agentsentinel-cli 0.7.0__tar.gz → 0.7.2__tar.gz

{agentsentinel_cli-0.7.0 → agentsentinel_cli-0.7.2}/.gitignore

@@ -39,3 +39,6 @@ Thumbs.db
 .vscode/
 *.swp
 ~$*
+
+# Local documentation (not for commit)
+doc/

{agentsentinel_cli-0.7.0 → agentsentinel_cli-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsentinel-cli
-Version: 0.7.0
+Version: 0.7.2
 Summary: Agentic security CLI — AI analyst with memory, supply chain audit, MCP audit, red-team probing, and agent discovery
 Project-URL: Homepage, https://github.com/jaydenaung/agentsentinel-cli
 Project-URL: Repository, https://github.com/jaydenaung/agentsentinel-cli
@@ -51,7 +51,7 @@ Description-Content-Type: text/markdown
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![Python](https://img.shields.io/pypi/pyversions/agentsentinel-cli)](https://pypi.org/project/agentsentinel-cli/)
 
-**AI agent security — analyst mode, static rules, red-team probing, and MCP auditing. No server. No Docker. One install.**
+**AI agent security — analyst mode, multi-agent trust analysis, static rules, red-team probing, and MCP auditing. No server. No Docker. One install.**
 
 ```bash
 pipx install "agentsentinel-cli[all]"
@@ -61,7 +61,7 @@ pipx install "agentsentinel-cli[all]"
 
 ## What it does
 
-`sentinel` covers 8 of the 10 risks in the [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/).
+`sentinel` covers 9 of the 10 risks in the [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/).
 
 It operates at two levels:
 
@@ -83,6 +83,10 @@ sentinel agentic ./my-agent/
 sentinel supply-chain http://localhost:3001
 sentinel supply-chain http://localhost:3001 --ai   # + Claude semantic analysis
 
+# Multi-agent trust analysis — detect A2A trust violations in your codebase
+sentinel a2a ./agents/
+sentinel a2a multi_agent.py --fail-on HIGH
+
 # Static posture scan
 sentinel scan my_agent.py
 sentinel secrets .
@@ -300,6 +304,54 @@ sentinel discover --format json
 
 ---
 
+### `sentinel a2a` — multi-agent trust analysis
+
+Scans Python agent source files and builds a call graph showing which agents call which, then audits the trust boundaries between them. Detects the attack paths that single-agent tools miss entirely: injection that propagates across agent boundaries, unbounded agent spawning, and code-execution agents that accept delegated instructions without verification.
+
+Supports **LangChain / LangGraph**, **AutoGen**, and **CrewAI**. No API key required.
+
+```bash
+sentinel a2a ./agents/
+sentinel a2a multi_agent.py
+sentinel a2a . --fail-on HIGH
+sentinel a2a . --format json
+sentinel a2a . --ignore-rule A2A01_UNVERIFIED_ORCHESTRATOR  # suppress if handled at infra layer
+```
+
+**Rules:**
+
+| Rule | Severity | What it catches |
+|------|----------|-----------------|
+| `A2A03_IMPLICIT_TRUST` | CRITICAL | Code-execution agent accepts calls from other agents with no caller verification |
+| `A2A04_PROMPT_PASSTHROUGH` | HIGH | User input flows directly across an agent boundary without sanitization |
+| `A2A02_UNBOUNDED_SPAWNING` | HIGH | Agent is instantiated inside a loop — unbounded agent creation risk |
+| `A2A06_CIRCULAR_DELEGATION` | HIGH | Cycle in the call graph — agents can loop indefinitely under injection |
+| `A2A05_UNSCOPED_DELEGATION` | MEDIUM | Orchestrator delegates its full tool set to a sub-agent instead of a restricted subset |
+| `A2A01_UNVERIFIED_ORCHESTRATOR` | LOW | Agents receive instructions from other agents with no visible trust verification |
+
+**Example output:**
+
+```
+  2 agents  1 edges  1 max depth  acyclic
+
+  Agent         Framework   Role          Tools
+  planner       autogen     worker        —
+  executor      autogen     orchestrator  —    ⚠ code exec
+
+  Call graph:
+    executor ──► planner  initiate_chat  passes input
+
+  ● HIGH      A2A04_PROMPT_PASSTHROUGH  ASI01
+              User input flows directly from 'executor' to 'planner'
+              without sanitization at the agent boundary.
+
+  Trust Score   75/100  ███████████████░░░░░  WATCH
+```
+
+Covers **ASI07** (Insecure Inter-Agent Communication) from OWASP Top 10 for Agentic Applications 2026.
+
+---
+
 ## Finding suppression
 
 Use `--ignore-rule` to suppress specific findings by rule ID. Suppressed findings are excluded from `--fail-on` evaluation and output — they don't break CI gates.
@@ -325,7 +377,7 @@ SC03_HIDDEN_NETWORK_FIELDS  # webhook field verified safe — used for audit log
 NO_AUTH                     # server is behind an authenticated reverse proxy
 ```
 
