agentmemorytaintgap 0.1.0__py3-none-any.whl

agentmemorytaintgap/__init__.py

@@ -0,0 +1,7 @@
+"""agentmemorytaintgap - flag untrusted content persisted into agent long-term memory."""
+
+from .scanner import scan_file, scan_source, Finding
+
+__all__ = ["scan_file", "scan_source", "Finding"]
+
+__version__ = "0.1.0"

agentmemorytaintgap/cli.py

@@ -0,0 +1,100 @@
+"""agentmemorytaintgap command-line interface."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from .scanner import scan_file
+
+
+def _iter_python_files(paths: list[str]) -> list[Path]:
+    files: list[Path] = []
+    for raw in paths:
+        p = Path(raw)
+        if p.is_dir():
+            files.extend(sorted(p.rglob("*.py")))
+        elif p.suffix == ".py":
+            files.append(p)
+    return files
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="agentmemorytaintgap",
+        description=(
+            "Flag AI agent memory-write calls that persist untrusted tool/"
+            "external/user content into long-term memory with no sanitization "
+            "or provenance marker (agent memory poisoning)."
+        ),
+    )
+    parser.add_argument(
+        "paths", nargs="+", help="Python files or directories to scan"
+    )
+    parser.add_argument(
+        "--json",
+        action="store_true",
+        help="Emit machine-readable JSON instead of human-readable text.",
+    )
+    parser.add_argument(
+        "--strict",
+        action="store_true",
+        help="Also fail (exit 1) when only AT002 warnings are present.",
+    )
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+
+    files = _iter_python_files(args.paths)
+    if not files:
+        print("agentmemorytaintgap: no Python files found", file=sys.stderr)
+        return 2
+
+    all_findings = []
+    had_error = False
+    for f in files:
+        try:
+            findings = scan_file(f)
+        except SyntaxError as exc:
+            print(f"agentmemorytaintgap: {f}: syntax error: {exc}", file=sys.stderr)
+            had_error = True
+            continue
+        all_findings.extend(findings)
+
+    if had_error:
+        return 2
+
+    blockers = [f for f in all_findings if f.rule == "AT001"]
+    warnings = [f for f in all_findings if f.rule == "AT002"]
+
+    if args.json:
+        payload = {
+            "findings": [f.to_dict() for f in all_findings],
+            "blockers": len(blockers),
+            "warnings": len(warnings),
+            "files_scanned": len(files),
+        }
+        print(json.dumps(payload, indent=2))
+    else:
+        for finding in all_findings:
+            print(str(finding))
+        if all_findings:
+            print(
+                f"\n{len(files)} file(s) scanned · {len(blockers)} blocker(s) · "
+                f"{len(warnings)} warning(s)"
+            )
+
+    if blockers:
+        return 1
+    if args.strict and warnings:
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

agentmemorytaintgap/scanner.py

@@ -0,0 +1,442 @@
+"""agentmemorytaintgap scanner.
+
+Static, AST-only detector for a specific AI-agent memory-safety gap:
+a *memory-write* call (something that persists content into a store that
+will be read back and fed into a FUTURE prompt as the agent's own trusted
+memory) that stores raw content sourced from an untrusted origin (a tool
+result, a raw user message, or external fetched content) with no
+provenance marker or sanitization step in between.
+
+This is deliberately a pragmatic, heuristic, single-hop, same-function-scope
+analysis — NOT full data-flow / taint tracking. See DETAILS.md for the exact
+scope and the honest false-positive/false-negative surface that results.
+"""
+
+from __future__ import annotations
+
+import ast
+from dataclasses import dataclass, field
+from pathlib import Path
+
+# ---------------------------------------------------------------------------
+# Recognition heuristics (all documented in DETAILS.md / README.md)
+# ---------------------------------------------------------------------------
+
+# Method names, called on *any* object, that are recognized memory-write
+# call shapes for common agent-memory frameworks (LangChain-shaped) or a
+# generic vector-store-as-memory pattern.
