agentsentinel-cli 0.7.4__tar.gz → 0.7.6__tar.gz

{agentsentinel_cli-0.7.4 → agentsentinel_cli-0.7.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsentinel-cli
-Version: 0.7.4
+Version: 0.7.6
 Summary: Agentic security CLI — AI analyst with memory, supply chain audit, MCP audit, red-team probing, and agent discovery
 Project-URL: Homepage, https://github.com/jaydenaung/agentsentinel-cli
 Project-URL: Repository, https://github.com/jaydenaung/agentsentinel-cli

{agentsentinel_cli-0.7.4 → agentsentinel_cli-0.7.6}/agentsentinel_cli/a2a_rules.py

@@ -269,7 +269,6 @@ _ALL_RULES = [
     _rule_prompt_passthrough,
     _rule_implicit_trust_with_code_exec,
     _rule_unscoped_delegation,
-    _rule_unverified_orchestrator,
 ]
 
 _SEVERITY_WEIGHT = {"CRITICAL": 40, "HIGH": 20, "MEDIUM": 10, "LOW": 5}

{agentsentinel_cli-0.7.4 → agentsentinel_cli-0.7.6}/agentsentinel_cli/cli.py

@@ -119,6 +119,60 @@ def _enrich_from_platform(agents, scores_map, connect_url, api_key):
         console.print(f"  [dim yellow]Warning: could not connect to AgentSentinel: {exc}[/dim yellow]")
 
 
+# ── sentinel discover helpers ────────────────────────────────────────────────
+
+def _deep_scan_agents(agents: list, extra_headers: dict | None) -> None:
+    """Run mcp scan rules on every confirmed network MCP server from a discover run."""
+    from agentsentinel_cli.discover import DiscoveredAgent
+    from agentsentinel_cli.mcp_client import scan_http, McpAuthRequired, McpError
+    from agentsentinel_cli.mcp_rules import McpContext, run_mcp_rules, mcp_posture_score
+    from agentsentinel_cli.mcp_report import print_mcp_result
+    from agentsentinel_cli import suppress as _suppress
+
+    network_agents = [a for a in agents if a.source == "network"]
+    if not network_agents:
+        return
+
+    console.print()
+    console.rule("[bold bright_blue]DEEP SCAN[/bold bright_blue]", style="bright_blue")
+
+    sup_rules = _suppress.load_ignore_file(Path.cwd())
+
+    for agent in network_agents:
+        base = f"http://{agent.location}"
+        scan_url = f"{base}/sse" if agent.transport == "sse" else base
+
+        # Auth-required servers need credentials — skip silently if none provided
+        if not agent.tools and not extra_headers:
+            console.print(
+                f"\n  [dim]Skipping {agent.location} — auth required, "
+                f"use --auth-header to deep scan[/dim]"
+            )
+            continue
+
+        try:
+            server = scan_http(scan_url, extra_headers=extra_headers, timeout=15)
+        except McpAuthRequired:
+            console.print(
+                f"\n  [dim]Skipping {agent.location} — credentials rejected[/dim]"
+            )
+            continue
+        except (McpError, Exception):
+            console.print(
+                f"\n  [dim]Skipping {agent.location} — could not reconnect[/dim]"
+            )
+            continue
+
+        # auth_required: True when the server actually enforces auth (risk LOW/MEDIUM)
+        auth_required = agent.risk in ("LOW", "MEDIUM")
+        ctx = McpContext(server=server, auth_required=auth_required)
+        findings = run_mcp_rules(ctx)
+        findings, _ = _suppress.apply(findings, sup_rules)
+        score = mcp_posture_score(findings)
+
+        print_mcp_result(ctx, findings, score, scan_url)
+
+
 # ── sentinel discover ─────────────────────────────────────────────────────────
 
 @main.command()
@@ -136,6 +190,8 @@ def _enrich_from_platform(agents, scores_map, connect_url, api_key):
               help="Custom port range, e.g. 8000-9001. Defaults to common MCP/agent ports.")
 @click.option("--auth-header", "auth_header", default=None, metavar="HEADER",
               help="HTTP auth header for MCP handshakes, e.g. 'Authorization: Bearer token'.")
+@click.option("--scan", "do_scan", is_flag=True, default=False,
+              help="Deep-scan every confirmed MCP server with sentinel mcp scan rules.")
 @click.option("--format", "fmt", type=click.Choice(["text", "json"]), default="text",
               help="Output format.")
 @click.option("--verbose", "-v", is_flag=True, default=False,
@@ -148,17 +204,20 @@ def discover(
     subnet: str | None,
     ports: str | None,
     auth_header: str | None,
+    do_scan: bool,
     fmt: str,
     verbose: bool,
 ) -> None:
     """Find MCP servers and AI agent processes in your environment.
 