-Supported on: `sentinel scan`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel secrets`, `sentinel inspect`.
+Supported on: `sentinel scan`, `sentinel a2a`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel secrets`, `sentinel inspect`.
 
 ---
 
@@ -339,7 +391,7 @@ Supported on: `sentinel scan`, `sentinel mcp scan`, `sentinel supply-chain`, `se
 | **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI), **`sentinel agentic`** |
 | Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` |
 | **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination), **`sentinel agentic`** |
-| Insecure Inter-Agent Communication | ASI07 | `sentinel agentic` (reasoning layer) |
+| **Insecure Inter-Agent Communication** | **ASI07** | **`sentinel a2a`** (call graph + trust rules), `sentinel agentic` (semantic reasoning) |
 | Cascading Agent Failures | ASI08 | `sentinel agentic` (cross-finding chain analysis) |
 | Human-Agent Trust Exploitation | ASI09 | `sentinel agentic` (narrative + evidence standard) |
 | Rogue Agents | ASI10 | `sentinel agentic` (drift detection across sessions) |
@@ -373,6 +425,9 @@ jobs:
 
       - name: MCP security audit
         run: sentinel mcp scan http://localhost:3001 --fail-on CRITICAL
+
+      - name: Multi-agent trust analysis
+        run: sentinel a2a ./agents/ --fail-on HIGH
 ```
 
 Use a `.sentinelignore` file at the repo root to suppress known-accepted findings without weakening the gate threshold:
@@ -393,6 +448,7 @@ MISSING_RATE_LIMIT    # rate limiting handled at infra layer
 | Investigating a specific server or codebase | `sentinel agentic` |
 | First assessment of a new MCP server | `sentinel agentic` |
 | Scheduled nightly security check | `sentinel agentic` (memory tracks drift) |
+| Auditing a multi-agent codebase | `sentinel a2a` (call graph + trust rules) |
 | Quick local sanity check | `sentinel mcp scan`, `sentinel scan` |
 | Red-teaming a live agent endpoint | `sentinel ai-probe` |
 
@@ -402,7 +458,7 @@ MISSING_RATE_LIMIT    # rate limiting handled at infra layer
 
 - Python 3.10+
 - `ANTHROPIC_API_KEY` required for: `sentinel agentic`, `sentinel ai-probe`, `sentinel supply-chain --ai`, `sentinel inspect` (AI summary)
-- No API key required for: `sentinel scan`, `sentinel secrets`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel probe`, `sentinel discover`, `sentinel inspect --no-ai`
+- No API key required for: `sentinel scan`, `sentinel a2a`, `sentinel secrets`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel probe`, `sentinel discover`, `sentinel inspect --no-ai`
 
 ---
 

{agentsentinel_cli-0.7.0 → agentsentinel_cli-0.7.2}/README.md

@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 [![Python](https://img.shields.io/pypi/pyversions/agentsentinel-cli)](https://pypi.org/project/agentsentinel-cli/)
 
-**AI agent security — analyst mode, static rules, red-team probing, and MCP auditing. No server. No Docker. One install.**
+**AI agent security — analyst mode, multi-agent trust analysis, static rules, red-team probing, and MCP auditing. No server. No Docker. One install.**
 