+MEMORY_WRITE_METHODS = {
+    "save_context",
+    "add_message",
+    "add_user_message",
+    "add_ai_message",
+}
+
+# Generic vector-store-as-memory methods. Only counted as a memory write
+# when called on a variable whose name matches MEMORY_VAR_HINTS below.
+VECTOR_STORE_METHODS = {"add", "upsert"}
+
+# Variable-name substrings that mark an object as a long-term memory /
+# vector store (heuristic naming signal, not a type check).
+MEMORY_VAR_HINTS = ("memory", "mem_store", "long_term")
+
+# Free function / bound method names that look like a custom "remember this"
+# helper.
+CUSTOM_MEMORY_FUNCS = {"remember", "store_memory", "save_memory"}
+
+# Attribute chains that look like a LangChain memory object's nested
+# chat_memory accessor, e.g. `memory.chat_memory.add_user_message(...)`.
+CHAT_MEMORY_ATTR = "chat_memory"
+
+# Function/method name substrings that look like a tool invocation.
+TOOL_CALL_METHODS = {"run", "invoke"}
+TOOL_VAR_HINTS = ("tool",)
+TOOL_DECORATOR_NAMES = {"tool"}
+
+# Function/method name substrings that look like the LLM's own generation
+# call (its output is the model's own words -> treated as trusted).
+LLM_CALL_METHODS = {"invoke", "generate", "predict", "run", "__call__"}
+LLM_VAR_HINTS = ("llm", "model", "chat")
+
+# Requests/HTTP-shaped external fetch calls.
+HTTP_MODULES = {"requests", "httpx", "aiohttp"}
+HTTP_METHODS = {"get", "post", "put", "patch", "delete"}
+FETCH_NAMES = {"fetch"}
+
+# Function names that look like sanitization / provenance tagging.
+SANITIZE_NAME_SUBSTRINGS = ("sanitize", "clean", "validate", "tag_source", "mark_untrusted")
+
+# Parameter names that look like raw user input.
+USER_INPUT_PARAM_HINTS = ("user_input", "user_message", "raw_input", "user_query", "message")
+
+
+@dataclass
+class Finding:
+    rule: str
+    severity: str  # "blocker" | "warning"
+    path: str
+    line: int
+    col: int
+    message: str
+    source_line: str = ""
+
+    def __str__(self) -> str:
+        tag = "BLOCKER" if self.severity == "blocker" else "WARNING"
+        loc = f"{self.path}:{self.line}:{self.col}"
+        out = f"{tag}  {self.rule} {loc}   {self.message}"
+        if self.source_line:
+            out += f"\n        {self.source_line.strip()}"
+        return out
+
+    def to_dict(self) -> dict:
+        return {
+            "rule": self.rule,
+            "severity": self.severity,
+            "path": self.path,
+            "line": self.line,
+            "col": self.col,
+            "message": self.message,
+            "source_line": self.source_line,
+        }
+
+
+def _name_of(node: ast.AST) -> str | None:
+    """Best-effort simple name for a Name/Attribute node's base identifier."""
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return _name_of(node.value)
+    return None
+
+
+def _call_func_name(call: ast.Call) -> str | None:
+    """The final attribute/name of the call target, e.g. 'add' for x.y.add(...)."""
+    func = call.func
+    if isinstance(func, ast.Name):
+        return func.id
+    if isinstance(func, ast.Attribute):
+        return func.attr
+    return None
+
+
+def _decorator_names(func_node: ast.AST) -> set[str]:
+    names = set()
+    decorators = getattr(func_node, "decorator_list", [])
+    for dec in decorators:
+        target = dec
+        if isinstance(target, ast.Call):
+            target = target.func
+        name = _call_func_name_or_name(target)
+        if name:
+            names.add(name)
+    return names
+
+
+def _call_func_name_or_name(node: ast.AST) -> str | None:
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return node.attr
+    return None
+
+
+def _is_tool_call(call: ast.Call) -> bool:
+    """Value came from a tool invocation: `.run()`/`.invoke()` on a
+    tool-named variable, or from calling a name that's a `@tool`-decorated
+    function elsewhere in the module (handled by caller with tool_func_names)."""
