regenerated. Worth naming the reason it went unnoticed: the release workflow
+  gates on its own job list and does not depend on `Link check`, so a red
+  workflow on `main` never blocked a tag. Three releases went out with it red
+  because nothing looked, which is the same "a check nobody reads is not a check"
+  problem the CVE ageing gate was designed around.
+
+- `CLAUDE_PROMPT.md`'s note about the unregistered index domain rewritten to stop
+  restating the dead hostname; it points at `SECURITY.md` instead.
+
+
+## [0.3.98] - 2026-09-08
+
+Clears the standing backlog: both deferred rule tasks are built, and the four
+loose ends flagged over the last two releases are closed. 337 → 339 rules,
+98 → 100 scanners. Both rules came out of the 2026-09-08 NVD triage and carry the
+fixtures that triage specified — neither is net-new surface invented to fill a
+release.
+
+### Added
+
+- **`AAK-MCP-DEST-UNVALIDATED-001`** (HIGH, MCP_CONFIG) — closes #693 and #699,
+  eight days ahead of their 2026-09-20 target. One rule, two arms, because
+  re-reading NVD showed the pair are the two ends of one defect rather than
+  duplicates:
+
+  - **Asymmetry** (CVE-2026-85666, OGX, 7.5): the guard *exists* and is called —
+    OGX applies `validate_url_not_private()` to its other URL inputs — and simply
+    is not applied to `server_url`. That is a within-file inconsistency, and the
+    same class this scanner already detects at two other layers (`AAK-MCPWN-001`,
+    `AAK-MCP-TOOLGATE-ASYMMETRY-001`). It is the higher-precision arm: the
+    negative case is a module that guards every destination, which is exactly
+    what it passes.
+  - **Absence** (CVE-2026-86122, Rowboat, 5.0): nothing guards anything, so there
+    is no correct sibling call to compare against and the asymmetry arm can never
+    fire.
+
+  Deliberately narrow, because ten `AAK-SSRF-*` rules already exist: the
+  destination must be configuration-shaped (`server_url`, `webhook_url`, …), the
+  file must be MCP-relevant, and guard recognition is *imported* from
+  `ssrf_toctou` rather than re-listed, so the two scanners cannot drift apart. A
+  caller-supplied URL arriving as a tool argument stays `AAK-MCP-SSRF-001`'s
+  surface, and the rule says so in its `limitations`.
+
+  `base_url` was in the destination vocabulary until the first self-scan fired it
+  on a `negative/` fixture whose whole job is to be clean. The fixture was right:
+  `base_url` in an API client is the service's own address, configured once and
+  not caller-steerable. Dropped rather than special-cased.
+
+- **`AAK-SANDBOX-DENYLIST-001`** (CRITICAL, TRUST_BOUNDARY) — closes #704, the
+  detector #656 was actually deferred for. Fires only when four signals combine:
+  a deny-list of dangerous *names* held as strings, checked against a value, an
+  in-process exec of that value, **and** a still-reachable lookup primitive
+  (`getattr`, `__getattribute__`, `vars`, `globals`). The fourth is what makes it
+  a defect rather than a style choice — a deny-list that also denies the lookups
+  is merely fragile; one that leaves them reachable is bypassable by construction.
+
+  The blocker named on #656 was precision: telling a deny-list sandbox from a
+  real one *without firing on every codebase that mentions `eval`*. Four
+  negatives hold that line, three of them #704's own acceptance list — an
+  allow-list sandbox, a subprocess-isolated executor, ordinary `eval` on trusted
+  input — plus the one that matters most here: a module that merely *mentions*
+  the vocabulary, which is what a security scanner's own rule text does. A test
+  runs the scanner over `agent_audit_kit/` itself and asserts zero findings.
+
+  Covers CVE-2026-81096 (ToolUniverse, CVSS 10) and CVE-2026-53710
+  (RestrictedPython `getattr` bypass in mcp-context-forge) — two products, which
+  is what makes it a class.
+
+### Fixed
+
+- **The documented scanner contract in `CLAUDE.md` was wrong.** It said `scan()`
+  returns `(findings, evaluated_rule_ids)`. The engine does
+  `all_scanned_files.update(files)` and reports `len(all_scanned_files)` as
+  `files_scanned`, so a scanner written to that contract would have inflated the
+  file count with rule-id strings. It returns **scanned file paths**.
+  `rules_evaluated` is computed separately from the active rule set and no
+  scanner contributes to it. Caught while writing the two scanners above, which
+  is exactly the audience the line misleads.
+
+- **`ROADMAP_2026.md`'s banner overstated its own discipline.** It said "not
+  updated"; §2 item 2 was amended at v0.3.0 and now carries a dated annotation.
+  Narrowed to what is true — nobody re-plans the file, and its figures and goals
+  are left as authored, but factual corrections are appended in place and dated.
+  A banner that overstates its own honesty is the same class of defect as the
+  ones it exists to disclose.
+
+- **`CLAUDE_PROMPT.md` offered `index.agentauditkit.dev` as an alternative host.**
+  Same unregistered-domain family as the security contact retired in v0.3.97.
+  Struck, pointing at the Pages origin that actually resolves.
+
+### Changed
+
+- **Branch cleanup: 17 stale branches removed, 5 of them after verifying their
+  content had landed.** Twelve were fully merged into `main`. The other five
+  showed as unmerged only because they were squash-merged, and each was checked
+  by artifact before deletion rather than by title — `.well-known/funding-manifest-urls`
+  and `scripts/check_cve_ageing.py` for `chore/cve-ageing-gate`, `scanners.json`
+  for `fix/release-unblock-and-derivable-claims`, and so on. That last one was
+  the reason this mattered: its head commit was "bump to 0.3.70", and merging it
+  would have walked the published version backwards by 27 releases.
+
+  `origin` now carries `main` and `gh-pages` and nothing else.
+
+
 ## [0.3.97] - 2026-09-08
 
