agentsentinel-cli 0.9.0__tar.gz → 0.9.2__tar.gz

{agentsentinel_cli-0.9.0 → agentsentinel_cli-0.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsentinel-cli
-Version: 0.9.0
+Version: 0.9.2
 Summary: AI agent and MCP server security scanner — discovery, static analysis, supply chain audit, and multi-agent trust analysis
 Project-URL: Homepage, https://github.com/jaydenaung/agentsentinel-cli
 Project-URL: Repository, https://github.com/jaydenaung/agentsentinel-cli
@@ -59,6 +59,7 @@ pipx install agentsentinel-cli
 | `sentinel secrets` | Are credentials or PII exposed in these files? |
 | `sentinel inspect` | What framework, model, and role is this agent? |
 | `sentinel a2a` | Are multi-agent trust boundaries safe? |
+| `sentinel host-scan` | What is my local AI security posture? |
 
 ---
 
@@ -82,6 +83,10 @@ sentinel a2a ./agents/
 # Secrets and credentials
 sentinel secrets .
 sentinel secrets ~/.claude/projects/   # scan Claude Code memory
+
+# Local AI security posture — no network calls
+sentinel host-scan
+sentinel host-scan --fail-on HIGH
 ```
 
 ---
@@ -318,6 +323,53 @@ Covers **ASI07** (Insecure Inter-Agent Communication).
 
 ---
 
+### `sentinel host-scan` — local AI security posture audit
+
+Audits your machine's AI security posture without any network calls. Reads Claude Code and Claude Desktop configurations, shell credential files, macOS privacy permissions (TCC), system security settings, and running AI processes.
+
+```bash
+sentinel host-scan
+sentinel host-scan --format json
+sentinel host-scan --fail-on HIGH
+sentinel host-scan --ignore-rule HOST_LARGE_MEMORY
+```
+
+**What it checks:**
+- **Claude Code** — `allowedTools` (Bash bypass), MCP server configs, shell hooks
+- **Claude Desktop** — MCP server configs
+- **Third-party AI tools** — Cursor (`~/.cursor/mcp.json`), Windsurf (`~/.codeium/windsurf/mcp_config.json`), Continue.dev (`~/.continue/config.json`), Gemini CLI (`~/.gemini/settings.json`), VS Code (`mcp.servers` in `settings.json`) — all MCP server configs audited with the same rules
+- **Shell configs** — hardcoded AI API keys in `.zshrc`, `.bashrc`, `.zprofile`, etc.
+- **macOS TCC permissions** — Full Disk Access, Screen Recording, Accessibility granted to AI apps
+- **macOS system security** — SIP, FileVault, Gatekeeper status
+- **Exposed AI processes** — AI-related processes listening on non-localhost network interfaces
+- **Memory footprint** — Claude Code conversation memory size in `~/.claude/projects/`
+
+**Rules:**
+
+| Rule | Severity | Category | What it catches |
+|------|----------|----------|-----------------|
+| `HOST_SHELL_UNRESTRICTED` | CRITICAL | config | `Bash` in `allowedTools` — shell runs without confirmation prompt |
+| `HOST_SIP_DISABLED` | CRITICAL | system | macOS System Integrity Protection is off |
+| `HOST_API_KEY_IN_SHELL` | HIGH | data_exposure | AI API keys hardcoded in shell config files |
+| `HOST_MCP_EXFIL_PATH` | HIGH | config | MCP server has both filesystem access and network capability |
+| `HOST_FDA_AI_APP` | HIGH | permissions | Full Disk Access granted to an AI app or its terminal |
+| `HOST_SCREEN_RECORDING_AI` | HIGH | permissions | Screen Recording permission granted to an AI app |
+| `HOST_AI_PROCESS_EXPOSED` | HIGH | network | AI-related process listening on a non-localhost interface |
+| `HOST_FILEVAULT_OFF` | HIGH | system | FileVault disk encryption is disabled |
+| `HOST_ACCESSIBILITY_AI` | MEDIUM | permissions | Accessibility permission granted to an AI app |
+| `HOST_HOOKS_SHELL` | MEDIUM | config | Claude Code shell hooks that could interpolate AI output |
+| `HOST_MCP_BROAD_FS` | MEDIUM | config | MCP server configured with home-dir or root-level path |
+| `HOST_MCP_SENSITIVE_PATH` | MEDIUM | config | MCP server has access to `~/.ssh`, `~/.aws`, `~/.kube`, or Keychain |
+| `HOST_MANY_MCP_SERVERS` | MEDIUM | config | 8+ MCP servers across all detected AI tools — large prompt injection attack surface |
+| `HOST_GATEKEEPER_OFF` | MEDIUM | system | Gatekeeper disabled — unsigned binaries run without warning |
+| `HOST_LARGE_MEMORY` | LOW | data_exposure | Claude Code memory files exceed 50 MB of accumulated conversation data |
+
+Every finding includes a **remediation** step. The posture score (0–100) uses the same deduction weights as other sentinel commands: CRITICAL −40, HIGH −20, MEDIUM −10, LOW −5.
+
+No API key required. No network calls.
+
+---
+
 ## Finding suppression
 
 Use `--ignore-rule` to suppress findings by rule ID. Suppressed findings are excluded from `--fail-on` evaluation — they don't break CI gates.
@@ -347,13 +399,13 @@ Supported on: `sentinel scan`, `sentinel a2a`, `sentinel mcp scan`, `sentinel su
 |------------|-----|------------------|
 | Agent Goal Hijack | ASI01 | `sentinel scan` (PROMPT_INJECTION_VECTOR), `sentinel supply-chain` (SC01) |
 | Tool Misuse & Exploitation | ASI02 | `sentinel mcp scan`, `sentinel scan` |
-| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS) |
+| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED) |
 | **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI semantic analysis) |
 | Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` (CODE_EXECUTION_TOOL) |
-| **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage) |
+| **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage), `sentinel host-scan` (HOST_LARGE_MEMORY) |
 | **Insecure Inter-Agent Communication** | **ASI07** | **`sentinel a2a`** (call graph + trust rules) |
 | Cascading Agent Failures | ASI08 | `sentinel discover` (surface unmonitored agents) |
-| Rogue Agents | ASI10 | `sentinel discover` (find agents that shouldn't exist) |
+| Rogue Agents | ASI10 | `sentinel discover` (find agents that shouldn't exist), `sentinel host-scan` (HOST_AI_PROCESS_EXPOSED) |
 
 ---
 
@@ -387,6 +439,9 @@ jobs:
 
       - name: Multi-agent trust analysis
         run: sentinel a2a ./agents/ --fail-on HIGH
+
+      - name: Host AI security posture
+        run: sentinel host-scan --fail-on HIGH
 ```
 