+    func = call.func
+    if isinstance(func, ast.Attribute) and func.attr in TOOL_CALL_METHODS:
+        base_name = _name_of(func.value)
+        if base_name and any(hint in base_name.lower() for hint in TOOL_VAR_HINTS):
+            return True
+    return False
+
+
+def _is_llm_call(call: ast.Call) -> bool:
+    """Value came from the LLM's own generation call -> trusted/safe."""
+    func = call.func
+    if isinstance(func, ast.Attribute) and func.attr in LLM_CALL_METHODS:
+        base_name = _name_of(func.value)
+        if base_name and any(hint in base_name.lower() for hint in LLM_VAR_HINTS):
+            return True
+    return False
+
+
+def _is_http_fetch_call(call: ast.Call) -> bool:
+    func = call.func
+    if isinstance(func, ast.Attribute) and func.attr in HTTP_METHODS:
+        base_name = _name_of(func.value)
+        if base_name and base_name.lower() in HTTP_MODULES:
+            return True
+    if isinstance(func, ast.Name) and func.id in FETCH_NAMES:
+        return True
+    return False
+
+
+def _is_sanitize_call_name(name: str | None) -> bool:
+    if not name:
+        return False
+    lowered = name.lower()
+    return any(sub in lowered for sub in SANITIZE_NAME_SUBSTRINGS)
+
+
+class _FunctionAnalyzer:
+    """Analyzes a single function body for memory-write calls and tries to
+    trace each write's stored value back to a trusted/untrusted/unknown
+    origin, single-hop, within this function's own scope only."""
+
+    def __init__(self, func_node, path: str, source_lines: list[str], tool_func_names: set[str]):
+        self.func_node = func_node
+        self.path = path
+        self.source_lines = source_lines
+        self.tool_func_names = tool_func_names
+        self.findings: list[Finding] = []
+        # var name -> "untrusted" | "trusted" | "unknown" (last assignment wins,
+        # this is intentionally simple/local, not a full CFG).
+        self.origins: dict[str, str] = {}
+        self.sanitized_vars: set[str] = set()
+        self.param_names = {a.arg for a in func_node.args.args}
+
+    def analyze(self) -> list[Finding]:
+        for stmt in ast.walk(self.func_node):
+            if isinstance(stmt, (ast.Assign, ast.AnnAssign)) and stmt.value is not None:
+                self._record_assignment(stmt)
+            elif isinstance(stmt, ast.Expr) and isinstance(stmt.value, ast.Call):
+                self._maybe_record_sanitize_call(stmt.value)
+
+        for stmt in ast.walk(self.func_node):
+            if isinstance(stmt, ast.Call):
+                self._check_memory_write(stmt)
+
+        return self.findings
+
+    def _record_assignment(self, stmt) -> None:
+        targets = stmt.targets if isinstance(stmt, ast.Assign) else [stmt.target]
+        value = stmt.value
+        origin = self._classify_value_origin(value)
+        for t in targets:
+            name = _name_of(t)
+            if name:
+                self.origins[name] = origin
+
+    def _maybe_record_sanitize_call(self, call: ast.Call) -> None:
+        name = _call_func_name(call)
+        if _is_sanitize_call_name(name):
+            for arg in call.args:
+                arg_name = _name_of(arg)
+                if arg_name:
+                    self.sanitized_vars.add(arg_name)
+
+    def _classify_value_origin(self, value: ast.AST) -> str:
+        """Classify a single expression's origin as trusted/untrusted/unknown,
+        single hop (does not recurse into further variable lookups)."""