     Confirms MCP servers via protocol handshake — not just open ports.
+    Add --scan to deep-audit every confirmed server in the same run.
 
     \b
     Examples:
         sentinel discover                              local processes + ports
         sentinel discover --host 10.0.1.45            single remote host
+        sentinel discover --host 10.0.1.45 --scan     discover + deep audit
         sentinel discover --subnet 10.0.0.0/24        full subnet scan
         sentinel discover --subnet 10.0.0.0/24 \\
           --auth-header 'Authorization: Bearer token'  scan with credentials
@@ -195,6 +254,8 @@ def discover(
             click.echo(discover_json(agents))
             return
         print_discover_result(agents, vectors=[f"host ({host})"], verbose=verbose)
+        if do_scan:
+            _deep_scan_agents(agents, extra_headers or None)
         if any(a.risk == "CRITICAL" for a in agents):
             sys.exit(1)
         return
@@ -237,6 +298,9 @@ def discover(
 
     print_discover_result(agents, vectors=vectors, verbose=verbose, subnet_stats=subnet_stats)
 
+    if do_scan:
+        _deep_scan_agents(agents, extra_headers or None)
+
     # Exit 1 if any CRITICAL agents found (useful for CI)
     if any(a.risk == "CRITICAL" for a in agents):
         sys.exit(1)

{agentsentinel_cli-0.7.4 → agentsentinel_cli-0.7.6}/agentsentinel_cli/mcp_rules.py

@@ -114,15 +114,26 @@ def _rule_code_execution(ctx: McpContext) -> McpFinding | None:
 
 
 def _rule_unbounded_input(ctx: McpContext) -> McpFinding | None:
-    """HIGH: unconstrained string inputs increase injection payload surface. (OWASP LLM01)"""
+    """HIGH: dangerous string parameters have no input constraints. (OWASP LLM01)
+
+    Only flags parameters whose names suggest they feed dangerous operations —
+    shell commands, SQL queries, file paths, URLs, code. Generic string fields
+    (name, title, message, body) are not flagged.
+    """
+    _DANGEROUS_PARAMS = frozenset({
+        "command", "cmd", "shell", "shell_command",
+        "query", "sql", "sql_query", "expression",
+        "path", "file_path", "filepath", "filename", "directory", "dir",
+        "url", "uri", "endpoint", "webhook", "target",
+        "code", "script", "template", "prompt",
+    })
+
     unvalidated: list[str] = []
     for tool in ctx.server.tools:
-        schema = tool.input_schema
-        props = schema.get("properties", {})
-        if not props and schema.get("type") == "object":
-            unvalidated.append(f"{tool.name} (no schema)")
-            continue
+        props = tool.input_schema.get("properties", {})
         for prop_name, prop_def in props.items():
+            if prop_name.lower() not in _DANGEROUS_PARAMS:
+                continue
             if (
                 prop_def.get("type") == "string"
                 and "maxLength" not in prop_def
@@ -130,7 +141,6 @@ def _rule_unbounded_input(ctx: McpContext) -> McpFinding | None:
                 and "pattern" not in prop_def
             ):
                 unvalidated.append(f"{tool.name}.{prop_name}")
-                break
 
     if unvalidated:
         sample = unvalidated[:5]
@@ -139,24 +149,29 @@ def _rule_unbounded_input(ctx: McpContext) -> McpFinding | None:
             severity="HIGH",
             rule_id="UNBOUNDED_INPUT",
             message=(
-                "Tools accept unconstrained string inputs with no maxLength, enum, or pattern. "
-                "Injection payloads can be passed directly through tool arguments."
+                "Dangerous parameters (command, path, query, url, code) accept unconstrained "
+                "string input. No maxLength, enum, or pattern — injection payloads pass through directly."
             ),
-            detail=f"Unconstrained inputs: {', '.join(sample)}{suffix}",
+            detail=f"Unconstrained dangerous inputs: {', '.join(sample)}{suffix}",
         )
     return None
 