 Use `.sentinelignore` at the repo root to suppress accepted risks without weakening the gate:
@@ -401,7 +456,7 @@ NO_AUTH    # server is behind an authenticated reverse proxy
 ## Requirements
 
 - Python 3.10+
-- No API key required for: `sentinel discover`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel scan`, `sentinel secrets`, `sentinel inspect --no-ai`, `sentinel a2a`
+- No API key required for: `sentinel discover`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel scan`, `sentinel secrets`, `sentinel inspect --no-ai`, `sentinel a2a`, `sentinel host-scan`
 - `ANTHROPIC_API_KEY` required for: `sentinel supply-chain --ai`, `sentinel inspect` (AI summary)
 
 ---

{agentsentinel_cli-0.9.0 → agentsentinel_cli-0.9.2}/README.md

@@ -25,6 +25,7 @@ pipx install agentsentinel-cli
 | `sentinel secrets` | Are credentials or PII exposed in these files? |
 | `sentinel inspect` | What framework, model, and role is this agent? |
 | `sentinel a2a` | Are multi-agent trust boundaries safe? |
+| `sentinel host-scan` | What is my local AI security posture? |
 
 ---
 
@@ -48,6 +49,10 @@ sentinel a2a ./agents/
 # Secrets and credentials
 sentinel secrets .
 sentinel secrets ~/.claude/projects/   # scan Claude Code memory
+
+# Local AI security posture — no network calls
+sentinel host-scan
+sentinel host-scan --fail-on HIGH
 ```
 
 ---
@@ -284,6 +289,53 @@ Covers **ASI07** (Insecure Inter-Agent Communication).
 
 ---
 
+### `sentinel host-scan` — local AI security posture audit
+
+Audits your machine's AI security posture without any network calls. Reads Claude Code and Claude Desktop configurations, shell credential files, macOS privacy permissions (TCC), system security settings, and running AI processes.
+
+```bash
+sentinel host-scan
+sentinel host-scan --format json
+sentinel host-scan --fail-on HIGH
+sentinel host-scan --ignore-rule HOST_LARGE_MEMORY
+```
+
+**What it checks:**
+- **Claude Code** — `allowedTools` (Bash bypass), MCP server configs, shell hooks
+- **Claude Desktop** — MCP server configs
+- **Third-party AI tools** — Cursor (`~/.cursor/mcp.json`), Windsurf (`~/.codeium/windsurf/mcp_config.json`), Continue.dev (`~/.continue/config.json`), Gemini CLI (`~/.gemini/settings.json`), VS Code (`mcp.servers` in `settings.json`) — all MCP server configs audited with the same rules
+- **Shell configs** — hardcoded AI API keys in `.zshrc`, `.bashrc`, `.zprofile`, etc.
+- **macOS TCC permissions** — Full Disk Access, Screen Recording, Accessibility granted to AI apps
+- **macOS system security** — SIP, FileVault, Gatekeeper status
+- **Exposed AI processes** — AI-related processes listening on non-localhost network interfaces
+- **Memory footprint** — Claude Code conversation memory size in `~/.claude/projects/`
+
+**Rules:**
+
+| Rule | Severity | Category | What it catches |
+|------|----------|----------|-----------------|
+| `HOST_SHELL_UNRESTRICTED` | CRITICAL | config | `Bash` in `allowedTools` — shell runs without confirmation prompt |
+| `HOST_SIP_DISABLED` | CRITICAL | system | macOS System Integrity Protection is off |
+| `HOST_API_KEY_IN_SHELL` | HIGH | data_exposure | AI API keys hardcoded in shell config files |