+        if isinstance(value, ast.Call):
+            name = _call_func_name(value)
+            if _is_sanitize_call_name(name):
+                return "trusted"
+            if _is_llm_call(value):
+                return "trusted"
+            if _is_tool_call(value):
+                return "untrusted"
+            if _is_http_fetch_call(value):
+                return "untrusted"
+            if name and name in self.tool_func_names:
+                return "untrusted"
+            return "unknown"
+        if isinstance(value, ast.Name):
+            if value.id in self.origins:
+                return self.origins[value.id]
+            if value.id in self.param_names:
+                if any(hint in value.id.lower() for hint in USER_INPUT_PARAM_HINTS):
+                    return "untrusted"
+                return "unknown"
+            return "unknown"
+        if isinstance(value, ast.Attribute):
+            # e.g. response.text -> resolve the base variable's origin.
+            base = _name_of(value)
+            if base is not None:
+                return self._resolve_name_origin(base)
+            return "unknown"
+        if isinstance(value, ast.JoinedStr):
+            # f-string: inspect embedded values for a clearly untrusted piece.
+            classes = set()
+            for part in value.values:
+                if isinstance(part, ast.FormattedValue):
+                    classes.add(self._classify_value_origin(part.value))
+            if "untrusted" in classes:
+                return "untrusted"
+            if classes == {"trusted"}:
+                return "trusted"
+            return "unknown"
+        return "unknown"
+
+    def _resolve_name_origin(self, name: str) -> str:
+        if name in self.origins:
+            return self.origins[name]
+        if name in self.param_names:
+            if any(hint in name.lower() for hint in USER_INPUT_PARAM_HINTS):
+                return "untrusted"
+            return "unknown"
+        return "unknown"
+
+    def _resolve_arg_origin(self, arg: ast.AST) -> str:
+        """Resolve a memory-write call's argument expression to an origin,
+        single hop: either classify it directly, or if it's a bare Name,
+        look up how it was last assigned in this function."""
+        if isinstance(arg, ast.Name):
+            return self._resolve_name_origin(arg.id)
+        return self._classify_value_origin(arg)
+
+    def _arg_var_names(self, arg: ast.AST) -> set[str]:
+        names = set()
+        for node in ast.walk(arg):
+            if isinstance(node, ast.Name):
+                names.add(node.id)
+        return names
+
+    def _all_call_args(self, call: ast.Call) -> list[ast.AST]:
+        """The content-bearing argument expression(s) of a memory-write call.
+
+        Only the *last* positional argument is treated as the stored content
+        (this matches e.g. `save_context(inputs, outputs)`, where `outputs`
+        is what gets remembered as the agent's own record; the leading
+        argument(s) are typically bookkeeping like the original input echo),
+        plus any keyword arguments. Dict-literal arguments are unwrapped to
+        their value expressions (so `{"output": tool_result}` yields
+        `tool_result`, not the dict itself)."""
+        raw: list[ast.AST] = []
+        if call.args:
+            raw.append(call.args[-1])
+        raw.extend(kw.value for kw in call.keywords)
+
+        leaves: list[ast.AST] = []
+        for expr in raw:
+            if isinstance(expr, ast.Dict):
+                leaves.extend(v for v in expr.values if v is not None)
+            else:
+                leaves.append(expr)
+        return leaves
+
+    def _is_memory_write_call(self, call: ast.Call) -> tuple[bool, list[ast.AST]]:
+        """Returns (is_memory_write, candidate content expressions) if this
+        call matches a recognized memory-write shape."""
+        func = call.func
+        if not isinstance(func, ast.Attribute):
+            # Free function call: custom memory pattern, e.g. remember(x)
+            if isinstance(func, ast.Name) and func.id in CUSTOM_MEMORY_FUNCS:
+                return True, self._all_call_args(call)
+            return False, []
+
+        method_name = func.attr
+
+        # LangChain-shaped .save_context(...) / .add_message(...) / etc,
+        # including nested .chat_memory.add_user_message(...).
+        if method_name in MEMORY_WRITE_METHODS:
+            return True, self._all_call_args(call)
+
+        # Custom memory pattern as a bound method: obj.remember(...) etc.