 
 def _rule_tool_sprawl(ctx: McpContext) -> McpFinding | None:
-    """MEDIUM: excessive tool count increases blast radius. (OWASP LLM06)"""
+    """MEDIUM: high tool count across many categories increases blast radius. (OWASP LLM06)
+
+    Requires BOTH high count AND diverse categories. A server with 14 file-system
+    tools is a focused file manager. A server with 12 tools spanning code execution,
+    email, database, and web is a broad attack surface.
+    """
     categories = {t.category for t in ctx.server.tools} - {"other"}
-    if len(ctx.server.tools) > 10 or len(categories) >= 5:
+    if len(ctx.server.tools) > 10 and len(categories) >= 5:
         return McpFinding(
             severity="MEDIUM",
             rule_id="TOOL_SPRAWL",
             message=(
-                f"Server exposes {len(ctx.server.tools)} tools across {len(categories)} categories. "
-                "Every tool is an attack surface — reduce to the minimum required."
+                f"Server exposes {len(ctx.server.tools)} tools across {len(categories)} "
+                "distinct categories. High cross-category diversity increases blast radius."
             ),
             detail=f"Categories: {', '.join(sorted(categories))}",
         )
@@ -164,33 +179,25 @@ def _rule_tool_sprawl(ctx: McpContext) -> McpFinding | None:
 
 
 def _rule_vague_descriptions(ctx: McpContext) -> McpFinding | None:
-    """MEDIUM: thin tool descriptions expand prompt injection surface. (OWASP LLM01)"""
-    vague = [t.name for t in ctx.server.tools if len(t.description.strip()) < 20]
+    """MEDIUM: missing or single-word tool descriptions expand prompt injection surface. (OWASP LLM01)
+
+    Flags descriptions with fewer than 3 words — empty, one-word, or two-word
+    descriptions give the LLM no context about what the tool does or what it
+    should NOT do.
+    """
+    vague = [
+        t.name for t in ctx.server.tools
+        if len(t.description.strip().split()) < 3
+    ]
     if len(vague) >= 2:
         return McpFinding(
             severity="MEDIUM",
             rule_id="VAGUE_TOOL_DESCRIPTIONS",
             message=(
-                "Multiple tools have short or missing descriptions. "
-                "Vague descriptions make it easier for prompt injection to misdirect tool use."
-            ),
-            detail=f"Thin descriptions on: {', '.join(vague[:5])}{'…' if len(vague) > 5 else ''}",
-        )
-    return None
-
-
-def _rule_missing_rate_limit(ctx: McpContext) -> McpFinding | None:
-    """LOW: MCP protocol has no built-in rate limiting. (OWASP LLM06)"""
-    dangerous = [t.name for t in ctx.server.tools if t.is_dangerous]
-    if dangerous:
-        return McpFinding(
-            severity="LOW",
-            rule_id="MISSING_RATE_LIMIT",
-            message=(
-                "Dangerous tools detected. MCP has no built-in rate limiting — "
-                "ensure the server layer enforces per-client call limits."
+                "Multiple tools have absent or near-absent descriptions (fewer than 3 words). "
+                "Without clear descriptions the LLM cannot reason about safe tool use."
             ),
-            detail=f"Verify limits on: {', '.join(dangerous)}",
+            detail=f"Absent descriptions: {', '.join(vague[:5])}{'…' if len(vague) > 5 else ''}",
         )
     return None
 
@@ -206,8 +213,6 @@ _ALL_RULES = [
     # MEDIUM
     _rule_tool_sprawl,
     _rule_vague_descriptions,
-    # LOW
-    _rule_missing_rate_limit,
 ]
 