+| `HOST_MCP_EXFIL_PATH` | HIGH | config | MCP server has both filesystem access and network capability |
+| `HOST_FDA_AI_APP` | HIGH | permissions | Full Disk Access granted to an AI app or its terminal |
+| `HOST_SCREEN_RECORDING_AI` | HIGH | permissions | Screen Recording permission granted to an AI app |
+| `HOST_AI_PROCESS_EXPOSED` | HIGH | network | AI-related process listening on a non-localhost interface |
+| `HOST_FILEVAULT_OFF` | HIGH | system | FileVault disk encryption is disabled |
+| `HOST_ACCESSIBILITY_AI` | MEDIUM | permissions | Accessibility permission granted to an AI app |
+| `HOST_HOOKS_SHELL` | MEDIUM | config | Claude Code shell hooks that could interpolate AI output |
+| `HOST_MCP_BROAD_FS` | MEDIUM | config | MCP server configured with home-dir or root-level path |
+| `HOST_MCP_SENSITIVE_PATH` | MEDIUM | config | MCP server has access to `~/.ssh`, `~/.aws`, `~/.kube`, or Keychain |
+| `HOST_MANY_MCP_SERVERS` | MEDIUM | config | 8+ MCP servers across all detected AI tools — large prompt injection attack surface |
+| `HOST_GATEKEEPER_OFF` | MEDIUM | system | Gatekeeper disabled — unsigned binaries run without warning |
+| `HOST_LARGE_MEMORY` | LOW | data_exposure | Claude Code memory files exceed 50 MB of accumulated conversation data |
+
+Every finding includes a **remediation** step. The posture score (0–100) uses the same deduction weights as other sentinel commands: CRITICAL −40, HIGH −20, MEDIUM −10, LOW −5.
+
+No API key required. No network calls.
+
+---
+
 ## Finding suppression
 
 Use `--ignore-rule` to suppress findings by rule ID. Suppressed findings are excluded from `--fail-on` evaluation — they don't break CI gates.
@@ -313,13 +365,13 @@ Supported on: `sentinel scan`, `sentinel a2a`, `sentinel mcp scan`, `sentinel su
 |------------|-----|------------------|
 | Agent Goal Hijack | ASI01 | `sentinel scan` (PROMPT_INJECTION_VECTOR), `sentinel supply-chain` (SC01) |
 | Tool Misuse & Exploitation | ASI02 | `sentinel mcp scan`, `sentinel scan` |
-| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS) |
+| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED) |
 | **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI semantic analysis) |
 | Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` (CODE_EXECUTION_TOOL) |
-| **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage) |
+| **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage), `sentinel host-scan` (HOST_LARGE_MEMORY) |
 | **Insecure Inter-Agent Communication** | **ASI07** | **`sentinel a2a`** (call graph + trust rules) |
 | Cascading Agent Failures | ASI08 | `sentinel discover` (surface unmonitored agents) |
-| Rogue Agents | ASI10 | `sentinel discover` (find agents that shouldn't exist) |
+| Rogue Agents | ASI10 | `sentinel discover` (find agents that shouldn't exist), `sentinel host-scan` (HOST_AI_PROCESS_EXPOSED) |
 
 ---
 
@@ -353,6 +405,9 @@ jobs:
 
       - name: Multi-agent trust analysis
         run: sentinel a2a ./agents/ --fail-on HIGH
+
+      - name: Host AI security posture
+        run: sentinel host-scan --fail-on HIGH
 ```
 
