agentsentinel-cli 0.7.5__tar.gz → 0.7.6__tar.gz

{agentsentinel_cli-0.7.5 → agentsentinel_cli-0.7.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsentinel-cli
-Version: 0.7.5
+Version: 0.7.6
 Summary: Agentic security CLI — AI analyst with memory, supply chain audit, MCP audit, red-team probing, and agent discovery
 Project-URL: Homepage, https://github.com/jaydenaung/agentsentinel-cli
 Project-URL: Repository, https://github.com/jaydenaung/agentsentinel-cli

{agentsentinel_cli-0.7.5 → agentsentinel_cli-0.7.6}/agentsentinel_cli/a2a_rules.py

@@ -269,7 +269,6 @@ _ALL_RULES = [
     _rule_prompt_passthrough,
     _rule_implicit_trust_with_code_exec,
     _rule_unscoped_delegation,
-    _rule_unverified_orchestrator,
 ]
 
 _SEVERITY_WEIGHT = {"CRITICAL": 40, "HIGH": 20, "MEDIUM": 10, "LOW": 5}

{agentsentinel_cli-0.7.5 → agentsentinel_cli-0.7.6}/agentsentinel_cli/mcp_rules.py

@@ -114,15 +114,26 @@ def _rule_code_execution(ctx: McpContext) -> McpFinding | None:
 
 
 def _rule_unbounded_input(ctx: McpContext) -> McpFinding | None:
-    """HIGH: unconstrained string inputs increase injection payload surface. (OWASP LLM01)"""
+    """HIGH: dangerous string parameters have no input constraints. (OWASP LLM01)
+
+    Only flags parameters whose names suggest they feed dangerous operations —
+    shell commands, SQL queries, file paths, URLs, code. Generic string fields
+    (name, title, message, body) are not flagged.
+    """
+    _DANGEROUS_PARAMS = frozenset({
+        "command", "cmd", "shell", "shell_command",
+        "query", "sql", "sql_query", "expression",
+        "path", "file_path", "filepath", "filename", "directory", "dir",
+        "url", "uri", "endpoint", "webhook", "target",
+        "code", "script", "template", "prompt",
+    })
+
     unvalidated: list[str] = []
     for tool in ctx.server.tools:
-        schema = tool.input_schema
-        props = schema.get("properties", {})
-        if not props and schema.get("type") == "object":
-            unvalidated.append(f"{tool.name} (no schema)")
-            continue
+        props = tool.input_schema.get("properties", {})
         for prop_name, prop_def in props.items():
+            if prop_name.lower() not in _DANGEROUS_PARAMS:
+                continue
             if (
                 prop_def.get("type") == "string"
                 and "maxLength" not in prop_def
@@ -130,7 +141,6 @@ def _rule_unbounded_input(ctx: McpContext) -> McpFinding | None:
                 and "pattern" not in prop_def
             ):
                 unvalidated.append(f"{tool.name}.{prop_name}")
-                break
 
     if unvalidated:
         sample = unvalidated[:5]
@@ -139,24 +149,29 @@ def _rule_unbounded_input(ctx: McpContext) -> McpFinding | None:
             severity="HIGH",
             rule_id="UNBOUNDED_INPUT",
             message=(
-                "Tools accept unconstrained string inputs with no maxLength, enum, or pattern. "
-                "Injection payloads can be passed directly through tool arguments."
+                "Dangerous parameters (command, path, query, url, code) accept unconstrained "
+                "string input. No maxLength, enum, or pattern — injection payloads pass through directly."
             ),
-            detail=f"Unconstrained inputs: {', '.join(sample)}{suffix}",
+            detail=f"Unconstrained dangerous inputs: {', '.join(sample)}{suffix}",
         )
     return None
 
 
 def _rule_tool_sprawl(ctx: McpContext) -> McpFinding | None:
-    """MEDIUM: excessive tool count increases blast radius. (OWASP LLM06)"""
+    """MEDIUM: high tool count across many categories increases blast radius. (OWASP LLM06)
+
+    Requires BOTH high count AND diverse categories. A server with 14 file-system
+    tools is a focused file manager. A server with 12 tools spanning code execution,
+    email, database, and web is a broad attack surface.
+    """
     categories = {t.category for t in ctx.server.tools} - {"other"}
-    if len(ctx.server.tools) > 10 or len(categories) >= 5:
+    if len(ctx.server.tools) > 10 and len(categories) >= 5:
         return McpFinding(
             severity="MEDIUM",
             rule_id="TOOL_SPRAWL",
             message=(
-                f"Server exposes {len(ctx.server.tools)} tools across {len(categories)} categories. "
-                "Every tool is an attack surface — reduce to the minimum required."
+                f"Server exposes {len(ctx.server.tools)} tools across {len(categories)} "
+                "distinct categories. High cross-category diversity increases blast radius."
             ),
             detail=f"Categories: {', '.join(sorted(categories))}",
         )
@@ -164,33 +179,25 @@ def _rule_tool_sprawl(ctx: McpContext) -> McpFinding | None:
 