 ### Fixed

{agent_audit_kit-0.3.97 → agent_audit_kit-0.3.99}/CITATION.cff

@@ -34,8 +34,8 @@ authors:
 repository-code: "https://github.com/sattyamjjain/agent-audit-kit"
 url: "https://github.com/sattyamjjain/agent-audit-kit"
 license: Apache-2.0
-version: "0.3.97"
-date-released: "2026-09-08"
+version: "0.3.99"
+date-released: "2026-09-09"
 keywords:
   - model-context-protocol
   - mcp

{agent_audit_kit-0.3.97 → agent_audit_kit-0.3.99}/CLAUDE.md

@@ -5,8 +5,8 @@
 
 **AgentAuditKit** (version tracked in `pyproject.toml` / `agent_audit_kit.__version__`) — Security scanner for MCP-connected AI agent pipelines. The "npm audit" for AI agents.
 
-- **337 rules** across 14 security categories
-- **98 scanner modules** including AST-based Python taint analysis plus regex dangerous-sink pattern scanners for TypeScript/JavaScript and Rust (pattern matching, not taint flow)
+- **340 rules** across 14 security categories
+- **101 scanner modules** including AST-based Python taint analysis plus regex dangerous-sink pattern scanners for TypeScript/JavaScript and Rust (pattern matching, not taint flow)
 - **26 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `diff`, `suggest`, `watch`, `watch-cve`, `notify`, `install-precommit`, `export-rules`, `verify-bundle`, `sbom`, `report`, `coverage`, `inspect-ide`, `parity`, `corpus`, `pipelock`, `rule`, `scanners`
 - **OWASP coverage**: Agentic Top 10 (10/10), MCP Top 10 (10/10), Adversa AI Top 25
 - **Compliance mapping** (12 frameworks): EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, NSA MCP CSI, + regional (India DPDP, Singapore, Alabama, Tennessee)
@@ -87,8 +87,8 @@ agent_audit_kit/
   vuln_db.py, advisories.py, feeds/, watch.py   # CVE DB, advisories, live feeds, watch/watch-cve
   coverage.py, bundle.py         # Framework coverage; signed rule-bundle export/verify
   rules/
-    builtin.py         # 337 RuleDefinition entries (rule registry)
-  scanners/            # 98 registered scanners (100 .py files on disk — the registry is authoritative)
+    builtin.py         # 340 RuleDefinition entries (rule registry)
+  scanners/            # 101 registered scanners (103 .py files on disk — the registry is authoritative)
     mcp_config.py      # MCP configuration checks
     hook_injection.py  # Hook injection detection
     trust_boundary.py  # Trust boundary violations
@@ -127,7 +127,7 @@ vscode-extension/      # VS Code extension (TypeScript) — separate subtree, ha
 
 **Data flow**: CLI (cli.py) → engine.run_scan() → scanner registry → each scanner's `scan(project_root)` → `list[Finding]` → scoring → output formatter
 
-**Scanner contract**: Every scanner module exports `scan(project_root: Path, ...) -> tuple[list[Finding], set[str]]` where the tuple is (findings, evaluated_rule_ids).
+**Scanner contract**: Every scanner module exports `scan(project_root: Path, ...) -> tuple[list[Finding], set[str]]` where the tuple is **(findings, scanned file paths relative to `project_root`)**. This line used to say `evaluated_rule_ids`, which is wrong and is the kind of wrong that costs an afternoon: `engine.run_scan` does `all_scanned_files.update(files)` and reports `len(all_scanned_files)` as `files_scanned`, so a scanner that returned rule ids would inflate the file count with rule-id strings. `rules_evaluated` is computed separately, from the active rule set, and no scanner contributes to it.
 