 Use `.sentinelignore` at the repo root to suppress accepted risks without weakening the gate:
@@ -367,7 +422,7 @@ NO_AUTH    # server is behind an authenticated reverse proxy
 ## Requirements
 
 - Python 3.10+
-- No API key required for: `sentinel discover`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel scan`, `sentinel secrets`, `sentinel inspect --no-ai`, `sentinel a2a`
+- No API key required for: `sentinel discover`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel scan`, `sentinel secrets`, `sentinel inspect --no-ai`, `sentinel a2a`, `sentinel host-scan`
 - `ANTHROPIC_API_KEY` required for: `sentinel supply-chain --ai`, `sentinel inspect` (AI summary)
 
 ---

{agentsentinel_cli-0.9.0 → agentsentinel_cli-0.9.2}/agentsentinel_cli/cli.py

@@ -866,7 +866,7 @@ def a2a(
 
 # ── sentinel host ─────────────────────────────────────────────────────────────
 
-@main.command(name="host")
+@main.command(name="host-scan")
 @click.option("--format", "fmt", type=click.Choice(["text", "json"]), default="text",
               help="Output format.")
 @click.option("--fail-on", type=click.Choice(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
@@ -889,10 +889,10 @@ def host(
 
     \b
     Examples:
-        sentinel host
-        sentinel host --format json
-        sentinel host --fail-on HIGH
-        sentinel host --ignore-rule HOST_LARGE_MEMORY
+        sentinel host-scan
+        sentinel host-scan --format json
+        sentinel host-scan --fail-on HIGH
+        sentinel host-scan --ignore-rule HOST_LARGE_MEMORY
     """
     from agentsentinel_cli.host_scanner import scan_host
     from agentsentinel_cli.host_rules import run_host_rules, host_posture_score

{agentsentinel_cli-0.9.0 → agentsentinel_cli-0.9.2}/agentsentinel_cli/host_report.py

