agentmetry 0.7.0__tar.gz → 0.8.0__tar.gz

{agentmetry-0.7.0 → agentmetry-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.7.0
+Version: 0.8.0
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry
@@ -25,7 +25,7 @@ Requires-Python: >=3.11
 Requires-Dist: aiosqlite>=0.20.0
 Requires-Dist: fastapi>=0.115.0
 Requires-Dist: httpx>=0.28.0
-Requires-Dist: mcp>=1.2
+Requires-Dist: mcp<2,>=1.2
 Requires-Dist: pydantic-settings>=2.6.0
 Requires-Dist: pydantic>=2.9.0
 Requires-Dist: pyyaml>=6.0
@@ -37,7 +37,7 @@ Provides-Extra: dev
 Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
 Requires-Dist: pytest-cov>=6.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff==0.16.4; extra == 'dev'
+Requires-Dist: ruff==0.16.6; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # Agentmetry

{agentmetry-0.7.0 → agentmetry-0.8.0}/agentmetry/api/routes/audit.py

@@ -122,6 +122,10 @@ class ExternalIngestBody(BaseModel):
     # fields that separate a shipped release from a rug pull. All hashes and
     # flags: no tool name, no description, nothing model-visible.
     schema_tool_digests: dict[str, str] = Field(default_factory=dict)
+    # Concealed-character counts per category. Declared here because pydantic
+    # drops what it does not know, silently, which has already cost this file
+    # two shipped bugs.
+    schema_concealed: dict[str, int] = Field(default_factory=dict)
     server_version: str = ""
     list_changed: bool | None = None
 

{agentmetry-0.7.0 → agentmetry-0.8.0}/agentmetry/cli/__init__.py

@@ -34,6 +34,7 @@ _BACKUP_EXCLUDE_DIRS = {"logs"}
 logger = logging.getLogger(__name__)
 
 _BACKUP_EXCLUDE_SUFFIXES = {".pid"}
+_CLOSING_DISPOSITIONS = ("resolved", "false_positive", "risk_accepted")
 
 
 def _base_url(port: int, host: str = "127.0.0.1") -> str:
@@ -41,6 +42,15 @@ def _base_url(port: int, host: str = "127.0.0.1") -> str:
     return f"http://{display}:{port}"
 
 
+def _api_base_url(port: int) -> str:
+    return os.environ.get("AGENTMETRY_URL", "").strip().rstrip("/") or _base_url(port)
+
+
+def _api_headers() -> dict[str, str]:
+    key = os.environ.get("AGENTMETRY_API_KEY", "").strip()
+    return {"X-API-Key": key} if key else {}
+
+
 def _lan_ip() -> str | None:
     """Best-effort local IPv4 for phone/LAN access hints."""
     try:
@@ -219,7 +229,8 @@ def cmd_stats(args: argparse.Namespace) -> int:
         return 1
 
     if not data.get("enabled", True):
-        print("Audit export disabled — enable AGENTMETRY_AUDIT_EXPORT to collect stats.")
+        print("Audit export is disabled, so no events are recorded and stats are empty.")
+        print("Set AGENTMETRY_AUDIT_EXPORT_ENABLED=1 and restart.")
         return 1
 