 <!-- END AUTO-MANAGED -->
 
@@ -151,7 +151,7 @@ vscode-extension/      # VS Code extension (TypeScript) — separate subtree, ha
 ## Detected Patterns
 
 - **Scanner registry**: `engine.py` lazy-builds a list of `ScannerRegistration` dataclasses; each wraps a `scan_fn` callable. New scanners are registered via try/except ImportError blocks for backward compatibility.
-- **Rule registry**: `rules/builtin.py` defines all 337 rules as `RuleDefinition` dataclasses in a global `RULES` dict, populated by `_r()` helper.
+- **Rule registry**: `rules/builtin.py` defines all 340 rules as `RuleDefinition` dataclasses in a global `RULES` dict, populated by `_r()` helper.
 - **Counts are generated, never hand-typed**: `agent_audit_kit/__init__.py` holds `RULE_COUNT` / `SCANNER_COUNT`; `scripts/sync_rule_count.py` and `scripts/sync_scanner_count.py` regenerate them. `scripts/check_counts.py` (`make count-check`) fails if any tracked `*.md` — **including this file** — carries a stale count. Regenerate; do not hand-fix. Dated/historical docs are exempted via the exclusion list in `check_counts.py`.
 - **The guard is phrase-based, not number-based**: `check_counts.py` only checks counts written in one of its `PATTERNS` phrasings (`"N rules across"`, `"N scanner modules"`, `"N registered scanners"`, `"N CLI commands"`, ...). A count phrased any other way is never looked at and rots silently while `make count-check` reports clean — the `registered scanners` line in this file sat at a stale value for exactly that reason until its pattern was added. When prose needs a new count phrasing, reuse a guarded one or add it to `PATTERNS` in `scripts/check_counts.py`; that tuple is the single source, and `tests/test_rule_count_sync.py` imports `find_stale_counts()` rather than mirroring it.
 - **Count invariants under test**: `tests/test_repo_metadata_sync.py` asserts `SCANNER_COUNT` equals the real `engine._build_registry()` size, so the scanner constant tracks the registry, not the file count in `scanners/`.

{agent_audit_kit-0.3.97 → agent_audit_kit-0.3.99}/CLAUDE_PROMPT.md

@@ -22,8 +22,8 @@ Read in order:
 2. `../agent-airlock/ECOSYSTEM_STATE_2026-04.md` — shared ecosystem brief
 3. `ROADMAP_2026.md` — 90-day plan for this repo
 4. `../agent-airlock/LAUNCH_PLAYBOOK_2026.md` — shared growth tactics
-5. `agent_audit_kit/rules/builtin.py` — understand the 337 existing rules
-6. `agent_audit_kit/scanners/*.py` — understand the 98 scanner modules
+5. `agent_audit_kit/rules/builtin.py` — understand the 340 existing rules
+6. `agent_audit_kit/scanners/*.py` — understand the 101 scanner modules
 7. `tests/conftest.py` — fixture patterns
 8. Run `pytest -v` and `agent-audit-kit scan .` on the repo's own fixtures to confirm baseline
 
@@ -81,7 +81,7 @@ This is the leaderboard-ownership growth play.
 
 1. **Crawler**: discovers MCP servers from `anthropics/claude-plugins-official`, `claudemarketplaces.com`, `aitmpl.com`, `buildwithclaude.com`, and the top 500 GitHub results for `topic:mcp-server`. Store in `benchmarks/crawler/`.
 2. **Scanner runner**: runs the full agent-audit-kit rule catalog against each MCP server weekly.
-3. **Index site**: publish `sattyamjjain.github.io/agent-audit-kit` (or `index.agentauditkit.dev`) as a static site with per-server grades A–F, rule-hit breakdown, and week-over-week trends. Hosted on Cloudflare Pages.
+3. **Index site**: publish `sattyamjjain.github.io/agent-audit-kit` as a static site (this line used to offer a custom-domain alternative; that domain was never registered — see `SECURITY.md` — and the Pages origin is the one that resolves) with per-server grades A–F, rule-hit breakdown, and week-over-week trends. Hosted on Cloudflare Pages.
 4. **Disclosure policy**: every discovered vuln goes to the maintainer first with a 90-day disclosure window. Publish the policy at `docs/disclosure-policy.md` before crawling.
 5. **Weekly State of MCP Security** blog post summarizing new findings, trends, and the worst-graded servers. This is the Aider-leaderboard play.
 