@@ -61,7 +61,7 @@ def print_host_result(ctx: HostContext, findings: list[HostFinding], score: int)
     console.print()
     console.print(Panel.fit(
         "[bold white]AgentSentinel — Host AI Security Posture[/bold white]\n"
-        "[dim]Local AI tools · macOS privacy permissions · system security[/dim]",
+        "[dim]AI tools · privacy permissions · system security[/dim]",
         border_style="bright_blue",
         padding=(0, 2),
     ))
@@ -94,12 +94,22 @@ def print_host_result(ctx: HostContext, findings: list[HostFinding], score: int)
     else:
         console.print("  [dim]Claude Desktop config not found[/dim]")
 
-    # MCP servers table
+    if ctx.vendor_configs:
+        console.print()
+        for vc in ctx.vendor_configs:
+            console.print(
+                f"  [bold white]{vc.display_name}[/bold white]  [dim]{vc.path}[/dim]\n"
+                f"  [dim]  {len(vc.mcp_servers)} MCP server(s)[/dim]"
+            )
+
+    # MCP servers table — all sources combined
     all_servers = []
     if ctx.claude_code:
         all_servers.extend((s, "Claude Code") for s in ctx.claude_code.mcp_servers)
     if ctx.claude_desktop:
         all_servers.extend((s, "Desktop") for s in ctx.claude_desktop.mcp_servers)
+    for vc in ctx.vendor_configs:
+        all_servers.extend((s, vc.display_name) for s in vc.mcp_servers)
 
     if all_servers:
         console.print()
@@ -224,6 +234,14 @@ def as_host_json(ctx: HostContext, findings: list[HostFinding], score: int) -> s
                 "filesystem_paths": s.filesystem_paths,
                 "env_keys": s.env_keys,
             })
+    for vc in ctx.vendor_configs:
+        for s in vc.mcp_servers:
+            all_mcp.append({
+                "name": s.name, "source": vc.vendor,
+                "has_network_access": s.has_network_access,
+                "filesystem_paths": s.filesystem_paths,
+                "env_keys": s.env_keys,
+            })
 
     return json.dumps({
         "scan_type": "host",
@@ -236,6 +254,11 @@ def as_host_json(ctx: HostContext, findings: list[HostFinding], score: int) -> s
         "claude_desktop": {
             "found": ctx.claude_desktop is not None,
         },
+        "vendor_tools": [
+            {"vendor": vc.vendor, "display_name": vc.display_name,
+             "mcp_server_count": len(vc.mcp_servers)}
+            for vc in ctx.vendor_configs
+        ],
         "mcp_servers": all_mcp,
         "memory": {
             "file_count": ctx.memory_file_count,

{agentsentinel_cli-0.9.0 → agentsentinel_cli-0.9.2}/agentsentinel_cli/host_rules.py

@@ -65,6 +65,8 @@ def _all_mcp_servers(ctx: HostContext) -> list[McpServerConfig]:
         servers.extend(ctx.claude_code.mcp_servers)
     if ctx.claude_desktop:
         servers.extend(ctx.claude_desktop.mcp_servers)
+    for vc in ctx.vendor_configs:
+        servers.extend(vc.mcp_servers)
     return servers
 
 
@@ -375,7 +377,7 @@ def _rule_sensitive_path(ctx: HostContext) -> HostFinding | None:
 
 
 def _rule_many_mcp_servers(ctx: HostContext) -> HostFinding | None:
-    """MEDIUM: large number of MCP servers configured expands the attack surface."""
+    """MEDIUM: large number of MCP servers across all AI tools expands the attack surface."""
     seen: set[str] = set()
     unique = []
     for s in _all_mcp_servers(ctx):
@@ -385,18 +387,25 @@ def _rule_many_mcp_servers(ctx: HostContext) -> HostFinding | None:
     if len(unique) < 8:
         return None
     names = ", ".join(s.name for s in unique[:6])
+    tools: list[str] = []
+    if ctx.claude_code:
+        tools.append("Claude Code")
+    if ctx.claude_desktop:
+        tools.append("Claude Desktop")
+    tools.extend(vc.display_name for vc in ctx.vendor_configs)
+    tool_str = ", ".join(tools) if tools else "your AI tools"
     return HostFinding(
         severity="MEDIUM",
         rule_id="HOST_MANY_MCP_SERVERS",
         category="config",
         message=(
-            f"{len(unique)} MCP servers are configured. "
+            f"{len(unique)} MCP servers are configured across {tool_str}. "
             "Each server is an independent prompt injection entry point. "
             "The more servers installed, the larger the blast radius of a single compromise."
         ),
         detail=f"Servers: {names}{'…' if len(unique) > 6 else ''}",
         remediation=(
-            "Remove MCP servers you do not actively use. "
+            "Remove MCP servers you do not actively use across all AI tools. "
             "Review each server's capabilities and remove any that duplicate functionality."
         ),
     )

