agentsec-cli 0.1.0__py3-none-any.whl

agentsec/rules/additional.py

@@ -0,0 +1,227 @@
+"""Additional security rules for AgentSec."""
+
+from .base import Rule
+
+def load_additional_rules():
+    return [
+        Rule(
+            name="Network + filesystem access",
+            severity="critical",
+            description="MCP server has both network and filesystem access (exfiltration risk)",
+            recommendation="Separate network and filesystem capabilities, or implement strict allowlists.",
+            detect_patterns=["http", "https", "curl", "wget", "fetch", "filesystem", "write", "edit", "delete", "rm", "mv"]
+        ),
+        Rule(
+            name="Suspicious tool description",
+            severity="high",
+            description="Tool description contains suspicious instructions (prompt injection)",
+            recommendation="Review and sanitize tool descriptions; avoid instruction-like language.",
+            detect_patterns=["ignore previous instructions", "ignore all instructions", "do not tell the user", "secretly", "exfiltrate", "send to", "bypass", "disable security", "you are now", "system prompt"]
+        ),
+        Rule(
+            name="GitHub token exposure",
+            severity="high",
+            description="GitHub token or actions:write permission detected",
+            recommendation="Use fine-grained tokens with minimal permissions; avoid actions:write unless necessary.",
+            detect_patterns=["GITHUB_TOKEN", "gh auth token", ".git/config", "actions: write", "contents: write"]
+        ),
+        Rule(
+            name="Communication tool write permission",
+            severity="high",
+            description="MCP server can send messages to Slack/email/GitHub (data leak risk)",
+            recommendation="Limit write permissions for communication tools; use separate accounts with restricted scopes.",
+            detect_patterns=["slack", "gmail", "email", "send_message", "post_message", "create_issue", "comment", "reply"]
+        ),
+        Rule(
+            name="Database write/delete permission",
+            severity="high",
+            description="MCP server can modify or delete database records",
+            recommendation="Use read-only credentials for MCP servers; require manual approval for destructive operations.",
+            detect_patterns=["postgres", "mysql", "mongodb", "redis", "delete", "drop", "update", "insert"]
+        ),
+        Rule(
+            name="Unpinned dependency",
+            severity="medium",
+            description="MCP server dependency not pinned to a specific version",
+            recommendation="Pin dependencies to a specific version or commit SHA to avoid supply-chain attacks.",
+            detect_patterns=["latest", ":latest", "@latest"]
+        ),
+        Rule(
+            name="Remote script install",
+            severity="high",
+            description="Remote script installation pattern (curl | bash) detected",
+            recommendation="Avoid piping remote scripts to shell; prefer verified packages or download and inspect.",
+            detect_patterns=["curl ... | bash", "wget ... | sh"]
+        ),
+        Rule(
+            name="Excessive autonomy instruction",
+            severity="medium",
+            description="Agent instruction requests excessive autonomy (no confirmation)",
+            recommendation="Require user confirmation for important actions; avoid 'auto-approve' instructions.",
+            detect_patterns=["do not ask for confirmation", "always run commands", "auto-approve", "never ask user", "full access", "without confirmation"]
+        ),
+        Rule(
+            name="Prompt injection in markdown",
+            severity="medium",
+            description="Markdown file contains potential prompt injection phrases",
+            recommendation="Sanitize agent instructions; avoid embedding system-level directives in markdown.",
+            detect_patterns=["ignore previous instructions", "as an AI agent", "system prompt", "developer message", "hidden instruction"]
+        ),
+        Rule(
+            name="Sensitive file reference",
+            severity="high",
+            description="Agent instruction references sensitive files or secrets",
+            recommendation="Remove references to secrets or use gitignored files for credentials.",
+            detect_patterns=[".env", "id_rsa", ".ssh", "credentials", "secrets", "tokens", "auth.json"]