+        if method_name in CUSTOM_MEMORY_FUNCS:
+            return True, self._all_call_args(call)
+
+        # Generic vector-store-as-memory: .add(...)/.upsert(...) on a
+        # memory-hinted variable name.
+        if method_name in VECTOR_STORE_METHODS:
+            base_name = _name_of(func.value)
+            if base_name and any(hint in base_name.lower() for hint in MEMORY_VAR_HINTS):
+                return True, self._all_call_args(call)
+
+        return False, []
+
+    def _check_memory_write(self, call: ast.Call) -> None:
+        is_write, args = self._is_memory_write_call(call)
+        if not is_write:
+            return
+
+        line = call.lineno
+        col = call.col_offset
+        src_line = self.source_lines[line - 1] if 0 < line <= len(self.source_lines) else ""
+
+        if not args:
+            return  # nothing to trace
+
+        all_arg_names: set[str] = set()
+        for arg in args:
+            all_arg_names |= self._arg_var_names(arg)
+        if all_arg_names & self.sanitized_vars:
+            return  # short-circuit: sanitized/tagged before the write
+
+        origins = {self._resolve_arg_origin(arg) for arg in args}
+        if "untrusted" in origins:
+            origin = "untrusted"
+        elif "unknown" in origins:
+            origin = "unknown"
+        else:
+            origin = "trusted"
+
+        if origin == "untrusted":
+            self.findings.append(
+                Finding(
+                    rule="AT001",
+                    severity="blocker",
+                    path=self.path,
+                    line=line,
+                    col=col,
+                    message=(
+                        "Memory-write call stores content traced back to an untrusted "
+                        "origin (tool output / external fetch / raw user input) with no "
+                        "sanitization or provenance-tagging call in this function "
+                        "(agent memory poisoning risk)."
+                    ),
+                    source_line=src_line,
+                )
+            )
+        elif origin == "unknown":
+            self.findings.append(
+                Finding(
+                    rule="AT002",
+                    severity="warning",
+                    path=self.path,
+                    line=line,
+                    col=col,
+                    message=(
+                        "Memory-write call stores a value whose origin could not be "
+                        "confidently traced (parameter with no clear origin signal, or "
+                        "a more-than-one-hop assignment chain) — worth a human glance."
+                    ),
+                    source_line=src_line,
+                )
+            )
+        # origin == "trusted" -> no finding (e.g. the LLM's own generated response)
+
+
+def _collect_tool_func_names(tree: ast.AST) -> set[str]:
+    """Collect names of functions decorated with a recognizable @tool
+    decorator anywhere in the module, so calls to them elsewhere can be
+    classified as untrusted tool output."""
+    names = set()
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            if TOOL_DECORATOR_NAMES & _decorator_names(node):
+                names.add(node.name)
+    return names
+
+
+def scan_source(source: str, path: str = "<string>") -> list[Finding]:
+    tree = ast.parse(source, filename=path)
+    source_lines = source.splitlines()
+    tool_func_names = _collect_tool_func_names(tree)
+
+    findings: list[Finding] = []
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            analyzer = _FunctionAnalyzer(node, path, source_lines, tool_func_names)
+            findings.extend(analyzer.analyze())
+
+    findings.sort(key=lambda f: (f.line, f.col))
+    return findings
+
+
+def scan_file(path: str | Path) -> list[Finding]:
+    p = Path(path)
+    source = p.read_text(encoding="utf-8")
+    return scan_source(source, path=str(path))

agentmemorytaintgap-0.1.0.dist-info/METADATA

@@ -0,0 +1,158 @@
+Metadata-Version: 2.5
+Name: agentmemorytaintgap
+Version: 0.1.0
+Summary: Flags AI agent code that persists untrusted tool/external/user content into long-term memory with no sanitization or provenance marker (agent memory poisoning).