 
 def _rule_vague_descriptions(ctx: McpContext) -> McpFinding | None:
-    """MEDIUM: thin tool descriptions expand prompt injection surface. (OWASP LLM01)"""
-    vague = [t.name for t in ctx.server.tools if len(t.description.strip()) < 20]
+    """MEDIUM: missing or single-word tool descriptions expand prompt injection surface. (OWASP LLM01)
+
+    Flags descriptions with fewer than 3 words — empty, one-word, or two-word
+    descriptions give the LLM no context about what the tool does or what it
+    should NOT do.
+    """
+    vague = [
+        t.name for t in ctx.server.tools
+        if len(t.description.strip().split()) < 3
+    ]
     if len(vague) >= 2:
         return McpFinding(
             severity="MEDIUM",
             rule_id="VAGUE_TOOL_DESCRIPTIONS",
             message=(
-                "Multiple tools have short or missing descriptions. "
-                "Vague descriptions make it easier for prompt injection to misdirect tool use."
-            ),
-            detail=f"Thin descriptions on: {', '.join(vague[:5])}{'…' if len(vague) > 5 else ''}",
-        )
-    return None
-
-
-def _rule_missing_rate_limit(ctx: McpContext) -> McpFinding | None:
-    """LOW: MCP protocol has no built-in rate limiting. (OWASP LLM06)"""
-    dangerous = [t.name for t in ctx.server.tools if t.is_dangerous]
-    if dangerous:
-        return McpFinding(
-            severity="LOW",
-            rule_id="MISSING_RATE_LIMIT",
-            message=(
-                "Dangerous tools detected. MCP has no built-in rate limiting — "
-                "ensure the server layer enforces per-client call limits."
+                "Multiple tools have absent or near-absent descriptions (fewer than 3 words). "
+                "Without clear descriptions the LLM cannot reason about safe tool use."
             ),
-            detail=f"Verify limits on: {', '.join(dangerous)}",
+            detail=f"Absent descriptions: {', '.join(vague[:5])}{'…' if len(vague) > 5 else ''}",
         )
     return None
 
@@ -206,8 +213,6 @@ _ALL_RULES = [
     # MEDIUM
     _rule_tool_sprawl,
     _rule_vague_descriptions,
-    # LOW
-    _rule_missing_rate_limit,
 ]
 
 _SEVERITY_WEIGHT = {"CRITICAL": 40, "HIGH": 20, "MEDIUM": 10, "LOW": 5}

{agentsentinel_cli-0.7.5 → agentsentinel_cli-0.7.6}/agentsentinel_cli/rules.py

@@ -145,27 +145,32 @@ def _rule_privilege_excess(agent: AgentInfo) -> Finding | None:
 
 
 def _rule_dangerous_grants(agent: AgentInfo) -> Finding | None:
-    dangerous = [t.name for t in agent.tools if t.is_dangerous]
+    # Exclude code_execution tools — CODE_EXECUTION_GRANT already covers them at CRITICAL.
+    # This rule catches dangerous tools outside that category (e.g. send_email, delete_record).
+    dangerous = [
+        t.name for t in agent.tools
+        if t.is_dangerous and t.category not in _CODE_EXEC_CATEGORIES
+    ]
     if dangerous:
         return Finding(
             severity="HIGH",
             rule_id="DANGEROUS_GRANTS",
-            message="Agent holds dangerous tool grants. Verify intent and add rate limits.",
+            message="Agent holds dangerous tool grants outside code execution. Verify intent.",
             detail=f"Dangerous tools: {', '.join(dangerous)}",
         )
     return None
 
 
 def _rule_tool_sprawl(agent: AgentInfo) -> Finding | None:
-    """MEDIUM: agent holds too many tools across too many categories — blast radius scales with sprawl."""
+    """MEDIUM: high tool count across many categories — blast radius scales with diversity."""
     categories = {t.category for t in agent.tools if t.category != "other"}
-    if len(agent.tools) > 10 or len(categories) >= 5:
+    if len(agent.tools) > 10 and len(categories) >= 5:
         return Finding(
             severity="MEDIUM",
             rule_id="TOOL_SPRAWL",
             message=(
                 f"Agent holds {len(agent.tools)} tools across {len(categories)} categories. "
-                "Reduce grants to the minimum required for each task."
+                "High cross-category diversity increases blast radius."
             ),
             detail=f"Categories present: {', '.join(sorted(categories))}",
         )
@@ -187,19 +192,6 @@ def _rule_write_without_description(agent: AgentInfo) -> Finding | None:
     return None
 
 
-def _rule_missing_rate_limit(agent: AgentInfo) -> Finding | None:
-    """Flag dangerous tools — rate limits aren't visible in static analysis."""
-    dangerous = [t.name for t in agent.tools if t.is_dangerous]
-    if dangerous:
-        return Finding(
-            severity="LOW",
-            rule_id="MISSING_RATE_LIMIT",
-            message="Dangerous grants detected. Ensure rate limits are configured at runtime.",
-            detail=f"Tools to check: {', '.join(dangerous)}",
-        )
-    return None
-
-
 _ALL_RULES = [
     # CRITICAL
     _rule_exfiltration_path,
@@ -215,8 +207,6 @@ _ALL_RULES = [
     # MEDIUM
     _rule_tool_sprawl,
     _rule_write_without_description,
-    # LOW
-    _rule_missing_rate_limit,
 ]
 
 _SEVERITY_WEIGHT = {"CRITICAL": 40, "HIGH": 20, "MEDIUM": 10, "LOW": 5}

{agentsentinel_cli-0.7.5 → agentsentinel_cli-0.7.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentsentinel-cli"
-version = "0.7.5"
+version = "0.7.6"
 description = "Agentic security CLI — AI analyst with memory, supply chain audit, MCP audit, red-team probing, and agent discovery"
 readme = "README.md"
 requires-python = ">=3.10"