{agent_audit_kit-0.3.97 → agent_audit_kit-0.3.99}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agent-audit-kit
-Version: 0.3.97
+Version: 0.3.99
 Summary: Security scanner for MCP-connected AI agent pipelines
 Project-URL: Homepage, https://github.com/sattyamjjain/agent-audit-kit
 Project-URL: Repository, https://github.com/sattyamjjain/agent-audit-kit
@@ -50,7 +50,7 @@ Description-Content-Type: text/markdown
   <a href="benchmarks/determinism/RESULTS.md"><img src="https://img.shields.io/badge/determinism-0%25%20variance%20(20%2F20)-brightgreen.svg" alt="Determinism: 0% variance across 20/20 runs"></a>
   <!-- fp-badge --><a href="benchmarks/false_positive/RESULTS.md"><img src="https://img.shields.io/badge/benign--slice%20536%20configs-HIGH%2FCRIT%20FP%200%2F1-brightgreen.svg" alt="Benign-slice false-positive measurement: 536 configs scanned, 0 of 1 HIGH/CRITICAL findings were false positives (0.0%)"></a><!-- /fp-badge -->
   <a href="docs/benchmarks/third-party-grading.md"><img src="https://img.shields.io/badge/third--party%20grade-see%20notes-lightgrey.svg" alt="Third-party grading notes"></a>
-  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-337-blue.svg" alt="Rules: 337"></a>
+  <a href="#what-it-scans"><img src="https://img.shields.io/badge/rules-340-blue.svg" alt="Rules: 340"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_Agentic-10%2F10-green.svg" alt="OWASP Agentic: 10/10"></a>
   <a href="#frameworks--standards"><img src="https://img.shields.io/badge/OWASP_MCP-10%2F10-green.svg" alt="OWASP MCP: 10/10"></a>
   <a href="https://sattyamjjain.github.io/agent-audit-kit/"><img src="https://img.shields.io/badge/MCP_Security_Index-live-blue.svg" alt="MCP Security Index"></a>
@@ -78,11 +78,11 @@ These are regenerated from `research/state-of-mcp-2026/results.json` by `scripts
 1. **Runs fully offline and deterministically.** Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). This is measured, not just claimed: [20/20 identical runs → one shared SHA-256 finding-set digest, 0% variance](benchmarks/determinism/RESULTS.md). Scanners that route findings through an LLM judge can't guarantee a byte-identical re-run — so CI diffs, audit re-runs, and regression baselines stay stable here. No account, no telemetry. Precision is measured the same way, not asserted: we publish a reproducible, hand-adjudicated [benign-slice HIGH/CRITICAL false-positive rate](benchmarks/false_positive/RESULTS.md) — with a Wilson confidence interval and any offending rule filed as an issue.
 2. **Produces auditor-ready compliance-evidence packs.** SARIF for the GitHub Security tab plus PDF evidence reports mapped to 12 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.
 