+        ),
+        Rule(
+            name="MCP OAuth broad scopes",
+            severity="medium",
+            description="MCP OAuth configuration has overly broad scopes",
+            recommendation="Use minimal required scopes; avoid '*' or 'admin' scopes.",
+            detect_patterns=["oauth", "*", "admin", "full_access"]
+        ),
+        Rule(
+            name="Web + filesystem access",
+            severity="high",
+            description="Tool can browse web and write files (prompt injection to file write risk)",
+            recommendation="Isolate web browsing from filesystem write; use separate tools with restricted permissions.",
+            detect_patterns=["http", "https", "curl", "wget", "fetch", "write", "edit", "delete", "rm", "mv"]
+        ),
+        Rule(
+            name="Read repo + network",
+            severity="high",
+            description="Tool can read repo files and send network requests (exfiltration risk)",
+            recommendation="Restrict read access for network-capable tools; use separate credentials.",
+            detect_patterns=["read_file", "read", "http", "https", "curl", "wget", "fetch"]
+        ),
+        Rule(
+            name="Unknown/untrusted source",
+            severity="medium",
+            description="MCP server package from unknown or untrusted source",
+            recommendation="Use packages from trusted registries (npm, PyPI) with known maintainers.",
+            detect_patterns=["raw.githubusercontent.com", r"raw\.", "gist", "pastebin", "dropbox", "bitbucket"]
+        ),
+        Rule(
+            name="No policy file",
+            severity="low",
+            description="Project uses MCP/tools but no local security policy file",
+            recommendation="Define a policy file (e.g., .agentsec.yaml) to specify allow/deny lists.",
+            detect_patterns=["mcpServers", "tools", "allowed", "denied"]
+        ),
+        # Новые правила для популярных AI-агентов и дополнительных уязвимостей
+        Rule(
+            name="Cursor agent config with dangerous permissions",
+            severity="high",
+            description="Cursor agent configuration grants dangerous permissions (shell, filesystem write, network)",
+            recommendation="Restrict permissions for Cursor agent to minimal required; use project-specific configs.",
+            detect_patterns=["cursor-agent"],
+            all_patterns=["cursor", "shell", "write", "network"]
+        ),
+        Rule(
+            name="Claude Desktop config with MCP server risks",
+            severity="high",
+            description="Claude Desktop MCP server configuration has risky settings (shell, filesystem, network)",
+            recommendation="Review Claude Desktop MCP config; restrict shell and filesystem access.",
+            detect_patterns=["claude-desktop", "claude_desktop", "claude_desktop_config.json"],
+            all_patterns=["mcpservers", "filesystem"]
+        ),
+        Rule(
+            name="Codex/Cline agent with unrestricted tools",
+            severity="high",
+            description="Codex or Cline agent has unrestricted access to tools (shell, filesystem, network)",
+            recommendation="Restrict tool access for Codex/Cline agents; use permission prompts.",
+            detect_patterns=["codex", "cline", "tools", "shell", "filesystem", "network", "permissions"]
+        ),
+        Rule(
+            name="Environment variable exposure",
+            severity="critical",
+            description="MCP server or agent config exposes environment variables with secrets",
+            recommendation="Avoid exposing env vars in configs; use .env files and gitignore them.",
+            detect_patterns=["process.env", "AWS_", "OPENAI_", "ANTHROPIC_", "GOOGLE_", "GITHUB_", "SLACK_", "DISCORD_"]
+        ),
+        Rule(
+            name="Vulnerable dependency pattern",
+            severity="medium",
+            description="MCP server dependency uses known vulnerable version pattern (e.g., outdated package)",
+            recommendation="Update dependencies to latest secure versions; use tools like npm audit or pip-audit.",
+            detect_patterns=["@modelcontextprotocol", "^0.1", "~0.0", "<1.0", ">=0.1"]
+        ),
+        Rule(
+            name="Insecure default command",
+            severity="critical",
+            description="MCP server command uses insecure defaults (e.g., exec, eval, dangerous flags)",
