agent-audit-kit 0.6.2__tar.gz → 0.6.4__tar.gz

{agent_audit_kit-0.6.2 → agent_audit_kit-0.6.4}/.github/dependabot.yml

@@ -5,7 +5,7 @@ updates:
     schedule:
       interval: "weekly"
     ignore:
-      # ruff's minor is pinned in pyproject.toml (`ruff>=0.15,<0.16`) so CI lint
+      # ruff's minor is pinned in pyproject.toml (`ruff>=0.15,<0.17`) so CI lint
       # stays reproducible. A new ruff minor adds rules that turn CI red without a
       # deliberate `ruff check --fix` adoption, so don't auto-propose the cap bump
       # (that was PR #494 — closed, failed all four `test` jobs). Adopting a newer

{agent_audit_kit-0.6.2 → agent_audit_kit-0.6.4}/.github/workflows/link-check.yml

@@ -46,7 +46,7 @@ jobs:
         with:
           args: >-
             --no-progress
-            --exclude 'mailto:|agentauditkit\.io|globenewswire\.com|asciinema\.org'
+            --exclude 'mailto:|agentauditkit\.io|globenewswire\.com|asciinema\.org|linkedin\.com|github\.com/sattyamjjain/agent-audit-kit/(blob|tree)/main'
             --exclude-path 'docs/changelog/archive'
             --max-retries 3
             --retry-wait-time 5
@@ -67,6 +67,21 @@ jobs:
       # repo — is also covered by tests/test_docs_links.py, which fails fast and
       # locally and does not depend on the network at all.
       #
+      # Links to this repository's own files are written as absolute
+      # blob/main URLs on purpose: README.md is the PyPI long_description, and
+      # PyPI does not resolve repo-relative paths. Checking them over the
+      # network is both weaker and wrong here -- weaker because GitHub answers
+      # 200 for paths that redirect, and wrong because a PR that adds a docs
+      # page and links to it 404s until the branch merges, which is how this
+      # exclusion came to be needed on 2026-09-12.
+      #
+      # They are checked instead against the working tree by
+      # tests/test_readme_contract.py::test_every_docs_site_link_has_a_source_page,
+      # which asserts every one of them resolves to a file that exists.
+      # linkedin.com is excluded because it answers 999 to every non-browser
+      # request -- its anti-bot status, not a dead link. It entered scope on
+      # 2026-09-12 when the grant application moved from the repo root into
+      # docs/, which lychee scans. The link itself resolves fine in a browser.
       # asciinema.org is excluded for the same reason, after the gentler fix was
       # tried and did not work: the README's demo embed times out from the runner
       # while answering 200 in ~0.9s from elsewhere, and raising --timeout from