 ```bash
 pipx install "agentsentinel-cli[all]"
@@ -14,7 +14,7 @@ pipx install "agentsentinel-cli[all]"
 
 ## What it does
 
-`sentinel` covers 8 of the 10 risks in the [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/).
+`sentinel` covers 9 of the 10 risks in the [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/).
 
 It operates at two levels:
 
@@ -36,6 +36,10 @@ sentinel agentic ./my-agent/
 sentinel supply-chain http://localhost:3001
 sentinel supply-chain http://localhost:3001 --ai   # + Claude semantic analysis
 
+# Multi-agent trust analysis — detect A2A trust violations in your codebase
+sentinel a2a ./agents/
+sentinel a2a multi_agent.py --fail-on HIGH
+
 # Static posture scan
 sentinel scan my_agent.py
 sentinel secrets .
@@ -253,6 +257,54 @@ sentinel discover --format json
 
 ---
 
+### `sentinel a2a` — multi-agent trust analysis
+
+Scans Python agent source files and builds a call graph showing which agents call which, then audits the trust boundaries between them. Detects the attack paths that single-agent tools miss entirely: injection that propagates across agent boundaries, unbounded agent spawning, and code-execution agents that accept delegated instructions without verification.
+
+Supports **LangChain / LangGraph**, **AutoGen**, and **CrewAI**. No API key required.
+
+```bash
+sentinel a2a ./agents/
+sentinel a2a multi_agent.py
+sentinel a2a . --fail-on HIGH
+sentinel a2a . --format json
+sentinel a2a . --ignore-rule A2A01_UNVERIFIED_ORCHESTRATOR  # suppress if handled at infra layer
+```
+
+**Rules:**
+
+| Rule | Severity | What it catches |
+|------|----------|-----------------|
+| `A2A03_IMPLICIT_TRUST` | CRITICAL | Code-execution agent accepts calls from other agents with no caller verification |
+| `A2A04_PROMPT_PASSTHROUGH` | HIGH | User input flows directly across an agent boundary without sanitization |
+| `A2A02_UNBOUNDED_SPAWNING` | HIGH | Agent is instantiated inside a loop — unbounded agent creation risk |
+| `A2A06_CIRCULAR_DELEGATION` | HIGH | Cycle in the call graph — agents can loop indefinitely under injection |
+| `A2A05_UNSCOPED_DELEGATION` | MEDIUM | Orchestrator delegates its full tool set to a sub-agent instead of a restricted subset |
+| `A2A01_UNVERIFIED_ORCHESTRATOR` | LOW | Agents receive instructions from other agents with no visible trust verification |
+
+**Example output:**
+
+```
+  2 agents  1 edges  1 max depth  acyclic
+
+  Agent         Framework   Role          Tools
+  planner       autogen     worker        —
+  executor      autogen     orchestrator  —    ⚠ code exec
+
+  Call graph:
+    executor ──► planner  initiate_chat  passes input
+
+  ● HIGH      A2A04_PROMPT_PASSTHROUGH  ASI01
+              User input flows directly from 'executor' to 'planner'
+              without sanitization at the agent boundary.
+
+  Trust Score   75/100  ███████████████░░░░░  WATCH
+```
+
+Covers **ASI07** (Insecure Inter-Agent Communication) from OWASP Top 10 for Agentic Applications 2026.
+
+---
+
 ## Finding suppression
 