+            recommendation="Avoid using eval, exec, or dangerous command-line flags; use safe alternatives.",
+            detect_patterns=["eval", "exec", "-e", "-c", "--eval", "--exec", "child_process"]
+        ),
+        Rule(
+            name="Read-only file system in MCP server",
+            severity="medium",
+            description="MCP server has read-only filesystem access but may still expose sensitive files",
+            recommendation="Even read-only access can leak secrets; restrict path to necessary directories.",
+            detect_patterns=["read", "readonly", "read-only", "filesystem", "path"]
+        ),
+        Rule(
+            name="Missing input validation",
+            severity="medium",
+            description="Agent or MCP server lacks input validation, potentially allowing injection attacks",
+            recommendation="Validate and sanitize all inputs from the agent or external sources.",
+            detect_patterns=["input", "prompt", "argument", "parameter", "validate", "sanitize"]
+        ),
+        Rule(
+            name="Package manager execution",
+            severity="high",
+            description="Agent config invokes package managers that can execute install scripts",
+            recommendation="Pin packages, disable lifecycle scripts where possible, and avoid dynamic package execution.",
+            detect_patterns=["npx", "uvx", "pipx", "bunx", "pnpm dlx", "npm exec"]
+        ),
+        Rule(
+            name="Container privileged mode",
+            severity="critical",
+            description="Containerized MCP server may run with elevated host privileges",
+            recommendation="Avoid privileged mode and host namespace sharing; use minimal container capabilities.",
+            detect_patterns=["privileged: true", "--privileged", "pid: host", "network_mode: host", "--network=host"]
+        ),
+        Rule(
+            name="Host mount exposure",
+            severity="critical",
+            description="MCP server or container mounts sensitive host directories",
+            recommendation="Mount only required project directories and prefer read-only mounts.",
+            detect_patterns=["/var/run/docker.sock", "/:/", "/home:/", "/root:/", "~:/", "/Users:/"]
+        ),
+        Rule(
+            name="Browser automation with local file access",
+            severity="high",
+            description="Agent config combines browser automation with local file access",
+            recommendation="Isolate browser automation from sensitive filesystem paths.",
+            detect_patterns=["playwright", "puppeteer", "browser", "filesystem", "file://"]
+        ),
+        Rule(
+            name="Dynamic code execution",
+            severity="critical",
+            description="Agent or MCP server can dynamically evaluate code",
+            recommendation="Avoid eval-style execution and route code execution through reviewed, sandboxed tools.",
+            detect_patterns=["eval(", "exec(", "new Function", "child_process.exec", "python -c", "node -e"]
+        ),
+        Rule(
+            name="Wildcard tool allowlist",
+            severity="high",
+            description="Agent config appears to allow all tools or permissions via wildcard",
+            recommendation="Use explicit allowlists for tools, paths, hosts, and permissions.",
+            detect_patterns=["allowed_tools: *", "allow_all", "allowed: [\"*\"]", "permissions: *", "tools: *"]
+        ),
+        Rule(
+            name="Telemetry or analytics endpoint",
+            severity="medium",
+            description="Agent or MCP server references telemetry or analytics endpoints",
+            recommendation="Ensure telemetry is opt-in and never includes prompts, secrets, or source code.",
+            detect_patterns=["telemetry", "analytics", "posthog", "segment", "sentry", "datadog"]
+        ),
+        Rule(
+            name="Credential helper access",
+            severity="high",
+            description="Agent config references credential stores or auth helpers",
+            recommendation="Do not expose credential helpers to agents; use scoped tokens with least privilege.",
+            detect_patterns=["credential.helper", "keychain", "secretservice", "wincred", "gh auth", "aws configure"]
+        ),
+    ]

agentsec/rules/base.py

@@ -0,0 +1,108 @@
+"""Base rule definitions."""