+Author: Jay
+License: MIT
+License-File: LICENSE
+Keywords: ai-agents,linter,llm-security,memory-poisoning,prompt-injection,static-analysis
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# agentmemorytaintgap
+
+**Catch untrusted content being written into an AI agent's long-term memory as if it were a trusted fact.**
+
+Prompt injection usually gets pictured as a single bad turn: a poisoned web
+page or tool result sneaks into one prompt, the model says something wrong
+once, and the blast radius ends there. Agent **memory** breaks that
+assumption. A growing class of agent frameworks let the agent persist
+content — a tool result, a summary, a "fact" — into a long-term memory store
+that gets read back and fed into *every future prompt* as if it were the
+agent's own trusted conclusion. If the content that gets written was actually
+attacker-controlled (a malicious tool response, a crafted user message, a
+poisoned web page), and nothing strips or tags it first, the poison survives
+for the lifetime of that memory store — this is the "agent memory poisoning"
+risk that's an increasingly-discussed, distinct branch of prompt injection in
+2026.
+
+`agentmemorytaintgap` reads your source with Python's `ast` module — no
+imports, no execution — and flags the memory-**write** call sites where that
+can happen:
+
+```
+$ agentmemorytaintgap agent/
+
+BLOCKER  AT001 agent/handler.py:3:4   Memory-write call stores content traced back to an untrusted origin (tool output / external fetch / raw user input) with no sanitization or provenance-tagging call in this function (agent memory poisoning risk).
+        agent_memory.save_context({"input": user_query}, {"output": tool_result})
+
+1 file(s) scanned · 1 blocker(s) · 0 warning(s)
+```
+
+Exit code `1` on a blocker, so it drops straight into pre-commit or CI.
+
+## What it flags
+
+| Rule | Severity | Fires when… |
+| :--- | :--- | :--- |
+| **AT001** | blocker | a memory-write call's stored value traces (single-hop, same function) back to a **provably untrusted** origin — tool output, an HTTP/fetch response, or a raw user-input parameter — with **no** sanitize/tag call on it anywhere in that function. |
+| **AT002** | warning | a memory-write call's stored value origin **could not be confidently traced** either way (a bare parameter with no naming signal, or a longer assignment chain). Lower confidence — worth a human glance, not a confident blocker. |
+
+The LLM's own generated response (e.g. `llm.invoke(...)`) is treated as
+trusted and is never flagged — the concern here is specifically *external*
+content being stored as if it were the agent's own conclusion.
+
+### Recognized memory-write shapes
+
+- LangChain-shaped: `.save_context(...)`, `.chat_memory.add_message(...)` /
+  `.add_user_message(...)` / `.add_ai_message(...)`.
+- Generic vector-store-as-memory: `.add(...)` / `.upsert(...)` called on a
+  variable whose name contains `memory`, `mem_store`, or `long_term` — there
+  is no single standard "agent memory" API the way there is for HTTP, so
+  this is a **naming heuristic**, documented honestly in `DETAILS.md`.
+- Custom memory helpers: a call to `remember(...)`, `store_memory(...)`, or
+  `save_memory(...)`, as a free function or bound method.
+
+### Recognized untrusted origins
+
+- A tool call: `.run(...)` / `.invoke(...)` on a variable named like `tool`,
+  or a call to a function decorated with a recognizable `@tool` decorator.
+- An external fetch: `requests`/`httpx`/`aiohttp` `.get/.post/...(...)`, or a
+  call to a function literally named `fetch`.
+- A raw user-input function parameter (named like `user_input`,
+  `user_message`, `raw_input`, `user_query`, or `message`).
+
+### Safe-marker short-circuit
+
+If a call whose name contains `sanitize`, `clean`, `validate`, `tag_source`,
+or `mark_untrusted` is applied to the value anywhere in the
+same function before the memory write, the finding does not fire — the
+short-circuit is deliberately generous, the same style as its sibling tools.
+
+## How it relates to echofence
+
+`echofence` and `agentmemorytaintgap` are both prompt-injection-adjacent AST
+linters, and they are **deliberately distinct, non-overlapping tools**:
+
+- **[`echofence`](https://github.com/jay-tank/echofence) — input side, single
+  turn.** Flags untrusted *external* content reaching a live LLM **prompt**
+  directly — the indirect variant of OWASP LLM01. The risk window is one
+  request/response cycle.