-- **<!-- rule-count:total -->337<!-- /rule-count --> rules** across 14 security categories, covering the 2026 CVE wave
+- **<!-- rule-count:total -->340<!-- /rule-count --> rules** across 14 security categories, covering the 2026 CVE wave
   - Rule count is computed from the registry and verified in CI (`test_rule_count_is_canonical`).
-- **<!-- scanner-count:total -->98<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
-- **Remediation guidance: all <!-- rule-count:total -->337<!-- /rule-count --> of <!-- rule-count:total -->337<!-- /rule-count --> rules.** Every finding tells you what to change and why — that is the product, and it has no gap.
-- **Mechanical fix recipes: <!-- fix-recipe-coverage:count -->11<!-- /fix-recipe-coverage --> of <!-- rule-count:total -->337<!-- /rule-count --> rules (<!-- fix-recipe-coverage:pct -->3.3<!-- /fix-recipe-coverage -->%).** This is a scope decision, not coverage: **a recipe ships only where the remediation is deterministic and one-line** — exactly one correct edit, confirmable from the diff. Everything else stays advisory on purpose, because a fix that needs judgement is a fix that can be wrong silently. `agent-audit-kit fix` applies these; the narrower `suggest --auto-pr` allow-list is the subset AAK will open a PR for.
+- **<!-- scanner-count:total -->101<!-- /scanner-count --> scanner modules** including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
+- **Remediation guidance: all <!-- rule-count:total -->340<!-- /rule-count --> of <!-- rule-count:total -->340<!-- /rule-count --> rules.** Every finding tells you what to change and why — that is the product, and it has no gap.
+- **Mechanical fix recipes: <!-- fix-recipe-coverage:count -->11<!-- /fix-recipe-coverage --> of <!-- rule-count:total -->340<!-- /rule-count --> rules (<!-- fix-recipe-coverage:pct -->3.2<!-- /fix-recipe-coverage -->%).** This is a scope decision, not coverage: **a recipe ships only where the remediation is deterministic and one-line** — exactly one correct edit, confirmable from the diff. Everything else stays advisory on purpose, because a fix that needs judgement is a fix that can be wrong silently. `agent-audit-kit fix` applies these; the narrower `suggest --auto-pr` allow-list is the subset AAK will open a PR for.
   <br>The rules with the most findings are the ones that fail that bar hardest, and the reasons are written down per fix shape in [`autopr.py`](agent_audit_kit/autopr.py): splitting a shell string into argv needs the shell's own parse; flipping a transport needs to know the server speaks the replacement; declaring RFC 9728 metadata needs an endpoint stood up on a different machine than the one being scanned. [`AAK-OAUTH-008` is the worked example](agent_audit_kit/autopr.py): the only edit that silences it leaves the credential in place, and a test performs that edit to prove it.
   - Coverage is computed from the registry and verified in CI (`test_fix_recipe_coverage_is_canonical`), which also asserts every rule marked `auto_fixable` has a recipe that actually runs.
 - **26 CLI commands**: `scan`, `discover`, `pin`, `verify`, `fix`, `score`, `update`, `proxy`, `kill`, `diff`, `suggest`, `watch`, `watch-cve`, `notify`, `install-precommit`, `export-rules`, `verify-bundle`, `sbom`, `report`, `coverage`, `inspect-ide`, `parity`, `corpus`, `pipelock`, `rule`, `scanners`
@@ -123,7 +123,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: sattyamjjain/agent-audit-kit@v0.3.97
+      - uses: sattyamjjain/agent-audit-kit@v0.3.99
         id: scan
         with:
           fail-on: high
@@ -153,7 +153,7 @@ aak scan .
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/sattyamjjain/agent-audit-kit
-    rev: v0.3.97
+    rev: v0.3.99
     hooks:
       - id: agent-audit-kit
 ```
@@ -177,8 +177,8 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 
 | Category | Rules | What It Detects |
 |----------|:-----:|-----------------|
-| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->66<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1), MCP tool-argument URL SSRF (an MCP tool handler passing a caller-supplied `url`/`endpoint`/`target` argument straight into an outbound `requests`/`httpx`/`urllib`/`aiohttp` fetch with no host/scheme allow-list — `ast` parameter→fetch taint for Python, regex fallback for TS/JS/Rust — `AAK-MCP-SSRF-001`, **CWE-918 / CVE-2026-14748**, AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary`), Serena MCP toolkit unauthenticated-dashboard RCE (`serena-agent` < 1.5.2 — an unauthenticated Flask dashboard on a fixed port reachable via DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to remote code execution — `AAK-MCP-SERENA-CVE-2026-49471-001`, **CWE-306 + CWE-352 / CVE-2026-49471**, HIGH 8.3), MCP 2026-07-28 deprecated features (the `roots` / `sampling` / `logging` capabilities annotation-deprecated under the RC's new 12-month deprecation policy — flagged across config + server source so authors migrate before removal — `AAK-MCP-DEPRECATED-001..003`, **SEP-2577 / SEP-2596**), OAuth `iss`-validation gap (an authorization-code