+
+from typing import List
+from pathlib import Path
+
+class Rule:
+    def __init__(
+        self,
+        name: str,
+        severity: str,
+        description: str,
+        recommendation: str,
+        detect_patterns: List[str],
+        all_patterns: List[str] | None = None,
+    ):
+        self.name = name
+        self.severity = severity
+        self.description = description
+        self.recommendation = recommendation
+        self.patterns = detect_patterns
+        self.all_patterns = all_patterns or []
+
+    def detect(self, content: str, file_path: Path) -> bool:
+        if not content:
+            return False
+        lower = content.lower()
+        if self.all_patterns:
+            return all(pattern.lower() in lower for pattern in self.all_patterns)
+        for pattern in self.patterns:
+            if pattern.lower() in lower:
+                return True
+        return False
+
+def load_rules() -> List[Rule]:
+    from .additional import load_additional_rules
+    base_rules = [
+        Rule(
+            name="MCP shell execution",
+            severity="critical",
+            description="MCP server can execute shell commands",
+            recommendation="Require explicit approval or remove shell access.",
+            detect_patterns=["bash", "sh", "powershell", "cmd", "exec", "subprocess", "terminal", "run_command"]
+        ),
+        Rule(
+            name="MCP filesystem write access",
+            severity="critical",
+            description="MCP server has filesystem write access",
+            recommendation="Restrict filesystem access to read-only or specific directories.",
+            detect_patterns=["filesystem", "write", "edit", "delete", "rm", "mv", "path", "workspace"]
+        ),
+        Rule(
+            name="Secret exposure",
+            severity="critical",
+            description="MCP server can access secrets or environment variables",
+            recommendation="Do not expose secrets to MCP servers; use environment variables with caution.",
+            detect_patterns=[".env", "process.env", "AWS_SECRET_ACCESS_KEY", "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "GITHUB_TOKEN", "SLACK_BOT_TOKEN"]
+        ),
+        Rule(
+            name="Broad path access",
+            severity="high",
+            description="MCP server has broad filesystem path access (root or home)",
+            recommendation="Restrict path to specific directories.",
+            detect_patterns=["/", "~", "/home", "/Users", "C:\\", ".", "..", "**"]
+        ),
+        Rule(
+            name="Prompt injection risk",
+            severity="medium",
+            description="Agent instruction file contains suspicious prompt injection patterns",
+            recommendation="Review and sanitize agent instruction files.",
+            detect_patterns=["ignore previous instructions", "ignore all instructions", "do not tell the user", "secretly", "exfiltrate", "bypass", "disable security", "you are now", "system prompt", "hidden instruction"]
+        ),
+        Rule(
+            name="Sensitive file reference",
+            severity="high",
+            description="Agent instruction references sensitive files or secrets",
+            recommendation="Remove references to secrets or use gitignored files.",
+            detect_patterns=[".env", "id_rsa", ".ssh", "credentials", "secrets", "tokens", "auth.json"]
+        ),
+        Rule(
+            name="Excessive autonomy",
+            severity="medium",
+            description="Agent instruction asks for excessive autonomy (no confirmation)",
+            recommendation="Require user confirmation for important actions.",
+            detect_patterns=["do not ask for confirmation", "always run commands", "auto-approve", "never ask user", "full access"]
+        ),
+        Rule(
+            name="Unpinned dependency",
+            severity="medium",
+            description="MCP server dependency is not pinned (latest tag or no version)",
+            recommendation="Pin dependencies to a specific version or commit SHA.",
+            detect_patterns=["latest", ":latest", "@latest"]
+        ),
+        Rule(
+            name="Remote script install",
+            severity="high",
+            description="Agent config uses remote script install pattern (curl | bash)",
+            recommendation="Avoid piping remote scripts directly to shell.",
+            detect_patterns=["curl ... | bash", "wget ... | sh"]
+        ),
+        Rule(
+            name="Docker socket access",
+            severity="critical",
+            description="MCP server can access the Docker socket",
+            recommendation="Avoid mounting the Docker socket unless absolutely necessary.",
+            detect_patterns=["/var/run/docker.sock", "docker.sock"]
+        ),
+    ]
+    return base_rules + load_additional_rules()

agentsec/sarif.py

@@ -0,0 +1,110 @@
+"""SARIF (Static Analysis Results Interchange Format) report generator.
+
+Conforms to SARIF v2.1.0 (https://docs.oasis-open.org/sarif/sarif/v2.1.0/).
