agentsentinel-cli 0.7.4__tar.gz → 0.7.5__tar.gz

{agentsentinel_cli-0.7.4 → agentsentinel_cli-0.7.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsentinel-cli
-Version: 0.7.4
+Version: 0.7.5
 Summary: Agentic security CLI — AI analyst with memory, supply chain audit, MCP audit, red-team probing, and agent discovery
 Project-URL: Homepage, https://github.com/jaydenaung/agentsentinel-cli
 Project-URL: Repository, https://github.com/jaydenaung/agentsentinel-cli

{agentsentinel_cli-0.7.4 → agentsentinel_cli-0.7.5}/agentsentinel_cli/cli.py

@@ -119,6 +119,60 @@ def _enrich_from_platform(agents, scores_map, connect_url, api_key):
         console.print(f"  [dim yellow]Warning: could not connect to AgentSentinel: {exc}[/dim yellow]")
 
 
+# ── sentinel discover helpers ────────────────────────────────────────────────
+
+def _deep_scan_agents(agents: list, extra_headers: dict | None) -> None:
+    """Run mcp scan rules on every confirmed network MCP server from a discover run."""
+    from agentsentinel_cli.discover import DiscoveredAgent
+    from agentsentinel_cli.mcp_client import scan_http, McpAuthRequired, McpError
+    from agentsentinel_cli.mcp_rules import McpContext, run_mcp_rules, mcp_posture_score
+    from agentsentinel_cli.mcp_report import print_mcp_result
+    from agentsentinel_cli import suppress as _suppress
+
+    network_agents = [a for a in agents if a.source == "network"]
+    if not network_agents:
+        return
+
+    console.print()
+    console.rule("[bold bright_blue]DEEP SCAN[/bold bright_blue]", style="bright_blue")
+
+    sup_rules = _suppress.load_ignore_file(Path.cwd())
+
+    for agent in network_agents:
+        base = f"http://{agent.location}"
+        scan_url = f"{base}/sse" if agent.transport == "sse" else base
+
+        # Auth-required servers need credentials — skip silently if none provided
+        if not agent.tools and not extra_headers:
+            console.print(
+                f"\n  [dim]Skipping {agent.location} — auth required, "
+                f"use --auth-header to deep scan[/dim]"
+            )
+            continue
+
+        try:
+            server = scan_http(scan_url, extra_headers=extra_headers, timeout=15)
+        except McpAuthRequired:
+            console.print(
+                f"\n  [dim]Skipping {agent.location} — credentials rejected[/dim]"
+            )
+            continue
+        except (McpError, Exception):
+            console.print(
+                f"\n  [dim]Skipping {agent.location} — could not reconnect[/dim]"
+            )
+            continue
+
+        # auth_required: True when the server actually enforces auth (risk LOW/MEDIUM)
+        auth_required = agent.risk in ("LOW", "MEDIUM")
+        ctx = McpContext(server=server, auth_required=auth_required)
+        findings = run_mcp_rules(ctx)
+        findings, _ = _suppress.apply(findings, sup_rules)
+        score = mcp_posture_score(findings)
+
+        print_mcp_result(ctx, findings, score, scan_url)
+
+
 # ── sentinel discover ─────────────────────────────────────────────────────────
 
 @main.command()
@@ -136,6 +190,8 @@ def _enrich_from_platform(agents, scores_map, connect_url, api_key):
               help="Custom port range, e.g. 8000-9001. Defaults to common MCP/agent ports.")
 @click.option("--auth-header", "auth_header", default=None, metavar="HEADER",
               help="HTTP auth header for MCP handshakes, e.g. 'Authorization: Bearer token'.")
+@click.option("--scan", "do_scan", is_flag=True, default=False,
+              help="Deep-scan every confirmed MCP server with sentinel mcp scan rules.")
 @click.option("--format", "fmt", type=click.Choice(["text", "json"]), default="text",
               help="Output format.")
 @click.option("--verbose", "-v", is_flag=True, default=False,
@@ -148,17 +204,20 @@ def discover(
     subnet: str | None,
     ports: str | None,
     auth_header: str | None,
+    do_scan: bool,
     fmt: str,
     verbose: bool,
 ) -> None:
     """Find MCP servers and AI agent processes in your environment.
 
     Confirms MCP servers via protocol handshake — not just open ports.
+    Add --scan to deep-audit every confirmed server in the same run.
 
     \b
     Examples:
         sentinel discover                              local processes + ports
         sentinel discover --host 10.0.1.45            single remote host
+        sentinel discover --host 10.0.1.45 --scan     discover + deep audit
         sentinel discover --subnet 10.0.0.0/24        full subnet scan
         sentinel discover --subnet 10.0.0.0/24 \\
           --auth-header 'Authorization: Bearer token'  scan with credentials
@@ -195,6 +254,8 @@ def discover(
             click.echo(discover_json(agents))
             return
         print_discover_result(agents, vectors=[f"host ({host})"], verbose=verbose)
+        if do_scan:
+            _deep_scan_agents(agents, extra_headers or None)
         if any(a.risk == "CRITICAL" for a in agents):
             sys.exit(1)
         return
@@ -237,6 +298,9 @@ def discover(
 
     print_discover_result(agents, vectors=vectors, verbose=verbose, subnet_stats=subnet_stats)
 
+    if do_scan:
+        _deep_scan_agents(agents, extra_headers or None)
+
     # Exit 1 if any CRITICAL agents found (useful for CI)
     if any(a.risk == "CRITICAL" for a in agents):
         sys.exit(1)

{agentsentinel_cli-0.7.4 → agentsentinel_cli-0.7.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentsentinel-cli"
-version = "0.7.4"
+version = "0.7.5"
 description = "Agentic security CLI — AI analyst with memory, supply chain audit, MCP audit, red-team probing, and agent discovery"
 readme = "README.md"
 requires-python = ">=3.10"

agentsentinel_cli-0.7.5/tmp/note.md

@@ -0,0 +1,16 @@
+# Notes
+  ls dist/
+
+python3.11 -m build 
+twine upload dist/agentsentinel_cli-0.7.3* --username __token__ --password $PYPI_TOKEN
+
+lsof -i :8000
+lsof -ti :8000
+
+kill $(lsof -ti :8000)
+
+kill -9 $(lsof -ti :8000)
+
+  nsenter -t <PID> -m -u -i -n -p -- /bin/bash
+
+    ps -p <PID> -o pid,ppid,command

agentsentinel_cli-0.7.4/tmp/note.md

@@ -1,4 +0,0 @@
-# Notes
-
-python3.11 -m build 
-twine upload dist/agentsentinel_cli-0.7.3* --username __token__ --password $PYPI_TOKEN