 Use `--ignore-rule` to suppress specific findings by rule ID. Suppressed findings are excluded from `--fail-on` evaluation and output — they don't break CI gates.
@@ -278,7 +330,7 @@ SC03_HIDDEN_NETWORK_FIELDS  # webhook field verified safe — used for audit log
 NO_AUTH                     # server is behind an authenticated reverse proxy
 ```
 
-Supported on: `sentinel scan`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel secrets`, `sentinel inspect`.
+Supported on: `sentinel scan`, `sentinel a2a`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel secrets`, `sentinel inspect`.
 
 ---
 
@@ -292,7 +344,7 @@ Supported on: `sentinel scan`, `sentinel mcp scan`, `sentinel supply-chain`, `se
 | **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI), **`sentinel agentic`** |
 | Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` |
 | **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination), **`sentinel agentic`** |
-| Insecure Inter-Agent Communication | ASI07 | `sentinel agentic` (reasoning layer) |
+| **Insecure Inter-Agent Communication** | **ASI07** | **`sentinel a2a`** (call graph + trust rules), `sentinel agentic` (semantic reasoning) |
 | Cascading Agent Failures | ASI08 | `sentinel agentic` (cross-finding chain analysis) |
 | Human-Agent Trust Exploitation | ASI09 | `sentinel agentic` (narrative + evidence standard) |
 | Rogue Agents | ASI10 | `sentinel agentic` (drift detection across sessions) |
@@ -326,6 +378,9 @@ jobs:
 
       - name: MCP security audit
         run: sentinel mcp scan http://localhost:3001 --fail-on CRITICAL
+
+      - name: Multi-agent trust analysis
+        run: sentinel a2a ./agents/ --fail-on HIGH
 ```
 
 Use a `.sentinelignore` file at the repo root to suppress known-accepted findings without weakening the gate threshold:
@@ -346,6 +401,7 @@ MISSING_RATE_LIMIT    # rate limiting handled at infra layer
 | Investigating a specific server or codebase | `sentinel agentic` |
 | First assessment of a new MCP server | `sentinel agentic` |
 | Scheduled nightly security check | `sentinel agentic` (memory tracks drift) |
+| Auditing a multi-agent codebase | `sentinel a2a` (call graph + trust rules) |
 | Quick local sanity check | `sentinel mcp scan`, `sentinel scan` |
 | Red-teaming a live agent endpoint | `sentinel ai-probe` |
 
@@ -355,7 +411,7 @@ MISSING_RATE_LIMIT    # rate limiting handled at infra layer
 
 - Python 3.10+
 - `ANTHROPIC_API_KEY` required for: `sentinel agentic`, `sentinel ai-probe`, `sentinel supply-chain --ai`, `sentinel inspect` (AI summary)
-- No API key required for: `sentinel scan`, `sentinel secrets`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel probe`, `sentinel discover`, `sentinel inspect --no-ai`
+- No API key required for: `sentinel scan`, `sentinel a2a`, `sentinel secrets`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel probe`, `sentinel discover`, `sentinel inspect --no-ai`
 
 ---
 

{agentsentinel_cli-0.7.0 → agentsentinel_cli-0.7.2}/agentsentinel_cli/cli.py

@@ -123,45 +123,46 @@ def _enrich_from_platform(agents, scores_map, connect_url, api_key):
 