{agent_audit_kit-0.6.2 → agent_audit_kit-0.6.4}/CHANGELOG.md

@@ -7,6 +7,122 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.4] - 2026-09-12
+
+### Fixed
+
+Four stale facts in files the count guard could not see, found by a parallel
+audit of the supporting documentation rather than by the guards themselves.
+
+- **`funding.json` claimed 332 rules and 12 compliance frameworks** against a
+  live 348 and 14 — drifted by 16 rules with every guard reporting clean. It is
+  published to FLOSS/fund through `.well-known/funding-manifest-urls`, so it is
+  a public claim, and `scripts/check_counts.py` was scoped to tracked `*.md`
+  because that is where prose lives. This file's `description` is a paragraph of
+  prose inside a JSON string.
+
+  Two separate blind spots, both closed. The guard now reads
+  `EXTRA_TRACKED_FILES` in addition to markdown, and a new pattern covers
+  `N rules across M categories` — the sibling of the existing
+  `N rules across M scanners`. The categories number in that sentence was
+  already guarded; the rules number matched nothing, so one number in the
+  sentence was checked and the other was free to rot. Verified by reverting the
+  stale value and watching the guard fail, then restoring it.
+
+- **`SECURITY.md` listed `Latest release (0.3.x)` as the supported version**
+  while the project shipped 0.6.3. A security policy is a poor place to be two
+  minor versions stale, and it is one of the first files a reviewing
+  organisation opens.
+
+- **`CONTRIBUTING.md` step 5 told contributors to "Update `docs/rules.md` with
+  the new rule".** That file's rule table sits between
+  `BEGIN/END rules-summary` markers written by `scripts/sync_rule_count.py`, so
+  anyone following the instruction would hand-edit generated content and have
+  the next sync silently overwrite the work. It now says to regenerate, and
+  names the script.
+
+- **`.github/dependabot.yml` documented the ruff pin as `>=0.15,<0.16`** where
+  `pyproject.toml` says `>=0.15,<0.17`. A comment explaining a constraint that
+  is not the constraint in force.
+
+### Added
+
+- Five assertions in `tests/test_readme_contract.py` covering the above:
+  `funding.json`'s counts against the live registry, the guard extension that
+  makes that enforceable rather than a one-off correction, the
+  `rules across categories` phrasing, the `SECURITY.md` version line derived
+  from `__version__`, and the `CONTRIBUTING.md` instruction.
+
+## [0.6.3] - 2026-09-12
+
+### Changed
+
+- **README rewritten: 7,056 words to 1,300.** The 2026 median is 800-1,500 and a
+  reader decides in under thirty seconds. It was roughly five times too long,
+  and length was not the worst of it: **11 badges**, the first runnable command
+  at **line 69**, and bullets running eight to ten lines *defending a number*
+  before the reader knew what the tool did. The "Mechanical fix recipes: 11 of
+  348 (3.2%)" bullet argued its own scope for ten lines above the fold. That
+  reads as anxious. The content was good and is all still here; it was in the
+  wrong place.
+
+  The category table was the single biggest offender — its "What it detects"
+  cells ran past 2,000 characters each, one cell longer than a whole good
+  README. Compressed to a phrase per category, with the detail in the rule
+  reference.
+
+  Order now follows the inverted pyramid: name, badges, demo, `pip install` and
+  a scan inside the first screen, then what it finds, then why not a hosted
+  scanner, then the evidence.
+
+- **42 relative links removed from the README.** `pyproject.toml` sets
+  `readme = "README.md"`, so the README *is* the PyPI long description, and PyPI
+  does not resolve repository-relative paths. Every one of those 42 rendered as
+  a broken link on the page where someone decides whether to install. Verified
+  against the built wheel's `METADATA`: 0 remaining.
+
+- **`docs/` made navigable.** 55 markdown files with 9 in the mkdocs nav and 14
+  orphans at top level. That is *why* the README was overloaded: content piled
+  onto the front page because there was nowhere reachable to put it. The nav now
+  carries 23 pages in six groups, and the three remaining orphans are
+  intentionally internal stubs. New pages `docs/cli.md`, `docs/github-action.md`
+  and `docs/why.md` hold what left the README.
+
+- `Development Status :: 3 - Alpha` to `4 - Beta` in `pyproject.toml`. At v0.6.3
+  with 348 rules, signed releases and a published latency figure, Alpha was
+  inaccurate downward, and PyPI shows it. Added `Documentation` and `Changelog`
+  to `[project.urls]`, which PyPI renders as sidebar links.
+
+- Moved the OpenAI grant application to `docs/grants/`. `DEEP_ANALYSIS.md` and
+  `ROADMAP_2026.md` stay at root: both are wired into `check_counts.py`'s
+  exclusion list, a test and a workflow, so moving them buys a tidier listing at
+  the cost of guard churn.
+
+### Added
+
+- **`tests/test_readme_contract.py`** — 23 assertions, and the reason the
+  rewrite was safe to attempt.
+
+  Five scheduled jobs write into `README.md` by locating an HTML-comment
+  marker: `sync_rule_count.py`, `sync_scanner_count.py`, `sync_fp_badge.py`,
+  `gen_owasp_coverage.py` and `index_cadence.py`. **32 markers in 8 families.**
+  A prose edit that drops one takes that number out of automation.
+
+  Most fail loudly. `gen_owasp_coverage.py` does not: it returns False and
+  writes nothing when its markers are absent, has no `--check` mode, and its
+  tests only assert the module exits 0. Losing that marker would have frozen the
+  OWASP coverage table with nothing to notice — the same shape as the
+  release-time latency guard fixed in 0.5.2. It now has a test of its own.
+
+  The contract also holds the phrasings `check_counts.py` matches, so a future
+  reword cannot silently stop the count guard; asserts the README has no
+  relative link, because PyPI renders it; caps it at 2,500 words with a message
+  saying to move content to `docs/` rather than trim meaning; keeps Quick start
+  above line 40; and checks every docs link and mkdocs nav target resolves to a
+  file.
+
+  Verified by running all six writers twice and diffing: byte-identical.
+
 ## [0.6.2] - 2026-09-12
 
 Promises this project made in shipped code and then outlived. Found by a

{agent_audit_kit-0.6.2 → agent_audit_kit-0.6.4}/CITATION.cff

@@ -34,7 +34,7 @@ authors:
 repository-code: "https://github.com/sattyamjjain/agent-audit-kit"
 url: "https://github.com/sattyamjjain/agent-audit-kit"
 license: Apache-2.0
-version: "0.6.2"
+version: "0.6.4"
 date-released: "2026-09-12"
 keywords:
   - model-context-protocol

{agent_audit_kit-0.6.2 → agent_audit_kit-0.6.4}/CONTRIBUTING.md

@@ -65,7 +65,10 @@ mypy agent_audit_kit
 2. Assign a unique rule ID following the pattern `AAK-<CATEGORY>-<NNN>`.
 3. Include `severity`, `message`, `remediation`, and `owasp_ref` fields.
 4. Add tests in `tests/` that cover both detection and non-detection cases.
-5. Update `docs/rules.md` with the new rule.
+5. Regenerate the docs, do not hand-edit them: `python scripts/sync_rule_count.py`
+   rewrites the rule table in `docs/rules.md` between its `BEGIN/END rules-summary`
+   markers, and the counts in `README.md` and `__init__.py`. Editing that table by
+   hand works until the next sync overwrites it.
 