     days = data.get("window_days", args.days)
@@ -241,6 +252,76 @@ def cmd_stats(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_detections(args: argparse.Namespace) -> int:
+    try:
+        data = httpx.get(
+            f"{_base_url(args.port)}/api/v1/audit/detections/{args.correlation_id}",
+            timeout=10.0,
+        ).json()
+    except Exception:
+        print("Not running - start Agentmetry first (detections reads via the API).")
+        return 1
+    if not data.get("enabled", True):
+        print("Audit export is disabled, so no sessions are recorded.")
+        print("Set AGENTMETRY_AUDIT_EXPORT_ENABLED=1 and restart.")
+        return 1
+    detections = data.get("detections") or []
+    if not detections:
+        print(f"No detections for {args.correlation_id}.")
+        return 0
+    rule_width = max(len("Rule"), *(len(str(d.get("rule_id", ""))) for d in detections))
+    severity_width = max(
+        len("Severity"), *(len(str(d.get("severity", ""))) for d in detections)
+    )
+    print(f"{'Rule':<{rule_width}}  {'Severity':<{severity_width}}  Summary")
+    print(f"{'-' * rule_width}  {'-' * severity_width}  {'-' * len('Summary')}")
+    for detection in detections:
+        print(
+            f"{str(detection.get('rule_id', '')):<{rule_width}}  "
+            f"{str(detection.get('severity', '')):<{severity_width}}  "
+            f"{detection.get('summary', '')}"
+        )
+    return 0
+
+
+def cmd_disposition(args: argparse.Namespace) -> int:
+    """Close a detection from the shell, using the same API as the dashboard."""
+    note = args.note.strip()
+    if args.status in {"false_positive", "risk_accepted"} and not note:
+        print(f"--note is required for {args.status}")
+        return 1
+
+    try:
+        resp = httpx.post(
+            f"{_api_base_url(args.port)}/api/v1/audit/detections/disposition",
+            json={
+                "correlation_id": args.correlation_id,
+                "rule_id": args.rule_id,
+                "status": args.status,
+                "note": note,
+                "decided_by": args.decided_by,
+            },
+            headers=_api_headers(),
+            timeout=10.0,
+        )
+    except Exception:
+        print("Not running - start Agentmetry first (disposition writes via the API).")
+        return 1
+
+    if resp.status_code >= 400:
+        try:
+            detail = resp.json().get("detail")
+        except Exception:
+            detail = None
+        print(f"FAILED — {detail or resp.text or f'HTTP {resp.status_code}'}")
+        return 1
+
+    current = resp.json().get("disposition", {})
+    status = current.get("status", args.status)
+    print(f"Disposition set: {args.correlation_id} {args.rule_id} -> {status}")
+    return 0
+
+
 def cmd_logs(args: argparse.Namespace) -> int:
     log = _DATA_DIR / "logs" / "orchestrator.log"
     if not log.exists():
@@ -1132,6 +1213,14 @@ def main(argv: list[str] | None = None) -> int:
     sub.add_parser("status", help="orchestrator health and audit export status")
     stats = sub.add_parser("stats", help="audit trail metrics for dogfood (events, detections)")
     stats.add_argument("--days", type=int, default=7)
+    detections = sub.add_parser("detections", help="list detections for one session")
+    detections.add_argument("correlation_id", help="correlation_id / session id")
+    disposition = sub.add_parser("disposition", help="close an audit detection from the shell")
+    disposition.add_argument("correlation_id", help="session/correlation id that owns the detection")
+    disposition.add_argument("rule_id", help="detection rule id to close")
+    disposition.add_argument("--status", required=True, choices=_CLOSING_DISPOSITIONS)
+    disposition.add_argument("--note", default="")
+    disposition.add_argument("--decided-by", default="")
     logs = sub.add_parser("logs", help="tail the orchestrator log")
     logs.add_argument("-n", "--lines", type=int, default=50)
     logs.add_argument("-f", "--follow", action="store_true")
@@ -1273,6 +1362,8 @@ def main(argv: list[str] | None = None) -> int:
         "hook": cmd_hook,
         "status": cmd_status,
         "stats": cmd_stats,
+        "detections": cmd_detections,
+        "disposition": cmd_disposition,
         "logs": cmd_logs,
         "backup": cmd_backup,
         "restore": cmd_restore,