{agentsentinel_cli-0.9.0 → agentsentinel_cli-0.9.2}/agentsentinel_cli/host_scanner.py

@@ -7,6 +7,7 @@ No network calls — all checks are local and read-only.
 
 import dataclasses
 import json
+import os
 import re
 import subprocess
 from pathlib import Path
@@ -37,6 +38,15 @@ class ClaudeDesktopConfig:
     mcp_servers: list[McpServerConfig]
 
 
+@dataclasses.dataclass
+class VendorConfig:
+    """Configuration found for a third-party AI coding tool or agent runtime."""
+    vendor: str          # "cursor" | "windsurf" | "continue" | "gemini_cli" | "vscode"
+    display_name: str    # human-readable
+    path: Path
+    mcp_servers: list[McpServerConfig]
+
+
 @dataclasses.dataclass
 class TccPermission:
     app_name: str
@@ -59,6 +69,7 @@ class HostContext:
     """Aggregated host AI security posture data — passed to every rule."""
     claude_code: ClaudeCodeSettings | None
     claude_desktop: ClaudeDesktopConfig | None
+    vendor_configs: list[VendorConfig]
     memory_file_count: int
     memory_total_bytes: int
     shell_key_findings: list[tuple[str, str, str]]   # (key_type, file_path, redacted_snippet)
@@ -389,6 +400,98 @@ def _scan_exposed_processes() -> list[ExposedProcess]:
     return exposed
 
 
+# ── Third-party AI tool configs ───────────────────────────────────────────────
+
+def _dig(data: object, keys: list[str]) -> object:
+    """Navigate a nested dict by key path; returns None if any key is absent."""
+    for k in keys:
+        if not isinstance(data, dict):
+            return None
+        data = data.get(k)  # type: ignore[union-attr]
+        if data is None:
+            return None
+    return data
+
+
+def _parse_vendor_mcp(raw: dict, key_path: list[str], list_format: bool) -> list[McpServerConfig]:
+    """Extract MCP server configs from a vendor settings file.
+
+    list_format=True handles Continue.dev's array format;
+    False handles the dict format used by Cursor, Windsurf, Gemini CLI, and VS Code.
+    """
+    data = _dig(raw, key_path)
+    if not data:
+        return []
+    if list_format and isinstance(data, list):
+        return [
+            _analyze_mcp_server(item.get("name", f"server_{i}"), item)
+            for i, item in enumerate(data)
+            if isinstance(item, dict)
+        ]
+    if not list_format and isinstance(data, dict):
+        return [_analyze_mcp_server(k, v) for k, v in data.items() if isinstance(v, dict)]
+    return []
+
+
+def _read_vendor_configs() -> list[VendorConfig]:
+    """Discover MCP server configs for Cursor, Windsurf, Continue.dev, Gemini CLI, and VS Code."""
+    home = Path.home()
+    appdata = Path(os.environ["APPDATA"]) if "APPDATA" in os.environ else None
+
+    # (vendor_id, display_name, candidate_paths, mcp_json_key_path, list_format)
+    # key_path navigates nested keys: ["mcp", "servers"] → raw["mcp"]["servers"]
+    # list_format: True = array of {name, command, args}, False = dict of {name: {command, args}}
+    specs: list[tuple[str, str, list[Path], list[str], bool]] = [
+        ("cursor", "Cursor", [
+            home / ".cursor" / "mcp.json",
+            home / "Library" / "Application Support" / "Cursor" / "User" / "settings.json",
+            home / ".config" / "Cursor" / "User" / "settings.json",
+            *([appdata / "Cursor" / "User" / "settings.json"] if appdata else []),
+        ], ["mcpServers"], False),
+
+        ("windsurf", "Windsurf", [
+            home / ".codeium" / "windsurf" / "mcp_config.json",
+            home / "Library" / "Application Support" / "Windsurf" / "User" / "settings.json",
+            home / ".config" / "Windsurf" / "User" / "settings.json",
+            *([appdata / "Windsurf" / "User" / "settings.json"] if appdata else []),
+        ], ["mcpServers"], False),
+
+        ("continue", "Continue.dev", [
+            home / ".continue" / "config.json",
+        ], ["mcpServers"], True),
+
+        ("gemini_cli", "Gemini CLI", [
+            home / ".gemini" / "settings.json",
+        ], ["mcpServers"], False),
+
+        ("vscode", "VS Code", [
+            home / "Library" / "Application Support" / "Code" / "User" / "settings.json",
+            home / ".config" / "Code" / "User" / "settings.json",
+            *([appdata / "Code" / "User" / "settings.json"] if appdata else []),
+        ], ["mcp", "servers"], False),
+    ]
+
+    configs: list[VendorConfig] = []
+    for vendor_id, display_name, candidate_paths, key_path, list_fmt in specs:
+        for path in candidate_paths:
+            if not path.exists():
+                continue
+            try:
+                raw = json.loads(path.read_text())
+            except (json.JSONDecodeError, OSError):
+                continue
+            servers = _parse_vendor_mcp(raw, key_path, list_fmt)
+            if servers:
+                configs.append(VendorConfig(
+                    vendor=vendor_id,
+                    display_name=display_name,
+                    path=path,
+                    mcp_servers=servers,
+                ))
+            break  # use first matching path per vendor
+    return configs
+
+
 # ── Main entry point ──────────────────────────────────────────────────────────
 