 ## Pull Request Process
 

agent_audit_kit-0.6.4/PKG-INFO

@@ -0,0 +1,251 @@
+Metadata-Version: 2.5
+Name: agent-audit-kit
+Version: 0.6.4
+Summary: Security scanner for MCP-connected AI agent pipelines
+Project-URL: Homepage, https://github.com/sattyamjjain/agent-audit-kit
+Project-URL: Repository, https://github.com/sattyamjjain/agent-audit-kit
+Project-URL: Issues, https://github.com/sattyamjjain/agent-audit-kit/issues
+Project-URL: Documentation, https://sattyamjjain.github.io/agent-audit-kit/
+Project-URL: Changelog, https://github.com/sattyamjjain/agent-audit-kit/blob/main/CHANGELOG.md
+Author: AgentAuditKit Contributors
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: ai-agents,claude-code,mcp,scanner,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.9
+Requires-Dist: click>=8.1
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: tomli>=2.0; python_version < '3.11'
+Provides-Extra: dev
+Requires-Dist: mypy>=1.0; extra == 'dev'
+Requires-Dist: pytest-cov>=4.0; extra == 'dev'
+Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: ruff<0.17,>=0.15; extra == 'dev'
+Requires-Dist: tree-sitter-typescript>=0.21; extra == 'dev'
+Requires-Dist: tree-sitter>=0.21; extra == 'dev'
+Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
+Provides-Extra: taint
+Requires-Dist: tree-sitter-typescript>=0.21; extra == 'taint'
+Requires-Dist: tree-sitter>=0.21; extra == 'taint'
+Description-Content-Type: text/markdown
+
+<h1 align="center">AgentAuditKit</h1>
+
+<p align="center"><strong>The missing <code>npm audit</code> for AI agents.</strong></p>
+
+<p align="center">
+  <a href="https://github.com/sattyamjjain/agent-audit-kit/actions/workflows/ci.yml"><img src="https://github.com/sattyamjjain/agent-audit-kit/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <a href="https://pypi.org/project/agent-audit-kit/"><img src="https://img.shields.io/pypi/v/agent-audit-kit.svg" alt="PyPI"></a>
+  <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.9+-blue.svg" alt="Python 3.9+"></a>
+  <a href="https://www.apache.org/licenses/LICENSE-2.0"><img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License: Apache-2.0"></a>
+  <a href="#what-it-finds"><img src="https://img.shields.io/badge/rules-348-blue.svg" alt="Rules: 348"></a>
+  <a href="https://github.com/sattyamjjain/agent-audit-kit/blob/main/research/state-of-mcp-2026/REPORT.md#how-to-cite-this-report"><img src="https://img.shields.io/badge/cite-State_of_MCP_Security_2026_v1.0-informational.svg" alt="Cite the State of MCP Security 2026 report, version 1.0"></a>
+  <!-- fp-badge --><a href="benchmarks/false_positive/RESULTS.md"><img src="https://img.shields.io/badge/benign--slice%20536%20configs-HIGH%2FCRIT%20FP%200%2F1-brightgreen.svg" alt="Benign-slice false-positive measurement: 536 configs scanned, 0 of 1 HIGH/CRITICAL findings were false positives (0.0%)"></a><!-- /fp-badge -->
+</p>
+
+<p align="center">
+  <a href="https://asciinema.org/a/9X7N1ztuuIYi9T2P" target="_blank"><img src="https://asciinema.org/a/9X7N1ztuuIYi9T2P.svg" alt="AgentAuditKit demo" width="700"/></a>
+</p>
+
+Static security scanner for MCP-connected AI agent pipelines. It finds
+misconfigurations, hardcoded secrets, tool poisoning, rug pulls, trust-boundary
+violations and tainted data flows across **10 agent platforms** — and emits the
+compliance evidence an auditor asks for afterwards.
+
+It runs fully offline. No account, no telemetry, no model in the loop.
+
+## Quick start
+
+```bash
+pip install agent-audit-kit
+agent-audit-kit scan .
+```
+
+`aak` is installed as a shorthand for the same command.
+
+As a pre-commit hook:
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/sattyamjjain/agent-audit-kit
+    rev: v0.6.4
+    hooks:
+      - id: agent-audit-kit
+```
+
+In CI:
+
+```yaml
+# .github/workflows/agent-security.yml
+- uses: sattyamjjain/agent-audit-kit@v0.6.4
+  with:
+    severity: medium
+    fail-on: high
+    upload-sarif: true
+```
+
+The action writes SARIF; upload it with `github/codeql-action/upload-sarif`
+to land findings in the GitHub Security tab. Full
+[GitHub Action reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/github-action.md) ·
+[CLI reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/cli.md) ·
+[pre-commit hook](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/ci-cd.md).
+
+## What it finds
+
+<!-- rule-count:total -->348<!-- /rule-count --> rules across 14 security categories:
+
+| Category | Rules | What it detects |
+|----------|:-----:|-----------------|
+| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->67<!-- /category-count --> | Missing auth, wildcard CORS, `0.0.0.0` binds, SSRF, OAuth 2.1 and RFC 9728 gaps |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->110<!-- /category-count --> | Unpinned packages, typosquats, install scripts, and verified CVE version pins |
+| **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->30<!-- /category-count --> | Invisible Unicode, prompt injection in tool and parameter descriptions, rug pulls |
+| **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Provider keys, tokens in configs and env files, credentials in logs |
+| **Agent Config** | <!-- category-count:AGENT_CONFIG -->18<!-- /category-count --> | Permission escalation, auto-approve, headless trust in CI |
+| **A2A Protocol** | <!-- category-count:A2A_PROTOCOL -->13<!-- /category-count --> | Missing mutual auth, unbounded delegation, transitive trust |
+| **Hook Injection** | <!-- category-count:HOOK_INJECTION -->17<!-- /category-count --> | Hook RCE, exfiltration through lifecycle hooks |
+| **Taint Analysis** | <!-- category-count:TAINT_ANALYSIS -->14<!-- /category-count --> | `@tool` parameters reaching shell, SQL, filesystem and network sinks |
+| **Transport Security** | <!-- category-count:TRANSPORT_SECURITY -->15<!-- /category-count --> | Cleartext transports, DNS rebinding, session and body-size limits |
+| **Legal Compliance** | <!-- category-count:LEGAL_COMPLIANCE -->19<!-- /category-count --> | Copyleft licences, PII surface, and regional AI duties |
+| **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->17<!-- /category-count --> | Project-scoped trust, untrusted workspace escalation |
+| **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 server cards |
+| **Composition** | <!-- category-count:COMPOSITION -->3<!-- /category-count --> | Risk that exists only between components, not in any one of them |
+| **Agentic Skills** | <!-- category-count:AGENTIC_SKILL -->3<!-- /category-count --> | OWASP Agentic Skills Top 10 surface in skill bundles |
+
+Every finding carries severity, evidence, a file and line, and remediation.
+Full detail per rule is in the [rule reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/rules.md).
+
+## Why not a hosted scanner
+
+- **Offline and deterministic.** Your code and secrets never leave the machine,
+  and the same input always yields the same findings — measured at
+  [20/20 identical runs, 0% variance](https://github.com/sattyamjjain/agent-audit-kit/blob/main/benchmarks/determinism/RESULTS.md).
+  A scanner with an LLM in the loop cannot promise that, which is what makes CI
+  diffs and audit re-runs stable here.
+- **Auditor-ready evidence, not just findings.** SARIF plus PDF evidence packs
+  mapped to 14 frameworks, a CycloneDX/SPDX SBOM, and an OpenVEX document that
+  joins to it on purl.
+- **Pin and verify.** `pin` fingerprints a tool surface at approval; `verify`
+  re-checks it afterwards. That is the only thing that catches a server which
+  behaves until it does not — see the
+  [Deadbugz case study](https://github.com/sattyamjjain/agent-audit-kit/blob/main/examples/case-studies/deadbugz-delayed-metadata/README.md).
+
+Precision is measured rather than asserted: a hand-adjudicated
+[benign-slice false-positive rate](https://github.com/sattyamjjain/agent-audit-kit/blob/main/benchmarks/false_positive/RESULTS.md)
+with a Wilson interval, and any offending rule filed as an issue.
+
+## What we measured
+
+From the [State of MCP Security 2026](https://github.com/sattyamjjain/agent-audit-kit/blob/main/research/state-of-mcp-2026/REPORT.md)
+report ([how to cite](https://github.com/sattyamjjain/agent-audit-kit/blob/main/research/state-of-mcp-2026/REPORT.md#how-to-cite-this-report)):
+
+- <!-- report:corpus -->2,303<!-- /report --> distinct public MCP configs scanned.
+- <!-- report:noauth-pct -->52.1<!-- /report -->% (<!-- report:noauth-n -->1,200<!-- /report -->) declare a remote server with **no authentication**.
+- <!-- report:rfc9728-n -->0<!-- /report --> serve RFC 9728 Protected-Resource-Metadata discovery.
+- <!-- report:inline-auth-pct -->100<!-- /report -->% (<!-- report:inline-auth-n -->424<!-- /report -->/<!-- report:inline-auth-d -->424<!-- /report -->) of inline-auth remote configs **hardcode a static credential**.
+
+These regenerate from `results.json` and are asserted in CI, so they cannot
+drift from the report.
+
+## Compliance evidence
+
+PDF and text evidence packs mapped to 14 frameworks, including two already in
+force that most scanners do not carry: **EU AI Act Article 50** (transparency,