client that handles the auth response but never validates the RFC 9207 `iss` parameter, the RC's actual new OAuth requirement — `AAK-OAUTH-006`, **RFC 9207 / SEP-2468**), RFC 8707 Resource-Indicator absence (an OAuth 2.1 flow / MCP client config that never sets the `resource` parameter, so issued tokens aren't audience-bound and a token minted for one MCP server can be replayed at another — the confused-deputy / audience-confusion class; mandatory in the **ratified** MCP 2025-11-25 auth spec, independent of the 2026-07-28 RC — `AAK-OAUTH-007`, **RFC 8707 / RFC 9728 §7.4**), RFC 9728 Protected-Resource-Metadata discovery gap (a remote MCP server config that embeds a static `Authorization`/`Bearer`/`auth` credential with no `/.well-known/oauth-protected-resource` discovery path, or server source enforcing bearer auth without serving PRM — the resource-discovery arm of the 2026-07-28 auth profile — `AAK-OAUTH-008`, **RFC 9728**) |
-| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->108<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
+| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->67<!-- /category-count --> | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (`Mcp-Session-Id` reliance, removed `tasks/list`, sticky-session deployment, un-cached client `tools/list`), deny-by-default attested admission (signed clearance / `/.well-known/mcp-clearance` / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / `upstream.disable_ip_validation`, HTTPS upstream missing `upstream.tls.ca_file` trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (`npx`/`node`/`bash`/`sh`/`python` with `-c`/`-e`/`--eval`, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in `tools/list` but not `tools/call` — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on `0.0.0.0` / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth **launch surface** — `mcp.json`/`claude_desktop_config.json`/`*.mcp.yaml` `command`/`args`, Docker `--host 0.0.0.0`/`-p 0.0.0.0:`, and MCP Inspector / FastMCP startup binding `0.0.0.0`/`::`/a routable IP with no token or `DANGEROUSLY_OMIT_AUTH` set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot `0.0.0.0:8080` no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before `subprocess`/`os.exec*` / Node `child_process.spawn`/`execa` with no re-check — `AAK-MCP-ARGV-TOCTOU-001`, **CWE-77 + CWE-367 / CVE-2026-53822**), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — `""`/`changeme`/`os.environ.get(...,"")` — or a warning-only secret gate on a `0.0.0.0` bind — `AAK-MCP-NOAUTH-DEFAULT`, **CWE-306 + CWE-862 / CVE-2026-48814** (incomplete fix of CVE-2026-46701)), bearer-token → session-file path traversal (an untrusted token / `Authorization` header joined into a session file path used for an existence/read check with no separator-reject or resolve-and-contain guard — `AAK-MCP-AUTH-PATHTRAVERSAL-001`, **CWE-22 / CVE-2026-52830**, fast-mcp-telegram < 0.19.1), MCP tool-argument URL SSRF (an MCP tool handler passing a caller-supplied `url`/`endpoint`/`target` argument straight into an outbound `requests`/`httpx`/`urllib`/`aiohttp` fetch with no host/scheme allow-list — `ast` parameter→fetch taint for Python, regex fallback for TS/JS/Rust — `AAK-MCP-SSRF-001`, **CWE-918 / CVE-2026-14748**, AIAnytime Awesome-MCP-Server `mcp-wiki/wiki-summary`), Serena MCP toolkit unauthenticated-dashboard RCE (`serena-agent` < 1.5.2 — an unauthenticated Flask dashboard on a fixed port reachable via DNS rebinding writes the agent's persistent memory, chained with `execute_shell_command` `shell=True` to remote code execution — `AAK-MCP-SERENA-CVE-2026-49471-001`, **CWE-306 + CWE-352 / CVE-2026-49471**, HIGH 8.3), MCP 2026-07-28 deprecated features (the `roots` / `sampling` / `logging` capabilities annotation-deprecated under the RC's new 12-month deprecation policy — flagged across config + server source so authors migrate before removal — `AAK-MCP-DEPRECATED-001..003`, **SEP-2577 / SEP-2596**), OAuth `iss`-validation gap (an authorization-code client that handles the auth response but never validates the RFC 9207 `iss` parameter, the RC's actual new OAuth requirement — `AAK-OAUTH-006`, **RFC 9207 / SEP-2468**), RFC 8707 Resource-Indicator absence (an OAuth 2.1 flow / MCP client config that never sets the `resource` parameter, so issued tokens aren't audience-bound and a token minted for one MCP server can be replayed at another — the confused-deputy / audience-confusion class; mandatory in the **ratified** MCP 2025-11-25 auth spec, independent of the 2026-07-28 RC — `AAK-OAUTH-007`, **RFC 8707 / RFC 9728 §7.4**), RFC 9728 Protected-Resource-Metadata discovery gap (a remote MCP server config that embeds a static `Authorization`/`Bearer`/`auth` credential with no `/.well-known/oauth-protected-resource` discovery path, or server source enforcing bearer auth without serving PRM — the resource-discovery arm of the 2026-07-28 auth profile — `AAK-OAUTH-008`, **RFC 9728**) |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->109<!