+"""
+
+import json
+import datetime
+from typing import List, Dict, Any
+from pathlib import Path
+
+
+def generate_sarif(findings: List[Dict[str, Any]], repo_root: str = ".") -> Dict[str, Any]:
+    """Convert AgentSec findings to SARIF format."""
+    
+    rules = {}
+    results = []
+    
+    severity_mapping = {
+        "critical": 3.0,
+        "high": 2.0,
+        "medium": 1.0,
+        "low": 0.5,
+    }
+    
+    for idx, finding in enumerate(findings):
+        rule_id = finding['rule'].replace(" ", "_").lower()
+        
+        if rule_id not in rules:
+            desc = finding['description']
+            owasp = finding.get('owasp', '')
+            full_desc = desc
+            if owasp:
+                full_desc = f"[{owasp}] {desc}"
+            
+            rules[rule_id] = {
+                "id": rule_id,
+                "shortDescription": {"text": finding['rule']},
+                "fullDescription": {"text": full_desc},
+                "defaultConfiguration": {"level": "warning"},
+                "help": {
+                    "text": finding['recommendation'],
+                    "markdown": f"**Recommendation:** {finding['recommendation']}"
+                },
+                "properties": {
+                    "precision": "very-high",
+                    "security-severity": str(severity_mapping.get(finding['severity'].lower(), 1.0)),
+                }
+            }
+            if owasp:
+                rules[rule_id]["properties"]["owasp"] = owasp
+        
+        result = {
+            "ruleId": rule_id,
+            "level": "warning" if finding['severity'].lower() in ["medium", "low"] else "error",
+            "message": {
+                "text": f"{finding['description']} — {finding['recommendation']}"
+            },
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {
+                            "uri": finding['file']
+                        },
+                        "region": {
+                            "startLine": 1,
+                            "endLine": 1
+                        }
+                    }
+                }
+            ],
+            "properties": {
+                "severity": finding['severity'].upper(),
+            }
+        }
+        if finding.get('owasp'):
+            result["properties"]["owasp"] = finding['owasp']
+        if finding.get('server'):
+            result["properties"]["server"] = finding['server']
+        
+        results.append(result)
+    
+    sarif_doc = {
+        "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "AgentSec",
+                        "organization": "AgentSec",
+                        "informationUri": "https://github.com/locface/AgentSec",
+                        "rules": list(rules.values()),
+                        "version": "0.2.0"
+                    }
+                },
+                "results": results,
+                "properties": {
+                    "startTimeUtc": datetime.datetime.now(datetime.UTC).isoformat().replace("+00:00", "Z")
+                }
+            }
+        ]
+    }
+    
+    return sarif_doc
+
+
+def print_sarif(findings: List[Dict[str, Any]], repo_root: str = ".") -> None:
+    """Print SARIF report to stdout."""
+    sarif = generate_sarif(findings, repo_root)
+    print(json.dumps(sarif, indent=2))

agentsec/scanner.py

@@ -0,0 +1,119 @@
+"""Main scanner orchestrator."""
+from pathlib import Path
+from typing import List, Dict, Any
+from .rules import Rule, load_rules
+from .parsers import parse_file
+from .parsers.json_parser import parse_mcp_config as parse_json_mcp
+from .parsers.yaml_parser import parse_mcp_config as parse_yaml_mcp
+from .parsers.toml_parser import parse_mcp_config as parse_toml_mcp
+from .owasp import get_owasp_ids
+
+class Scanner:
+    def __init__(self, root: Path, include_hidden: bool = False, min_severity: str = "all"):
+        self.root = root
+        self.include_hidden = include_hidden
+        self.min_severity = min_severity
+        self.rules = load_rules()
+
+    def scan(self) -> List[Dict[str, Any]]:
+        """Walk the directory, parse relevant files, and apply rules."""