+since 2026-08-02) and **Colorado SB 26-189 ADMT** (effective 2027-01-01).
+
+```bash
+agent-audit-kit report . --framework eu-ai-act --format pdf
+agent-audit-kit sbom . --format cyclonedx -o sbom.cdx.json
+agent-audit-kit vex  . -o vex.openvex.json
+```
+
+Every control row cites a real clause, and a row the scanner cannot evidence
+says so instead of printing a tick. Full list of the <!-- rule-count:total -->348<!-- /rule-count -->
+rules mapped to 14 frameworks: [compliance reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/owasp-mapping.md).
+
+### OWASP Agentic Top 10 coverage
+
+<!-- owasp-coverage:start -->
+| ASI | Title | # rules |
+| --- | --- | --- |
+| **ASI01** | Goal Hijack | 14 |
+| **ASI02** | Tool Misuse | 48 |
+| **ASI03** | Memory Poisoning | 73 |
+| **ASI04** | Identity & Privilege Abuse | 74 |
+| **ASI05** | Cascading Failures | 56 |
+| **ASI06** | Unauthorized Capability Acquisition | 48 |
+| **ASI07** | Plan Injection | 9 |
+| **ASI08** | Agent Communication Poisoning | 5 |
+| **ASI09** | Resource Abuse | 18 |
+| **ASI10** | Supply-Chain | 21 |
+<!-- owasp-coverage:end -->
+
+Complete mapping for OWASP Agentic, OWASP MCP, and the NSA MCP CSI is in the
+[standards crosswalk](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/crosswalk/nsa-csi-owasp-agentic.md).
+
+## MCP Security Index
+
+A public leaderboard of scanned public MCP servers, with per-server grade cards
+and a 90-day [disclosure policy](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/disclosure-policy.md):
+[sattyamjjain.github.io/agent-audit-kit](https://sattyamjjain.github.io/agent-audit-kit/).
+
+<!-- index-cadence -->Last published snapshot: **2026-09-07** (5 snapshots in [`history.json`](https://sattyamjjain.github.io/agent-audit-kit/data/history.json)). The build fails if this date falls more than 10 days behind, so a stalled index reports itself.<!-- /index-cadence -->
+
+## CVE response
+
+Newly disclosed MCP CVEs are triaged and turned into rules as they land,
+surfaced by an NVD watcher and logged in
+[CHANGELOG.cves.md](https://github.com/sattyamjjain/agent-audit-kit/blob/main/CHANGELOG.cves.md). The measured disclosure-to-rule
+latency is published in [docs/cve-latency.md](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/cve-latency.md) and
+regenerated from the ledger, not asserted.
+
+## Under the hood
+
+<!-- scanner-count:total -->103<!-- /scanner-count --> scanner modules: AST-based taint analysis for
+Python, and regex dangerous-sink scanners for TypeScript/JavaScript and Rust.
+<!-- test-count:total -->2,373<!-- /test-count --> tests. 27 CLI commands. Releases are Sigstore-signed
+and ship a deterministic rule bundle.
+
+Mechanical fix recipes cover <!-- fix-recipe-coverage:count -->11<!-- /fix-recipe-coverage --> of <!-- rule-count:total -->348<!-- /rule-count --> rules
+(<!-- fix-recipe-coverage:pct -->3.2<!-- /fix-recipe-coverage -->%), applied by `agent-audit-kit fix`. That is a scope
+decision, not a coverage gap: a recipe ships only where the remediation is
+**deterministic and one-line** — exactly one correct edit, confirmable from the
+diff. Everything else stays advisory on purpose, because a fix that needs
+judgement is a fix that can be wrong silently. [Why the rest stay
+advisory](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/why.md).
+
+## Documentation
+
+[Getting started](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/getting-started.md) ·
+[CLI reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/cli.md) ·
+[Rule reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/rules.md) ·
+[CI/CD](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/ci-cd.md) ·
+[Comparison with other scanners](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/comparisons.md) ·
+[All documentation](https://github.com/sattyamjjain/agent-audit-kit/tree/main/docs)
+
+## Contributing
+
+Issues and pull requests are welcome — see
+[CONTRIBUTING.md](https://github.com/sattyamjjain/agent-audit-kit/blob/main/CONTRIBUTING.md). Adding a rule means a rule definition, a
+scanner, and fixtures in both directions; `agent-audit-kit rule lint` checks the
+registry invariants.
+
+## Security
+
+Report vulnerabilities per [SECURITY.md](https://github.com/sattyamjjain/agent-audit-kit/blob/main/SECURITY.md). AgentAuditKit
+publishes no fixed CVE-response SLA; it publishes the measured latency instead.
+
+## License
+
+Apache-2.0. See [LICENSE](https://github.com/sattyamjjain/agent-audit-kit/blob/main/LICENSE). Apache-2.0 carries an explicit patent
+grant, which the organisations that adopt a security tool tend to ask about.