-- /category-count --> | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for `astro-mcp-server` / `chatgpt-mcp-server` / `docsgpt` / `gpt-researcher` / `litellm` / `mcp-calculate-server` / `semantic-kernel` / `@anthropic-ai/claude-code` / `apache-doris-mcp-server` / `excel-mcp-server`, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — `AAK-MCP-STDIO-CMD-INJ-001..004` — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (`.env`-sourced binary, workspace-prepended `PATH`, `shutil.which` over a tainted PATH, Homebrew env override — `AAK-SKILL-UNTRUSTED-EXEC-PATH`, **CWE-426 / CVE-2026-53819**), and the **2026-07 MCP/agent CVE disclosure wave** — verified PyPI/npm version-pins for `litellm` < 1.84.0 (MCP auth bypass + skills-archive traversal, **CVE-2026-59822/59820**), `cline` < 3.0.30 (Hub-dashboard WS origin bypass → RCE, **CVE-2026-59723**), `mcp-text-editor` ≤ 1.0.2 (path traversal, **CVE-2026-15138**), `n8n` < 2.27.4/2.28.1 (MCP tool credential-domain bypass, **CVE-2026-59207**), `ruflo` < 3.16.3 (unauth MCP bridge RCE, **CVE-2026-59726**, CVSS 10), `@arikusi/deepseek-mcp-server` < 1.8.0 (unbound session IDs + unauth HTTP transport, **CVE-2026-55604/55605**), `mcp-server-kubernetes` < 3.9.0 (kubectl `--server` argument injection, **CVE-2026-61459**, CVSS 9.8), and `astrbot` ≤ 4.25.2 (MCP-test-endpoint SSRF, **CVE-2026-15501**) |
 | **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->30<!-- /category-count --> | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), `@mcp.tool` unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin, Kong Konnect MCP server < 1.0.0 indirect prompt injection → unintended Konnect/Admin API requests (`AAK-MCP-KONG-CVE-2026-13341-001`, **CVE-2026-13341**, HIGH 7.4). Indirect-prompt-injection detection (`AAK-POISON-001..006`) runs against tool descriptions **and** every per-parameter `inputSchema.properties.*.description` (recursive — nested objects, array items, `anyOf`/`allOf`/`oneOf`), so instruction text hidden in a single argument's docstring is caught |
 | **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, `.env` leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), `${VAR}`/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) |
 | **Agent Config** | <!-- category-count:AGENT_CONFIG -->18<!-- /category-count --> | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection |
@@ -187,12 +187,12 @@ agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/
 | **Taint Analysis** | <!-- category-count:TAINT_ANALYSIS -->14<!-- /category-count --> | `@tool` param flows to shell/eval/SQL/SSRF/file/deserialization sinks (Python AST), `load_prompt()` user-path reachability, transport-flip MITM (DocsGPT + GPT-Researcher). SQL-injection sinks (`AAK-TAINT-005`) now detected in TypeScript/JS MCP servers too — interpolated/concatenated `.query()`/`.execute()`, `knex.raw`, Prisma `$queryRawUnsafe` — matching the Python + Rust scanners (OX MCP-SDK disclosure class). LLM-generated SQL executed on an RCE-capable DB role (`AAK-LLM-SQL-RCE-001`, **CVE-2026-25879**) — model output reaching `cursor.execute`/`text(...)`/`.query()` as the query itself with no allow-list, plus superuser/`COPY ... FROM PROGRAM`/`xp_cmdshell`/`FILE`-privilege connection roles that turn SQL injection into shell |
 | **Transport Security** | <!-- category-count:TRANSPORT_SECURITY -->15<!-- /category-count --> | HTTP endpoints, TLS disabled, deprecated SSE, tokens in URL query strings, transport body-size limits (CVE-2026-39313), SSRF redirect bypass (CVE-2026-41481), DNS-rebinding (CVE-2025-66414/66416, CVE-2026-35568/35577) |
 | **Legal Compliance** | <!-- category-count:LEGAL_COMPLIANCE -->12<!-- /category-count --> | Copyleft licenses (AGPL/SSPL), missing licenses, DMCA-flagged packages, India PII surface, US-state consumer privacy (Alabama HB 351, Tennessee SB 1580), Singapore Agentic AI, healthcare AI triggers, EU AI Act Article 15 multilingual-eval coverage advisory (Annex III high-risk binding 2027-12-02, Annex I 2028-08-02 — AI Omnibus) |
-| **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->16<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
+| **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->17<!-- /category-count --> | `enableAllProjectMcpServers`, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |
 | **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 discovery cards (`/.well-known/mcp/server-card.json`): tool-description poisoning in `tools[].description` (`AAK-MCP-CARD-001`, reuses the AAK-POISON detectors), declared-transport vs advertised-capability mismatch — remote transport with `authentication.required: false`, or `stdio` advertising a remote endpoint (`AAK-MCP-CARD-002`), missing / placeholder signature / provenance (`AAK-MCP-CARD-003`), and over-broad capability / wildcard-scope claims (`AAK-MCP-CARD-004`) |