{agentmetry-0.7.0 → agentmetry-0.8.0}/agentmetry/core/audit/ingest.py

@@ -187,6 +187,7 @@ class _SchemaFields(NamedTuple):
     server_version: str
     list_changed: bool | None
     tool_digests: dict[str, str]
+    concealed: dict[str, int]
 
 
 def _schema_payload_fields(payload: dict[str, Any]) -> _SchemaFields:
@@ -202,6 +203,12 @@ def _schema_payload_fields(payload: dict[str, Any]) -> _SchemaFields:
     list_changed = payload.get("list_changed")
     if list_changed is not None and not isinstance(list_changed, bool):
         list_changed = None
+    raw_concealed = payload.get("schema_concealed")
+    concealed = (
+        {str(k): int(v) for k, v in raw_concealed.items() if isinstance(v, int)}
+        if isinstance(raw_concealed, dict)
+        else {}
+    )
     raw_digests = payload.get("schema_tool_digests")
     tool_digests = (
         {str(k): str(v) for k, v in raw_digests.items() if isinstance(v, str)}
@@ -209,7 +216,8 @@ def _schema_payload_fields(payload: dict[str, Any]) -> _SchemaFields:
         else {}
     )
     return _SchemaFields(
-        server, fingerprint, tool_count, source, server_version, list_changed, tool_digests
+        server, fingerprint, tool_count, source, server_version, list_changed,
+        tool_digests, concealed,
     )
 
 
@@ -232,22 +240,47 @@ def build_schema_canonical(
     from agentmetry.core.audit.canonical import SCHEMA_VERSION
     from agentmetry.core.audit.identity import identity_fields
     from agentmetry.core.audit.atlas import RUG_PULL
-    from agentmetry.core.diagnostics.mcp_schema import server_id
+    from agentmetry.core.diagnostics.mcp_schema import FORMATTING_CATEGORY, server_id
 
     fields = _schema_payload_fields(payload)
     server, fingerprint, tool_count = fields.server, fields.fingerprint, fields.tool_count
     server_version, list_changed = fields.server_version, fields.list_changed
     outcome = "changed" if status == "changed" else "success"
-    reason = (
-        "MCP tool schema changed; config may be unchanged (rug-pull candidate)"
-        if status == "changed"
-        else "MCP tool schema observed"
-    )
+    _REASONS = {
+        "changed": "MCP tool schema changed; config may be unchanged (rug-pull candidate)",
+        # Says what it is and what it is not. A re-baseline adopts whatever the
+        # server serves today without comparing it to anything, so if the server
+        # was already poisoned before our hashing changed, this event is the
+        # moment that state became the trusted one. `new` would have hidden that
+        # behind a word that also means "nothing was ever wrong here" (#146).
+        "rebaselined": (
+            "MCP tool schema re-baselined after a fingerprint change; "
+            "trust-on-first-use, not compared against the previous baseline"
+        ),
+    }
+    reason = _REASONS.get(status, "MCP tool schema observed")
+    _formatting = {k: v for k, v in fields.concealed.items() if k == FORMATTING_CATEGORY}
+    _concealment = {k: v for k, v in fields.concealed.items() if k != FORMATTING_CATEGORY}
     mcp_schema: dict[str, Any] = {
         "server_id": server_id(server) if server else "",
         "fingerprint": fingerprint,
         "tool_count": tool_count,
         "status": status,
+        # A baseline nobody has verified against a predecessor. Structured
+        # rather than left in the reason string so a SIEM can count them
+        # instead of matching prose.
+        **({"unverified_baseline": True} if status == "rebaselined" else {}),
+        # Concealed characters in strings the model reads. Counts per category,
+        # never the text. Attached on every status including `new`, because
+        # unlike everything else here it does not need a baseline: this is the
+        # one poisoning visible on a first sighting.
+        **({"concealed": _concealment} if _concealment else {}),
+        # Typography, kept apart from the evidence. A soft hyphen or a
+        # zero-width space arrives in descriptions imported from formatted
+        # documentation, and no neighbouring character can clear it the way one
+        # clears a ZWJ. Reporting it beside real concealment would make an
+        # operator who reads one finding distrust the next.
+        **({"formatting": _formatting} if _formatting else {}),
         # Only a schema that MOVED is the technique. `new` is the first
         # sight of a server and `same` is a quiet reconnect; tagging either
         # as a rug pull would put a Defense Evasion label on installing a