agent_audit_kit-0.6.4/README.md

@@ -0,0 +1,210 @@
+<h1 align="center">AgentAuditKit</h1>
+
+<p align="center"><strong>The missing <code>npm audit</code> for AI agents.</strong></p>
+
+<p align="center">
+  <a href="https://github.com/sattyamjjain/agent-audit-kit/actions/workflows/ci.yml"><img src="https://github.com/sattyamjjain/agent-audit-kit/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <a href="https://pypi.org/project/agent-audit-kit/"><img src="https://img.shields.io/pypi/v/agent-audit-kit.svg" alt="PyPI"></a>
+  <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.9+-blue.svg" alt="Python 3.9+"></a>
+  <a href="https://www.apache.org/licenses/LICENSE-2.0"><img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License: Apache-2.0"></a>
+  <a href="#what-it-finds"><img src="https://img.shields.io/badge/rules-348-blue.svg" alt="Rules: 348"></a>
+  <a href="https://github.com/sattyamjjain/agent-audit-kit/blob/main/research/state-of-mcp-2026/REPORT.md#how-to-cite-this-report"><img src="https://img.shields.io/badge/cite-State_of_MCP_Security_2026_v1.0-informational.svg" alt="Cite the State of MCP Security 2026 report, version 1.0"></a>
+  <!-- fp-badge --><a href="benchmarks/false_positive/RESULTS.md"><img src="https://img.shields.io/badge/benign--slice%20536%20configs-HIGH%2FCRIT%20FP%200%2F1-brightgreen.svg" alt="Benign-slice false-positive measurement: 536 configs scanned, 0 of 1 HIGH/CRITICAL findings were false positives (0.0%)"></a><!-- /fp-badge -->
+</p>
+
+<p align="center">
+  <a href="https://asciinema.org/a/9X7N1ztuuIYi9T2P" target="_blank"><img src="https://asciinema.org/a/9X7N1ztuuIYi9T2P.svg" alt="AgentAuditKit demo" width="700"/></a>
+</p>
+
+Static security scanner for MCP-connected AI agent pipelines. It finds
+misconfigurations, hardcoded secrets, tool poisoning, rug pulls, trust-boundary
+violations and tainted data flows across **10 agent platforms** — and emits the
+compliance evidence an auditor asks for afterwards.
+
+It runs fully offline. No account, no telemetry, no model in the loop.
+
+## Quick start
+
+```bash
+pip install agent-audit-kit
+agent-audit-kit scan .
+```
+
+`aak` is installed as a shorthand for the same command.
+
+As a pre-commit hook:
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/sattyamjjain/agent-audit-kit
+    rev: v0.6.4
+    hooks:
+      - id: agent-audit-kit
+```
+
+In CI:
+
+```yaml
+# .github/workflows/agent-security.yml
+- uses: sattyamjjain/agent-audit-kit@v0.6.4
+  with:
+    severity: medium
+    fail-on: high
+    upload-sarif: true
+```
+
+The action writes SARIF; upload it with `github/codeql-action/upload-sarif`
+to land findings in the GitHub Security tab. Full
+[GitHub Action reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/github-action.md) ·
+[CLI reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/cli.md) ·
+[pre-commit hook](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/ci-cd.md).
+
+## What it finds
+
+<!-- rule-count:total -->348<!-- /rule-count --> rules across 14 security categories:
+
+| Category | Rules | What it detects |
+|----------|:-----:|-----------------|
+| **MCP Configuration** | <!-- category-count:MCP_CONFIG -->67<!-- /category-count --> | Missing auth, wildcard CORS, `0.0.0.0` binds, SSRF, OAuth 2.1 and RFC 9728 gaps |
+| **Supply Chain** | <!-- category-count:SUPPLY_CHAIN -->110<!-- /category-count --> | Unpinned packages, typosquats, install scripts, and verified CVE version pins |
+| **Tool Poisoning** | <!-- category-count:TOOL_POISONING -->30<!-- /category-count --> | Invisible Unicode, prompt injection in tool and parameter descriptions, rug pulls |
+| **Secret Exposure** | <!-- category-count:SECRET_EXPOSURE -->18<!-- /category-count --> | Provider keys, tokens in configs and env files, credentials in logs |
+| **Agent Config** | <!-- category-count:AGENT_CONFIG -->18<!-- /category-count --> | Permission escalation, auto-approve, headless trust in CI |
+| **A2A Protocol** | <!-- category-count:A2A_PROTOCOL -->13<!-- /category-count --> | Missing mutual auth, unbounded delegation, transitive trust |