+        findings = []
+        target_patterns = [
+            "mcp.json", "mcp.yaml", "mcp.yml", "mcp.toml",
+            "mcp-config.json", "claude_desktop_config.json", "settings.json",
+            "AGENTS.md", "CLAUDE.md", ".cursorrules", ".cursor/rules",
+            ".cursor", "cline_mcp", ".clinerules", "codex.toml",
+            ".env", ".env.example",
+            "docker-compose.yml", "Dockerfile",
+            "package.json", "requirements.txt"
+        ]
+        mcp_patterns = [
+            "mcp.json", "mcp.yaml", "mcp.yml", "mcp.toml",
+            "mcp-config.json", "claude_desktop_config.json", "settings.json", "cline_mcp"
+        ]
+        
+        for file_path in self.root.rglob("*"):
+            if not file_path.is_file():
+                continue
+            if not self.include_hidden and file_path.name.startswith(".") and file_path.name not in [".env", ".env.example"]:
+                continue
+            
+            if not any(p in str(file_path) for p in target_patterns):
+                continue
+
+            content = parse_file(file_path)
+            if content is None:
+                continue
+
+            if any(mcp_pattern in str(file_path) for mcp_pattern in mcp_patterns):
+                mcp_data = None
+                if file_path.suffix == ".json":
+                    mcp_data = parse_json_mcp(content, file_path)
+                elif file_path.suffix in [".yaml", ".yml"]:
+                    mcp_data = parse_yaml_mcp(content, file_path)
+                elif file_path.suffix == ".toml":
+                    mcp_data = parse_toml_mcp(content, file_path)
+                if mcp_data:
+                    for server in mcp_data:
+                        for rule in self.rules:
+                            if self._apply_rule_to_mcp_server(rule, server):
+                                findings.append(self._make_finding(file_path, rule, server))
+            else:
+                for rule in self.rules:
+                    if rule.detect(content, file_path):
+                        findings.append(self._make_finding(file_path, rule))
+
+        return findings
+
+    def _make_finding(self, file_path: Path, rule: Rule, server: Dict[str, Any] | None = None) -> Dict[str, Any]:
+        """Build a finding dict with OWASP info."""
+        finding = {
+            "file": str(file_path),
+            "rule": rule.name,
+            "severity": rule.severity,
+            "description": rule.description,
+            "recommendation": rule.recommendation,
+            "owasp": get_owasp_ids(rule.name),
+        }
+        if server:
+            finding["server"] = server.get("name", "unknown")
+        return finding
+
+    def _apply_rule_to_mcp_server(self, rule: Rule, server: Dict[str, Any]) -> bool:
+        """Apply a rule to a structured MCP server entry."""
+        if rule.name == "MCP shell execution":
+            command = server.get("command", "").lower()
+            args = " ".join(server.get("args", [])).lower()
+            shell_indicators = ["bash", "sh", "powershell", "cmd", "zsh", "fish"]
+            if any(ind in command or ind in args for ind in shell_indicators):
+                return True
+            return False
+
+        if rule.name == "MCP filesystem write access":
+            args = " ".join(server.get("args", [])).lower()
+            if server.get("command", "") == "npx" and "@modelcontextprotocol/server-filesystem" in args:
+                return True
+            write_indicators = ["write", "edit", "delete", "rm", "mv"]
+            if any(ind in args for ind in write_indicators):
+                return True
+            return False
+
+        if rule.name == "Secret exposure":
+            args = " ".join(server.get("args", [])).lower()
+            secret_patterns = [".env", "process.env", "aws_secret", "openai_api", "anthropic_api", "github_token", "slack_token"]
+            if any(p in args for p in secret_patterns):
+                return True
+            return False
+
+        if rule.name == "Broad path access":
+            args = " ".join(server.get("args", [])).lower()
+            if "/" in args or ".." in args or "~" in args:
+                return True
+            return False
+
+        if rule.name == "Claude Desktop config with MCP server risks":
+            server_text = str(server).lower()
+            risky_indicators = ["filesystem", "shell", "bash", "network", "http", "https", "curl", "wget"]
+            return any(indicator in server_text for indicator in risky_indicators)
+
+        return rule.detect(str(server), Path("mcp"))