 @main.command()
 @click.option("--process/--no-process", default=True, show_default=True,
-              help="Scan running processes for LLM API usage.")
+              help="Scan running processes for MCP servers and agent signals.")
 @click.option("--network/--no-network", default=True, show_default=True,
-              help="Probe local ports for MCP servers and agent APIs.")
+              help="Probe local ports — confirmed via MCP protocol handshake.")
 @click.option("--docker/--no-docker", default=False, show_default=True,
-              help="Inspect running Docker containers.")
-@click.option("--path", "scan_path", default=None, type=click.Path(exists=True, path_type=Path),
-              metavar="DIR", help="Scan a directory for agent source files.")
+              help="Inspect running Docker containers for MCP/agent patterns.")
 @click.option("--subnet", default=None, metavar="CIDR",
-              help="Scan a CIDR subnet for AI agent endpoints, e.g. 10.0.0.0/24.")
+              help="Scan a CIDR subnet for MCP servers, e.g. 10.0.0.0/24.")
 @click.option("--ports", default=None, metavar="RANGE",
-              help="Custom port range for network scan, e.g. 8000-9001. Defaults to common agent ports.")
+              help="Custom port range, e.g. 8000-9001. Defaults to common MCP/agent ports.")
+@click.option("--auth-header", "auth_header", default=None, metavar="HEADER",
+              help="HTTP auth header for MCP handshakes, e.g. 'Authorization: Bearer token'.")
 @click.option("--format", "fmt", type=click.Choice(["text", "json"]), default="text",
               help="Output format.")
 @click.option("--verbose", "-v", is_flag=True, default=False,
-              help="Show full details per discovered agent.")
+              help="Show full details per discovered server.")
 def discover(
     process: bool,
     network: bool,
     docker: bool,
-    scan_path: Path | None,
     subnet: str | None,
     ports: str | None,
+    auth_header: str | None,
     fmt: str,
     verbose: bool,
 ) -> None:
-    """Find AI agents running in your environment.
+    """Find MCP servers and AI agent processes in your environment.
 
-    Scans running processes, local network ports, source files, and Docker
-    containers to surface AI agents — including unmonitored ones.
+    Confirms MCP servers via protocol handshake — not just open ports.
+    Use --subnet to scan across a network range.
 
     \b
     Examples:
-        sentinel discover                        scan processes + network
-        sentinel discover --docker               include Docker containers
-        sentinel discover --path ./agents        scan a source directory
-        sentinel discover --subnet 10.0.0.0/24   scan internal subnet
-        sentinel discover --no-process           network scan only
-        sentinel discover --ports 8000-9001      custom port range
-        sentinel discover --format json          machine-readable output
+        sentinel discover                              local processes + ports
+        sentinel discover --subnet 10.0.0.0/24        scan internal network
+        sentinel discover --subnet 10.0.0.0/24 \\
+          --auth-header 'Authorization: Bearer token'  scan with credentials
+        sentinel discover --no-process                 network only
+        sentinel discover --docker                     include containers
+        sentinel discover --ports 8000-9001            custom port range
+        sentinel discover --format json                machine-readable output
     """
     from agentsentinel_cli.discover import run_discovery, as_json as discover_json
     from agentsentinel_cli.discover_report import print_discover_result, print_subnet_progress
@@ -169,6 +170,15 @@ def discover(
     # Parse port range
     port_list = _parse_ports(ports) if ports else None
 
+    # Parse auth header
+    extra_headers: dict[str, str] = {}
+    if auth_header:
+        if ":" not in auth_header:
+            console.print("[red]Error:[/red] --auth-header must be 'Header-Name: value' format.")
+            sys.exit(1)
+        key, _, val = auth_header.partition(":")
+        extra_headers[key.strip()] = val.strip()
+
     # Collect active scan vectors for the header
     vectors = []
     if process:
@@ -177,14 +187,12 @@ def discover(
         vectors.append("network")
     if subnet:
         vectors.append(f"subnet ({subnet})")
-    if scan_path:
-        vectors.append(f"files ({scan_path})")
     if docker:
         vectors.append("docker")
 
     if not vectors:
         console.print("[yellow]No scan vectors selected — use at least one of: "
-                      "--process, --network, --subnet, --path, --docker[/yellow]")
+                      "--process, --network, --subnet, --docker[/yellow]")
         sys.exit(1)
 
     if fmt == "text":
@@ -197,9 +205,9 @@ def discover(
         do_process=process,
         do_network=network,
         do_docker=docker,
-        scan_path=scan_path,
         ports=port_list,
         subnet=subnet,
+        extra_headers=extra_headers or None,
         subnet_progress_cb=progress_cb,
     )