+- **`agentmemorytaintgap` — persistence side, every future turn.** Flags
+  untrusted content being **written into long-term memory** that will be
+  read back and replayed as trusted context across *every subsequent turn*,
+  potentially for the lifetime of the memory store. The artifact, the
+  timing, and the risk shape are different: a poisoned prompt affects one
+  answer; a poisoned memory write affects all future answers until someone
+  notices and purges the store.
+
+See `DETAILS.md` for the full, honest comparison — including why this is not
+just "echofence but for a different sink."
+
+## Install
+
+```bash
+pip install agentmemorytaintgap
+```
+
+## Usage
+
+```bash
+agentmemorytaintgap agent/                # scan a directory
+agentmemorytaintgap memory_handler.py      # scan a file
+agentmemorytaintgap agent/ --strict        # AT002 warnings fail the run too
+agentmemorytaintgap agent/ --json          # machine-readable output
+```
+
+### In CI
+
+```yaml
+- run: pip install agentmemorytaintgap
+- run: agentmemorytaintgap agent/ --strict
+```
+
+Exit codes: `0` clean · `1` a blocker (AT001), or any finding under
+`--strict` · `2` usage error.
+
+## Honest limitations
+
+`agentmemorytaintgap` is a **pragmatic, heuristic, single-hop,
+same-function-scope** analyzer — **not** full data-flow / taint analysis.
+See `DETAILS.md` for the complete breakdown, but concretely:
+
+- It only recognizes the memory-write shapes and naming conventions listed
+  above. A memory variable that doesn't contain `memory`/`mem_store`/
+  `long_term` in its name, or a tool call that doesn't match the recognized
+  `@tool`/`.run()`/`.invoke()` shapes, is invisible to v0.1.
+- Tracing is single-hop and scoped to one function. A value laundered
+  through a helper function it doesn't look inside of, or passed across
+  functions before being written to memory, will not be traced.
+- A sanitize/tag call anywhere in the function short-circuits the finding —
+  it trusts that the call actually does what its name implies; it does not
+  verify that.
+
+Treat it as a fast reviewer that catches the obvious, high-value cases on
+every PR, paired with human judgment for the rest.
+
+## License
+
+MIT © Jay Tank

agentmemorytaintgap-0.1.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+agentmemorytaintgap/__init__.py,sha256=k84Dy06UAx6Bws5aO_w2cKBNfqOc_xdmAuYxGVFRLGc,218
+agentmemorytaintgap/cli.py,sha256=elXnd7L3y9x_dRhYk2Do5j7Yx5sEAivtlNu_abz_Mpg,2716
+agentmemorytaintgap/scanner.py,sha256=lG4j9d1DGaeb6ZhS9fXOpwFCrH7KBrfyfnmE6BvNM70,16973
+agentmemorytaintgap-0.1.0.dist-info/METADATA,sha256=ng025WARYHDmqt1wsplmvAVBCY4XlvSzEbb9PLAe2Zc,7253
+agentmemorytaintgap-0.1.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+agentmemorytaintgap-0.1.0.dist-info/entry_points.txt,sha256=t4G_00wVvUpmJ7J7G_X6Ri5kcQuPTf258pHtMQ-tLwY,69
+agentmemorytaintgap-0.1.0.dist-info/licenses/LICENSE,sha256=xEsRvzJ-7Nbqa9ppe87ZOX9Xgmc2CJ7HOEFGRa0rcpU,1060
+agentmemorytaintgap-0.1.0.dist-info/RECORD,,

agentmemorytaintgap-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.0
+Root-Is-Purelib: true
+Tag: py3-none-any

agentmemorytaintgap-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+agentmemorytaintgap = agentmemorytaintgap.cli:main

agentmemorytaintgap-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.