+| **Hook Injection** | <!-- category-count:HOOK_INJECTION -->17<!-- /category-count --> | Hook RCE, exfiltration through lifecycle hooks |
+| **Taint Analysis** | <!-- category-count:TAINT_ANALYSIS -->14<!-- /category-count --> | `@tool` parameters reaching shell, SQL, filesystem and network sinks |
+| **Transport Security** | <!-- category-count:TRANSPORT_SECURITY -->15<!-- /category-count --> | Cleartext transports, DNS rebinding, session and body-size limits |
+| **Legal Compliance** | <!-- category-count:LEGAL_COMPLIANCE -->19<!-- /category-count --> | Copyleft licences, PII surface, and regional AI duties |
+| **Trust Boundaries** | <!-- category-count:TRUST_BOUNDARY -->17<!-- /category-count --> | Project-scoped trust, untrusted workspace escalation |
+| **MCP Server Card** | <!-- category-count:MCP_SERVER_CARD -->4<!-- /category-count --> | Static audit of SEP-1649 server cards |
+| **Composition** | <!-- category-count:COMPOSITION -->3<!-- /category-count --> | Risk that exists only between components, not in any one of them |
+| **Agentic Skills** | <!-- category-count:AGENTIC_SKILL -->3<!-- /category-count --> | OWASP Agentic Skills Top 10 surface in skill bundles |
+
+Every finding carries severity, evidence, a file and line, and remediation.
+Full detail per rule is in the [rule reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/rules.md).
+
+## Why not a hosted scanner
+
+- **Offline and deterministic.** Your code and secrets never leave the machine,
+  and the same input always yields the same findings — measured at
+  [20/20 identical runs, 0% variance](https://github.com/sattyamjjain/agent-audit-kit/blob/main/benchmarks/determinism/RESULTS.md).
+  A scanner with an LLM in the loop cannot promise that, which is what makes CI
+  diffs and audit re-runs stable here.
+- **Auditor-ready evidence, not just findings.** SARIF plus PDF evidence packs
+  mapped to 14 frameworks, a CycloneDX/SPDX SBOM, and an OpenVEX document that
+  joins to it on purl.
+- **Pin and verify.** `pin` fingerprints a tool surface at approval; `verify`
+  re-checks it afterwards. That is the only thing that catches a server which
+  behaves until it does not — see the
+  [Deadbugz case study](https://github.com/sattyamjjain/agent-audit-kit/blob/main/examples/case-studies/deadbugz-delayed-metadata/README.md).
+
+Precision is measured rather than asserted: a hand-adjudicated
+[benign-slice false-positive rate](https://github.com/sattyamjjain/agent-audit-kit/blob/main/benchmarks/false_positive/RESULTS.md)
+with a Wilson interval, and any offending rule filed as an issue.
+
+## What we measured
+
+From the [State of MCP Security 2026](https://github.com/sattyamjjain/agent-audit-kit/blob/main/research/state-of-mcp-2026/REPORT.md)
+report ([how to cite](https://github.com/sattyamjjain/agent-audit-kit/blob/main/research/state-of-mcp-2026/REPORT.md#how-to-cite-this-report)):
+
+- <!-- report:corpus -->2,303<!-- /report --> distinct public MCP configs scanned.
+- <!-- report:noauth-pct -->52.1<!-- /report -->% (<!-- report:noauth-n -->1,200<!-- /report -->) declare a remote server with **no authentication**.
+- <!-- report:rfc9728-n -->0<!-- /report --> serve RFC 9728 Protected-Resource-Metadata discovery.
+- <!-- report:inline-auth-pct -->100<!-- /report -->% (<!-- report:inline-auth-n -->424<!-- /report -->/<!-- report:inline-auth-d -->424<!-- /report -->) of inline-auth remote configs **hardcode a static credential**.
+
+These regenerate from `results.json` and are asserted in CI, so they cannot
+drift from the report.
+
+## Compliance evidence
+
+PDF and text evidence packs mapped to 14 frameworks, including two already in
+force that most scanners do not carry: **EU AI Act Article 50** (transparency,
+since 2026-08-02) and **Colorado SB 26-189 ADMT** (effective 2027-01-01).
+
+```bash
+agent-audit-kit report . --framework eu-ai-act --format pdf
+agent-audit-kit sbom . --format cyclonedx -o sbom.cdx.json
+agent-audit-kit vex  . -o vex.openvex.json
+```
+
+Every control row cites a real clause, and a row the scanner cannot evidence
+says so instead of printing a tick. Full list of the <!-- rule-count:total -->348<!-- /rule-count -->