{agentmetry-0.7.0 → agentmetry-0.8.0}/agentmetry/core/diagnostics/mcp_schema.py

@@ -42,8 +42,35 @@ logger = logging.getLogger(__name__)
 
 _lock = threading.Lock()
 
-#: Keys that change between calls without changing what the model is told.
-_VOLATILE = frozenset({"_meta"})
+#: Bump when the bytes fed to the hash change.
+#:
+#: A stored fingerprint is only comparable to one computed the same way, so a
+#: baseline written under an older version is re-baselined rather than reported
+#: as a change. Without that, the upgrade that fixes a blind spot hands every
+#: existing user a rug-pull alert on the same morning.
+#:
+#: 1: `_meta` stripped before hashing.
+#: 2: `_meta` hashed. See below.
+FINGERPRINT_VERSION = 2
+
+#: Keys dropped before hashing, because they change between calls without
+#: changing what the model is told.
+#:
+#: **Empty, and it is meant to stay nearly empty.** It used to hold `_meta`, on
+#: the reasonable-sounding grounds that `_meta` is transport bookkeeping. It is
+#: not. `_meta` rides on the tool object, reaches clients, and whether it
+#: reaches the *model* is client-dependent, which makes it the obvious place to
+#: move behaviour-bearing text once descriptions are being watched. Stripping it
+#: meant a poisoned listing hashed identically to a clean one: not a weakened
+#: signal, an absent one (issue #142).
+#:
+#: The rules in this project are public on purpose, so its exemptions are public
+#: too, and an exemption is a documented bypass.
+#:
+#: The bar for adding a key here is therefore evidence that it genuinely varies
+#: per call on a real server, plus a note saying which server and why. "It looks
+#: like metadata" is how the last entry got in.
+_VOLATILE: frozenset[str] = frozenset()
 
 
 def _canonical_entries(tools: list[Any] | None) -> list[dict[str, Any]]:
@@ -98,6 +125,244 @@ def fingerprint_each_tool(tools: list[Any] | None) -> dict[str, str]:
     }
 