 def scan_host() -> HostContext:
@@ -397,6 +500,7 @@ def scan_host() -> HostContext:
 
     claude_code = _read_claude_code_settings()
     claude_desktop = _read_claude_desktop_config()
+    vendor_configs = _read_vendor_configs()
     mem_count, mem_bytes = _scan_memory_files()
     shell_keys = _scan_shell_configs()
     tcc_perms, tcc_err = _read_tcc_permissions()
@@ -406,6 +510,7 @@ def scan_host() -> HostContext:
     return HostContext(
         claude_code=claude_code,
         claude_desktop=claude_desktop,
+        vendor_configs=vendor_configs,
         memory_file_count=mem_count,
         memory_total_bytes=mem_bytes,
         shell_key_findings=shell_keys,

agentsentinel_cli-0.9.2/publish.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION="0.9.2"
+TWINE_USERNAME="__token__"
+TWINE_PASSWORD="pypi-AgEIcHlwaS5vcmcCJDIyMGE5ZmVlLTQzZjctNDNlZS04NjNmLThhYTJlODVlNDFiYwACKlszLCIwMDRjN2Y1MS00YmQ4LTQwNDAtYmI3MS0zMjk1MWQ3MWM4NWQiXQAABiD4KieIB_qwkmr9tGmf_2M0fWCV0bMHI4d7jG8fMuPdnw"
+
+export TWINE_USERNAME TWINE_PASSWORD
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+echo "==> Building agentsentinel-cli v${VERSION}"
+
+# Update version in pyproject.toml
+sed -i '' "s/^version = .*/version = \"${VERSION}\"/" pyproject.toml
+echo "    pyproject.toml version set to ${VERSION}"
+
+# Clean previous build artifacts
+rm -rf dist/ build/ src/*.egg-info agentsentinel_cli.egg-info
+echo "    dist/ cleaned"
+
+# Build sdist + wheel
+python3 -m build
+echo "    build complete"
+
+# Upload to PyPI
+echo "==> Uploading to PyPI"
+twine upload dist/agentsentinel_cli-${VERSION}*
+
+echo "==> Done — https://pypi.org/project/agentsentinel-cli/${VERSION}/"