 | **Composition** | <!-- category-count:COMPOSITION -->3<!-- /category-count --> | Risk that exists only between components, where each one passes on its own. An ordered 2- or 3-component path carrying untrusted input to network egress through something that reads secrets or local state, while no single component spans it (`AAK-COMPOSE-001`, CompoSkill **arXiv:2608.16246**); two or more skills sharing a writable path neither declares, which is the collusion channel a declared-capability union cannot see by construction (`AAK-COMPOSE-002`, ColluSkill **arXiv:2608.09732**); and a skill whose body or adjacent scripts exercise a wider capability than its manifest declares, which makes every chain through it look narrower than it is (`AAK-COMPOSE-003`). Paths are capped at three components, where CompoSkill's own attack-success numbers concentrate. Distinct from `AAK-AGENT-COMPOSE-001`, which is an unordered capability union over one container of skills; a composition finding stands down when any component is already reported at the same severity, so a chain is never reported twice |
 | **Agentic Skills (AST10)** | <!-- category-count:AGENTIC_SKILL -->3<!-- /category-count --> | The statically decidable subset of the [OWASP Agentic Skills Top 10](#owasp-agentic-skills-top-10-ast10). A skill bundle pulling an external resource that nothing pins, so what it runs is whatever the source serves at the time (`AAK-AST02-001`, **AST02** + the pinning half of **AST07**); a deserialization tag in skill frontmatter that constructs an object while parsing, before any field is read and before the skill is invoked (`AAK-AST04-001`, **AST04** parsing layer, distinct from `AAK-SKILL-005` which reads frontmatter *values*); and a bundle whose platform manifests disagree about security metadata, so the platform loading the weaker one runs without a control the other declares (`AAK-AST10-001`, **AST10**). Three rules, not ten: AST06, AST08 and AST09 need runtime or organisational evidence a static scan cannot supply |
 
-**<!-- rule-count:total -->337<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
+**<!-- rule-count:total -->340<!-- /rule-count --> rules total.** Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.
 
 ### MCP Server Card scanning (SEP-1649)
 
@@ -345,7 +345,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v4
-  - uses: sattyamjjain/agent-audit-kit@v0.3.97
+  - uses: sattyamjjain/agent-audit-kit@v0.3.99
     id: scan
     with:
       fail-on: high
@@ -468,9 +468,9 @@ cross-reference, not a head-to-head benchmark.
 | **ASI01** | Goal Hijack | 14 |
 | **ASI02** | Tool Misuse | 48 |
 | **ASI03** | Memory Poisoning | 73 |
-| **ASI04** | Identity & Privilege Abuse | 72 |
-| **ASI05** | Cascading Failures | 55 |
-| **ASI06** | Unauthorized Capability Acquisition | 47 |
+| **ASI04** | Identity & Privilege Abuse | 73 |
+| **ASI05** | Cascading Failures | 56 |
+| **ASI06** | Unauthorized Capability Acquisition | 48 |
 | **ASI07** | Plan Injection | 9 |
 | **ASI08** | Agent Communication Poisoning | 5 |
 | **ASI09** | Resource Abuse | 18 |
@@ -531,7 +531,7 @@ See [`docs/comparisons.md`](docs/comparisons.md) for a fully-sourced version. Ve
 | Feature | AgentAuditKit | Microsoft AGT | Snyk Agent Scan | Semgrep Multimodal |
 |---------|:---:|:---:|:---:|:---:|
 | Scope | Static scanner + compliance PDFs | Runtime governance | Static + runtime | Multimodal SAST |
-| Detection rules (static) | **<!-- rule-count:total -->337<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
+| Detection rules (static) | **<!-- rule-count:total -->340<!-- /rule-count -->** | Runtime policies, not rules | ~30 | LLM-assisted |
 | OWASP Agentic 10/10 | **Yes** | Yes | Partial | Partial |
 | OWASP MCP 10/10 | **Yes** | No (runtime-focused) | No | No |
 | Auditor-ready PDF compliance | **12 frameworks** | No | 0 | 0 |
@@ -575,7 +575,7 @@ Provides inline diagnostics on file save with quick-fix suggestions.
 Public leaderboard of MCP servers, published at
 **[sattyamjjain.github.io/agent-audit-kit](https://sattyamjjain.github.io/agent-audit-kit/)**.
 
-<!-- index-cadence -->Last published snapshot: **2026-08-31** (4 snapshots in [`history.json`](https://sattyamjjain.github.io/agent-audit-kit/data/history.json)). The build fails if this date falls more than 10 days behind, so a stalled index reports itself.<!-- /index-cadence -->
+<!-- index-cadence -->Last published snapshot: **2026-09-07** (5 snapshots in [`history.json`](https://sattyamjjain.github.io/agent-audit-kit/data/history.json)). The build fails if this date falls more than 10 days behind, so a stalled index reports itself.<!-- /index-cadence -->
 
 > **On the schedule.** The Monday crawl was dying on `HTTP 429` — the status the
 > GitHub Search API returns for a secondary rate limit, and the one its retry path
@@ -694,7 +694,7 @@ agent-audit-kit verify-bundle rules.json --signature rules.json.sigstore
 git clone https://github.com/sattyamjjain/agent-audit-kit
 cd agent-audit-kit
 pip install -e ".[dev]"
-pytest -v                          # <!-- test-count:total -->2,202<!-- /test-count --> test functions
+pytest -v                          # <!-- test-count:total -->2,253<!-- /test-count --> test functions
 ruff check .                       # Lint
 mypy agent_audit_kit/              # Type check
 agent-audit-kit scan .             # Self-scan