 
+#: Characters that render as nothing, or reverse rendering order, while still
+#: reaching the model. Grouped by category so a finding can say what kind of
+#: concealment it is without carrying the text.
+#:
+#: The TAG block is the one that matters most: U+E0000 to U+E007F mirrors ASCII,
+#: so an entire second instruction can be written in it and displayed as an
+#: empty string. Research calls the result an approval-view fidelity gap, and
+#: the phrase is exact: the human approving a tool reads one string and the
+#: model receives another.
+#:
+#: **Every one of these ranges has a legitimate use**, which the first version
+#: of this module denied in a comment that said so in as many words. A reader on
+#: r/mcp took it apart within a day of the release being cut:
+#:
+#:   * TAG characters spell the subdivision flags. Scotland, Wales and England
+#:     are emoji tag sequences, a U+1F3F4 base followed by tag letters and a
+#:     U+E007F terminator.
+#:   * U+200D joins every emoji ZWJ sequence, so a family or a profession emoji
+#:     carries one or more.
+#:   * U+200C is required Persian and Arabic orthography and is used across
+#:     Indic scripts. It is spelling, not decoration, so flagging it penalises
+#:     correctly written non-Latin text.
+#:   * Bidi isolates are the modern, recommended way to mix scripts, so any
+#:     description containing Arabic or Hebrew may legitimately carry them.
+#:
+#: So the check is contextual rather than range-based. A character counts only
+#: when nothing in its surroundings explains it, which keeps the detection
+#: (TAG-encoded ASCII is still caught, because it has no flag base in front of
+#: it) and drops the false positives.
+#:
+#: Private Use Area is deliberately absent. It is genuinely used for icon fonts
+#: and would fire on legitimate descriptions, and a category that cries wolf
+#: costs more than the one case it might catch.
+
+#: Tag characters, and the two that bracket a legitimate emoji tag sequence.
+_TAG_RANGE = (0xE0000, 0xE007F)
+_TAG_TERMINATOR = 0xE007F
+_TAG_BASE = 0x1F3F4  # waving black flag, the only base an emoji tag sequence uses
+
+#: Zero-width and format characters, split by whether context can explain them.
+_ZWJ = 0x200D
+_ZWNJ = 0x200C
+
+#: The category for characters that are typography rather than evidence.
+#:
+#: These three were counted as concealment until the reader who found the flag
+#: and Persian cases was asked directly whether they had innocent uses. They do,
+#: and descriptions imported from formatted documentation carry them:
+#:
+#:   * U+200B gives a line-break opportunity without a visible space.
+#:   * U+00AD is a soft hyphen, an optional hyphenation point.
+#:   * U+FEFF is legacy zero-width no-break space. U+2060 is preferred for new
+#:     text, and a byte order mark belongs to the input stream rather than to
+#:     every description string in it.
+#:
+#: Unlike ZWJ and ZWNJ there is no neighbouring character that settles the
+#: question, so no positional test can clear them. They are reported under their
+#: own key instead, so an operator can inspect them without a formatting quirk
+#: reading as a poisoned tool. Presence alone is not evidence of anything.
+FORMATTING_CATEGORY = "formatting"
+_FORMATTING_CONTROLS = frozenset({0x200B, 0xFEFF, 0x00AD})
+
+_BIDI_CONTROLS = frozenset(
+    list(range(0x202A, 0x202F)) + list(range(0x2066, 0x206A))
+)
+
+#: Rough pictographic ranges. Only used to decide whether a ZWJ sits between two
+#: emoji, so being generous here costs a missed detection in a case that would
+#: need an attacker to hide a payload inside an emoji sequence, and being narrow
+#: costs a false positive on ordinary text. Generous is the right trade.
+_PICTOGRAPHIC = (
+    (0x00A9, 0x00AE),
+    (0x203C, 0x3299),
+    (0x1F000, 0x1FAFF),
+    (0xFE0F, 0xFE0F),  # variation selector 16, sits inside ZWJ sequences
+    (0x1F3FB, 0x1F3FF),  # skin tone modifiers
+)
+
+#: Scripts that use ZWNJ as orthography rather than decoration.
+_ZWNJ_SCRIPTS = (
+    (0x0600, 0x06FF),  # Arabic
+    (0x0750, 0x077F),
+    (0x08A0, 0x08FF),
+    (0xFB50, 0xFDFF),
+    (0xFE70, 0xFEFF),
+    (0x0900, 0x0DFF),  # Devanagari through Sinhala
+    (0x0700, 0x074F),  # Syriac
+)
+
+#: Right-to-left scripts. A bidi control in text with none of these has nothing
+#: to reorder, which is what makes it unexplained.
+_RTL_SCRIPTS = (
+    (0x0590, 0x05FF),  # Hebrew
+    (0x0600, 0x06FF),  # Arabic
+    (0x0700, 0x074F),  # Syriac
+    (0x0780, 0x07BF),  # Thaana
+    (0x07C0, 0x07FF),  # N'Ko
+    (0x0800, 0x085F),
+    (0xFB1D, 0xFDFF),
+    (0xFE70, 0xFEFF),
+)
+
+
+def _in(point: int, ranges: tuple[tuple[int, int], ...]) -> bool:
+    return any(low <= point <= high for low, high in ranges)
+
+
+def _explained_tag_indices(points: list[int]) -> set[int]:
+    """Indices belonging to a well-formed emoji tag sequence.
+
+    The grammar is narrow: a U+1F3F4 base, one or more tag characters, then a
+    U+E007F terminator. Tag characters anywhere else have no other use, so this
+    keeps the detection while letting the subdivision flags through.
+    """
+    explained: set[int] = set()
+    i = 0
+    while i < len(points):
+        if points[i] != _TAG_BASE:
+            i += 1
+            continue
+        j = i + 1
+        while j < len(points) and _TAG_RANGE[0] <= points[j] < _TAG_TERMINATOR:
+            j += 1
+        if j > i + 1 and j < len(points) and points[j] == _TAG_TERMINATOR:
+            explained.update(range(i, j + 1))
+            i = j + 1
+        else:
+            i += 1
+    return explained
+
+
+def _neighbour(points: list[int], index: int, step: int) -> int | None:
+    """The nearest code point either side, skipping variation selectors."""
+    i = index + step
+    while 0 <= i < len(points):
+        if points[i] != 0xFE0F:
+            return points[i]
+        i += step
+    return None
+
+
+def _scan_text(text: str, found: dict[str, int]) -> None:
+    points = [ord(c) for c in text]
+    tag_ok = _explained_tag_indices(points)
+    has_rtl = any(_in(p, _RTL_SCRIPTS) for p in points)
+
+    for i, point in enumerate(points):
+        if _TAG_RANGE[0] <= point <= _TAG_RANGE[1]:
+            if i not in tag_ok:
+                found["tag_block"] = found.get("tag_block", 0) + 1
+            continue
+
+        if point in _FORMATTING_CONTROLS:
+            found[FORMATTING_CATEGORY] = found.get(FORMATTING_CATEGORY, 0) + 1
+            continue
+
+        if point == _ZWJ:
+            before = _neighbour(points, i, -1)
+            after = _neighbour(points, i, 1)
+            joins_emoji = (
+                before is not None
+                and after is not None
+                and _in(before, _PICTOGRAPHIC)
+                and _in(after, _PICTOGRAPHIC)
+            )
+            if not joins_emoji:
+                found["zero_width"] = found.get("zero_width", 0) + 1
+            continue
+
+        if point == _ZWNJ:
+            before = _neighbour(points, i, -1)
+            after = _neighbour(points, i, 1)
+            orthographic = (before is not None and _in(before, _ZWNJ_SCRIPTS)) or (
+                after is not None and _in(after, _ZWNJ_SCRIPTS)
+            )
+            if not orthographic:
+                found["zero_width"] = found.get("zero_width", 0) + 1
+            continue
+
+        if point in _BIDI_CONTROLS and not has_rtl:
+            found["bidi_control"] = found.get("bidi_control", 0) + 1
+
+
+def _walk_strings(value: Any):
+    """Every string anywhere in a tool definition.
+
+    Deliberately not a list of field names. #103 settled that argument for the
+    severity split and it applies here for the same reason: an allowlist fails
+    open on whatever the spec adds next, and a field nobody has thought about
+    yet should default to inspected rather than invisible.
+    """
+    if isinstance(value, str):
+        yield value
+    elif isinstance(value, dict):
+        for key, item in value.items():
+            yield from _walk_strings(key)
+            yield from _walk_strings(item)
+    elif isinstance(value, list):
+        for item in value:
+            yield from _walk_strings(item)
+
+
+def scan_concealed_text(tools: list[Any] | None) -> dict[str, int]:
+    """Counts of unexplained concealed characters, or an empty dict if clean.
+
+    Counts only. Never the text, never which tool, never the surrounding
+    string. A finding that carries the payload has stored the payload, which is
+    the rule the whole module is built on.
+
+    This catches one narrow class of poisoning on a single observation, which
+    the fingerprint cannot do at all. That limit is worth stating precisely,
+    because "blind on the first listing" understates it: the fingerprint answers
+    "did this move", never "should this have been here". A server hostile at its
+    first release that never changed since has a stable digest forever and is
+    never flagged by it, at listing one or listing one hundred.
+
+    This check does **not** make a clean listing trustworthy either, first or
+    otherwise. An instruction written in ordinary visible text needs none of
+    these characters and is invisible here.
+
+    "Unexplained" is doing real work in the first line. Every range here has a
+    legitimate use, so context decides: a tag character inside a subdivision
+    flag, a ZWJ between two emoji, a ZWNJ next to Persian or Devanagari, and a
+    bidi control in text that actually contains a right-to-left script are all
+    silent. See the comment above `_TAG_RANGE` for who found that out and how.
+
+    The result carries two grades of finding under different keys. `tag_block`,
+    `zero_width` and `bidi_control` are concealment: something is hidden and
+    nothing around it explains why. `formatting` is typography that no
+    positional test can clear, and on its own it is not evidence of poisoning.
+    `build_schema_canonical` keeps them in separate blocks for that reason.
+    """
+    found: dict[str, int] = {}
+    for text in _walk_strings(_canonical_entries(tools)):
+        _scan_text(text, found)
+    return found
+
+
 def server_id(name: str) -> str:
     """Opaque 16-hex id for a server name. Publish this, never the name."""
     return hashlib.sha256(name.encode("utf-8")).hexdigest()[:16]
@@ -201,6 +466,9 @@ class SchemaRecord:
     #: is why a delta against an empty baseline reports nothing changed rather
     #: than reporting every tool as new.
     tool_digests: dict[str, str] = field(default_factory=dict)
+    #: Which hashing this fingerprint was computed with. Defaults to 1 because
+    #: a record that does not say was written before the field existed.
+    fingerprint_version: int = 1
 