+rules mapped to 14 frameworks: [compliance reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/owasp-mapping.md).
+
+### OWASP Agentic Top 10 coverage
+
+<!-- owasp-coverage:start -->
+| ASI | Title | # rules |
+| --- | --- | --- |
+| **ASI01** | Goal Hijack | 14 |
+| **ASI02** | Tool Misuse | 48 |
+| **ASI03** | Memory Poisoning | 73 |
+| **ASI04** | Identity & Privilege Abuse | 74 |
+| **ASI05** | Cascading Failures | 56 |
+| **ASI06** | Unauthorized Capability Acquisition | 48 |
+| **ASI07** | Plan Injection | 9 |
+| **ASI08** | Agent Communication Poisoning | 5 |
+| **ASI09** | Resource Abuse | 18 |
+| **ASI10** | Supply-Chain | 21 |
+<!-- owasp-coverage:end -->
+
+Complete mapping for OWASP Agentic, OWASP MCP, and the NSA MCP CSI is in the
+[standards crosswalk](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/crosswalk/nsa-csi-owasp-agentic.md).
+
+## MCP Security Index
+
+A public leaderboard of scanned public MCP servers, with per-server grade cards
+and a 90-day [disclosure policy](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/disclosure-policy.md):
+[sattyamjjain.github.io/agent-audit-kit](https://sattyamjjain.github.io/agent-audit-kit/).
+
+<!-- index-cadence -->Last published snapshot: **2026-09-07** (5 snapshots in [`history.json`](https://sattyamjjain.github.io/agent-audit-kit/data/history.json)). The build fails if this date falls more than 10 days behind, so a stalled index reports itself.<!-- /index-cadence -->
+
+## CVE response
+
+Newly disclosed MCP CVEs are triaged and turned into rules as they land,
+surfaced by an NVD watcher and logged in
+[CHANGELOG.cves.md](https://github.com/sattyamjjain/agent-audit-kit/blob/main/CHANGELOG.cves.md). The measured disclosure-to-rule
+latency is published in [docs/cve-latency.md](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/cve-latency.md) and
+regenerated from the ledger, not asserted.
+
+## Under the hood
+
+<!-- scanner-count:total -->103<!-- /scanner-count --> scanner modules: AST-based taint analysis for
+Python, and regex dangerous-sink scanners for TypeScript/JavaScript and Rust.
+<!-- test-count:total -->2,373<!-- /test-count --> tests. 27 CLI commands. Releases are Sigstore-signed
+and ship a deterministic rule bundle.
+
+Mechanical fix recipes cover <!-- fix-recipe-coverage:count -->11<!-- /fix-recipe-coverage --> of <!-- rule-count:total -->348<!-- /rule-count --> rules
+(<!-- fix-recipe-coverage:pct -->3.2<!-- /fix-recipe-coverage -->%), applied by `agent-audit-kit fix`. That is a scope
+decision, not a coverage gap: a recipe ships only where the remediation is
+**deterministic and one-line** — exactly one correct edit, confirmable from the
+diff. Everything else stays advisory on purpose, because a fix that needs
+judgement is a fix that can be wrong silently. [Why the rest stay
+advisory](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/why.md).
+
+## Documentation
+
+[Getting started](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/getting-started.md) ·
+[CLI reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/cli.md) ·
+[Rule reference](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/rules.md) ·
+[CI/CD](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/ci-cd.md) ·
+[Comparison with other scanners](https://github.com/sattyamjjain/agent-audit-kit/blob/main/docs/comparisons.md) ·
+[All documentation](https://github.com/sattyamjjain/agent-audit-kit/tree/main/docs)
+
+## Contributing
+
+Issues and pull requests are welcome — see
+[CONTRIBUTING.md](https://github.com/sattyamjjain/agent-audit-kit/blob/main/CONTRIBUTING.md). Adding a rule means a rule definition, a
+scanner, and fixtures in both directions; `agent-audit-kit rule lint` checks the
+registry invariants.
+
+## Security
+
+Report vulnerabilities per [SECURITY.md](https://github.com/sattyamjjain/agent-audit-kit/blob/main/SECURITY.md). AgentAuditKit
+publishes no fixed CVE-response SLA; it publishes the measured latency instead.
+
+## License
+
+Apache-2.0. See [LICENSE](https://github.com/sattyamjjain/agent-audit-kit/blob/main/LICENSE). Apache-2.0 carries an explicit patent
+grant, which the organisations that adopt a security tool tend to ask about.