{agentsentinel_cli-0.9.0 → agentsentinel_cli-0.9.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentsentinel-cli"
-version = "0.9.0"
+version = "0.9.2"
 description = "AI agent and MCP server security scanner — discovery, static analysis, supply chain audit, and multi-agent trust analysis"
 readme = "README.md"
 requires-python = ">=3.10"

{agentsentinel_cli-0.9.0 → agentsentinel_cli-0.9.2}/tmp/note.md

@@ -1,6 +1,6 @@
 # Notes
   ls dist/
-
+rm -rf dist/&
 python3.11 -m build 
 twine upload dist/agentsentinel_cli-0.7.3* --username __token__ --password $PYPI_TOKEN
 

agentsentinel_cli-0.9.2/tmp/publish.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION="0.9.2"
+TWINE_USERNAME="__token__"
+TWINE_PASSWORD="pypi-AgEIcHlwaS5vcmcCJDIyMGE5ZmVlLTQzZjctNDNlZS04NjNmLThhYTJlODVlNDFiYwACKlszLCIwMDRjN2Y1MS00YmQ4LTQwNDAtYmI3MS0zMjk1MWQ3MWM4NWQiXQAABiD4KieIB_qwkmr9tGmf_2M0fWCV0bMHI4d7jG8fMuPdnw"
+
+export TWINE_USERNAME TWINE_PASSWORD
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+echo "==> Building agentsentinel-cli v${VERSION}"
+
+# Update version in pyproject.toml
+sed -i '' "s/^version = .*/version = \"${VERSION}\"/" pyproject.toml
+echo "    pyproject.toml version set to ${VERSION}"
+
+# Clean previous build artifacts
+rm -rf dist/ build/ src/*.egg-info agentsentinel_cli.egg-info
+echo "    dist/ cleaned"
+
+# Build sdist + wheel
+pyproject-build
+echo "    build complete"
+
+# Upload to PyPI
+echo "==> Uploading to PyPI"
+twine upload dist/agentsentinel_cli-${VERSION}*
+
+echo "==> Done — https://pypi.org/project/agentsentinel-cli/${VERSION}/"

agentsentinel_cli-0.9.2/tmp/pypi.md

@@ -0,0 +1,53 @@
+# PyPI Upload Steps for agentsentinel-cli
+
+## Prerequisites
+
+- `twine` installed via Homebrew: `brew install twine`
+- A PyPI account with an API token (generate at https://pypi.org/manage/account/token/)
+
+## Steps
+
+### 1. Bump the version
+
+Edit `pyproject.toml`:
+
+```toml
+version = "0.9.0"  # increment as appropriate
+```
+
+### 2. Build the distributions
+
+Use `pipx run build` to avoid the Homebrew externally-managed-environment restriction:
+
+```bash
+pipx run build
+```
+
+This produces two files in `dist/`:
+- `agentsentinel_cli-<version>-py3-none-any.whl`
+- `agentsentinel_cli-<version>.tar.gz`
+
+### 3. Upload to PyPI
+
+Pass credentials directly on the command line (twine cannot prompt interactively in this terminal):
+
+```bash
+twine upload dist/agentsentinel_cli-<version>* -u __token__ -p pypi-YOUR_TOKEN_HERE
+```
+
+Replace `pypi-YOUR_TOKEN_HERE` with your actual PyPI API token.
+
+### 4. Verify
+
+Check the release is live at:
+```
+https://pypi.org/project/agentsentinel-cli/
+```
+
+---
+
+## Notes
+
+- `python3 -m build` fails because `/opt/homebrew/bin/python3` (3.12) and `pip` (3.11) are mismatched — use `pipx run build` instead.
+- `twine upload` without `-u`/`-p` flags will hang trying to prompt for a password — always pass them inline.
+- Old dist files are not automatically removed. The `dist/` folder accumulates across versions; only the files matching `<version>` are uploaded.