 
 @dataclass
@@ -256,13 +524,14 @@ def load_store(path: Path | None = None) -> SchemaStore:
                 }
                 if isinstance(digests, dict)
                 else {},
+                fingerprint_version=int(rec.get("fingerprint_version") or 1),
             )
     return SchemaStore(servers=servers)
 
 
 def _dump(store: SchemaStore) -> dict[str, Any]:
     return {
-        "schema_version": 2,
+        "schema_version": 3,
         "servers": {
             name: {
                 "fingerprint": rec.fingerprint,
@@ -273,6 +542,7 @@ def _dump(store: SchemaStore) -> dict[str, Any]:
                 **({"server_version": rec.server_version} if rec.server_version else {}),
                 **({"list_changed": rec.list_changed} if rec.list_changed is not None else {}),
                 **({"tool_digests": rec.tool_digests} if rec.tool_digests else {}),
+                "fingerprint_version": rec.fingerprint_version,
             }
             for name, rec in sorted(store.servers.items())
         },
@@ -312,6 +582,25 @@ def classify_observation(
         existing = load_store(path or store_path()).servers.get(name)
     if existing is None:
         return "new"
+    if existing.fingerprint_version != FINGERPRINT_VERSION:
+        # The stored digest was computed over different bytes, so it is not
+        # comparable and a mismatch says nothing about the server. Re-baseline
+        # instead. Without this, the release that closed the `_meta` blind spot
+        # would have reported a rug pull on every server every user had ever
+        # observed, on upgrade day, and taught them the alert is noise.
+        #
+        # `rebaselined` rather than `new`, and the distinction is the whole
+        # point (issue #146). `new` says "we had never seen this server". This
+        # says "we had a baseline, our hashing changed, and we are trusting
+        # whatever the server says today without comparing it to anything".
+        #
+        # Those carry different evidence. If a server was already poisoned
+        # before the upgrade, this observation adopts the poisoned state and an
+        # operator reading a quiet week must be able to see that, rather than
+        # find a word that also means "nothing has ever been wrong here".
+        # Trading a loud false positive for a silent false negative is the
+        # worse half of that trade for a recorder.
+        return "rebaselined"
     if existing.fingerprint == fp:
         return "same"
     if existing.tool_count == 0 and tool_count > 0:
@@ -384,6 +673,7 @@ def record_observation(
                 existing.server_version = server_version
             if list_changed is not None:
                 existing.list_changed = list_changed
+            existing.fingerprint_version = FINGERPRINT_VERSION
             if tool_digests:
                 # An unchanged listing backfills the per-tool map for records
                 # written before it existed, so the first real change after an
@@ -402,6 +692,7 @@ def record_observation(
             server_version=server_version,
             list_changed=list_changed,
             tool_digests=dict(tool_digests or {}),
+            fingerprint_version=FINGERPRINT_VERSION,
         )
         _write_store(store, target)
         return "changed" if previous else "new"