 _SEVERITY_WEIGHT = {"CRITICAL": 40, "HIGH": 20, "MEDIUM": 10, "LOW": 5}

{agentsentinel_cli-0.7.4 → agentsentinel_cli-0.7.6}/agentsentinel_cli/rules.py

@@ -145,27 +145,32 @@ def _rule_privilege_excess(agent: AgentInfo) -> Finding | None:
 
 
 def _rule_dangerous_grants(agent: AgentInfo) -> Finding | None:
-    dangerous = [t.name for t in agent.tools if t.is_dangerous]
+    # Exclude code_execution tools — CODE_EXECUTION_GRANT already covers them at CRITICAL.
+    # This rule catches dangerous tools outside that category (e.g. send_email, delete_record).
+    dangerous = [
+        t.name for t in agent.tools
+        if t.is_dangerous and t.category not in _CODE_EXEC_CATEGORIES
+    ]
     if dangerous:
         return Finding(
             severity="HIGH",
             rule_id="DANGEROUS_GRANTS",
-            message="Agent holds dangerous tool grants. Verify intent and add rate limits.",
+            message="Agent holds dangerous tool grants outside code execution. Verify intent.",
             detail=f"Dangerous tools: {', '.join(dangerous)}",
         )
     return None
 
 
 def _rule_tool_sprawl(agent: AgentInfo) -> Finding | None:
-    """MEDIUM: agent holds too many tools across too many categories — blast radius scales with sprawl."""
+    """MEDIUM: high tool count across many categories — blast radius scales with diversity."""
     categories = {t.category for t in agent.tools if t.category != "other"}
-    if len(agent.tools) > 10 or len(categories) >= 5:
+    if len(agent.tools) > 10 and len(categories) >= 5:
         return Finding(
             severity="MEDIUM",
             rule_id="TOOL_SPRAWL",
             message=(
                 f"Agent holds {len(agent.tools)} tools across {len(categories)} categories. "
-                "Reduce grants to the minimum required for each task."
+                "High cross-category diversity increases blast radius."
             ),
             detail=f"Categories present: {', '.join(sorted(categories))}",
         )
@@ -187,19 +192,6 @@ def _rule_write_without_description(agent: AgentInfo) -> Finding | None:
     return None
 
 
-def _rule_missing_rate_limit(agent: AgentInfo) -> Finding | None:
-    """Flag dangerous tools — rate limits aren't visible in static analysis."""
-    dangerous = [t.name for t in agent.tools if t.is_dangerous]
-    if dangerous:
-        return Finding(
-            severity="LOW",
-            rule_id="MISSING_RATE_LIMIT",
-            message="Dangerous grants detected. Ensure rate limits are configured at runtime.",
-            detail=f"Tools to check: {', '.join(dangerous)}",
-        )
-    return None
-
-
 _ALL_RULES = [
     # CRITICAL
     _rule_exfiltration_path,
@@ -215,8 +207,6 @@ _ALL_RULES = [
     # MEDIUM
     _rule_tool_sprawl,
     _rule_write_without_description,
-    # LOW
-    _rule_missing_rate_limit,
 ]
 
 _SEVERITY_WEIGHT = {"CRITICAL": 40, "HIGH": 20, "MEDIUM": 10, "LOW": 5}

{agentsentinel_cli-0.7.4 → agentsentinel_cli-0.7.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentsentinel-cli"
-version = "0.7.4"
+version = "0.7.6"
 description = "Agentic security CLI — AI analyst with memory, supply chain audit, MCP audit, red-team probing, and agent discovery"
 readme = "README.md"
 requires-python = ">=3.10"

agentsentinel_cli-0.7.6/tmp/note.md

@@ -0,0 +1,16 @@
+# Notes
+  ls dist/
+
+python3.11 -m build 
+twine upload dist/agentsentinel_cli-0.7.3* --username __token__ --password $PYPI_TOKEN
+
+lsof -i :8000
+lsof -ti :8000
+
+kill $(lsof -ti :8000)
+
+kill -9 $(lsof -ti :8000)
+
+  nsenter -t <PID> -m -u -i -n -p -- /bin/bash
+
+    ps -p <PID> -o pid,ppid,command

agentsentinel_cli-0.7.4/tmp/note.md

@@ -1,4 +0,0 @@
-# Notes
-
-python3.11 -m build 
-twine upload dist/agentsentinel_cli-0.7.3* --username __token__ --password $PYPI_TOKEN