{agentmetry-0.7.0 → agentmetry-0.8.0}/agentmetry/core/version.py

@@ -10,4 +10,4 @@ Bump this here and add the matching CHANGELOG section in the same commit.
 
 from __future__ import annotations
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"

{agentmetry-0.7.0 → agentmetry-0.8.0}/agentmetry/policies/dlp/manifest.yaml

@@ -159,3 +159,29 @@ rules:
     pattern: "(?i)\\b(ANTHROPIC_BASE_URL|ANTHROPIC_AUTH_TOKEN|OPENAI_BASE_URL|OPENAI_API_BASE|GEMINI_BASE_URL|MOONSHOT_API_KEY|DASHSCOPE_API_KEY|DEEPSEEK_API_KEY|ZHIPUAI_API_KEY|MINIMAX_API_KEY|QWEN_API_KEY|HTTP_PROXY|HTTPS_PROXY|NODE_OPTIONS|PYTHONSTARTUP|LD_PRELOAD)[\"']?\\s*[=:]"
     category: "execution_hijack"
     severity: "critical"
+
+  - id: "stripe_api_key"
+    name: "Stripe API Key"
+    description: "Detects Stripe live/test secret keys"
+    pattern: "(?i)\\bsk_(live|test)_[0-9a-z]{24,}\\b"
+    category: "credentials"
+    severity: "critical"
+
+  # Anthropic keys (sk-ant-api03-...) don't fit the generic sk-[a-zA-Z0-9]{20,}
+  # shape below: the hyphen after "ant" (and again after "api03") breaks the
+  # alnum-only run at 3 characters, so the generic rule never fires on them
+  # despite starting with the same "sk-" prefix. Needs its own rule, and a
+  # distinct rule id is more useful in a detection than a generic match anyway.
+  - id: "anthropic_api_key"
+    name: "Anthropic API Key"
+    description: "Detects Anthropic API keys (sk-ant-...)"
+    pattern: "(?i)\\bsk-ant-[a-zA-Z0-9_-]{20,}"
+    category: "credentials"
+    severity: "critical"
+
+  - id: "generic_provider_api_key"
+    name: "Generic LLM Provider API Key"
+    description: "Detects OpenAI-shaped provider API keys (sk-...); Anthropic and DashScope keys have their own rules above"
+    pattern: "(?i)\\bsk-[a-zA-Z0-9]{20,}\\b"
+    category: "credentials"
+    severity: "critical"

{agentmetry-0.7.0 → agentmetry-0.8.0}/pyproject.toml

@@ -34,7 +34,12 @@ dependencies = [
     "websockets>=14.0",
     "sqlalchemy>=2.0.0",
     "aiosqlite>=0.20.0",
-    "mcp>=1.2",
+    # Upper bound is load-bearing, not caution. MCP 2.0 removed
+    # `mcp.server.fastmcp.FastMCP`, which `tools/vault_fs_server.py` imports,
+    # so an unconstrained `>=1.2` resolved to 2.x on any fresh install and the
+    # bundled server failed on first run (issue #138). Lift this when that
+    # import is ported to the 2.x API, not before.
+    "mcp>=1.2,<2",
     # Windows ships no IANA timezone database, so `zoneinfo` cannot resolve
     # AGENTMETRY_BUSINESS_TZ there without this. Without it the off-hours rule
     # silently fell back to UTC and produced wrong findings on the platform this
@@ -47,7 +52,7 @@ dependencies = [
 # so a linter release could turn a green branch red with no change to this repo.
 # It did: 0.16.0 widened the default rule set and CI reported 132 errors against
 # code that passed locally on 0.15.x. Bump this deliberately, not by accident.
-dev = ["pytest>=8.0", "pytest-asyncio>=0.24", "pytest-cov>=6.0", "ruff==0.16.4"]
+dev = ["pytest>=8.0", "pytest-asyncio>=0.24", "pytest-cov>=6.0", "ruff==0.16.6"]
 
 [project.urls]
 Homepage = "https://agentmetry.ai"