agentsentinel-cli 0.9.2__tar.gz → 0.9.4__tar.gz

{agentsentinel_cli-0.9.2 → agentsentinel_cli-0.9.4}/.gitignore

@@ -27,6 +27,10 @@ htmlcov/
 .env
 .env.*
 
+# Publish scripts contain credentials — never commit
+publish.sh
+tmp/
+
 # Sentinel analyst memory (local state, not for commit)
 .sentinel/
 

{agentsentinel_cli-0.9.2 → agentsentinel_cli-0.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsentinel-cli
-Version: 0.9.2
+Version: 0.9.4
 Summary: AI agent and MCP server security scanner — discovery, static analysis, supply chain audit, and multi-agent trust analysis
 Project-URL: Homepage, https://github.com/jaydenaung/agentsentinel-cli
 Project-URL: Repository, https://github.com/jaydenaung/agentsentinel-cli
@@ -59,7 +59,8 @@ pipx install agentsentinel-cli
 | `sentinel secrets` | Are credentials or PII exposed in these files? |
 | `sentinel inspect` | What framework, model, and role is this agent? |
 | `sentinel a2a` | Are multi-agent trust boundaries safe? |
-| `sentinel host-scan` | What is my local AI security posture? |
+| `sentinel host-scan` | What is my local AI security posture across all AI tools? |
+| `sentinel redteam mcp` | Can I actively exploit this MCP server? |
 
 ---
 
@@ -87,6 +88,11 @@ sentinel secrets ~/.claude/projects/   # scan Claude Code memory
 # Local AI security posture — no network calls
 sentinel host-scan
 sentinel host-scan --fail-on HIGH
+
+# Active red-team — real attacks, confirmed exploitation
+sentinel redteam mcp full http://localhost:8000
+sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
+sentinel redteam mcp auth http://localhost:8000
 ```
 
 ---
@@ -325,7 +331,9 @@ Covers **ASI07** (Insecure Inter-Agent Communication).
 
 ### `sentinel host-scan` — local AI security posture audit
 
-Audits your machine's AI security posture without any network calls. Reads Claude Code and Claude Desktop configurations, shell credential files, macOS privacy permissions (TCC), system security settings, and running AI processes.
+Audits your machine's AI security posture without any network calls. Discovers and audits MCP server configurations across every major AI coding tool on the host — Claude Code, Claude Desktop, Cursor, Windsurf, Continue.dev, Gemini CLI, and VS Code — then checks shell credentials, macOS privacy permissions, system security settings, and running AI processes.
+
+Works on macOS, Linux, and Windows. No API key required.
 
 ```bash
 sentinel host-scan
@@ -335,9 +343,19 @@ sentinel host-scan --ignore-rule HOST_LARGE_MEMORY
 ```
 
 **What it checks:**
-- **Claude Code** — `allowedTools` (Bash bypass), MCP server configs, shell hooks
+
+*Anthropic tools*
+- **Claude Code** — `allowedTools` (shell bypass), MCP server configs, shell hooks
 - **Claude Desktop** — MCP server configs
-- **Third-party AI tools** — Cursor (`~/.cursor/mcp.json`), Windsurf (`~/.codeium/windsurf/mcp_config.json`), Continue.dev (`~/.continue/config.json`), Gemini CLI (`~/.gemini/settings.json`), VS Code (`mcp.servers` in `settings.json`) — all MCP server configs audited with the same rules
+
+*Third-party AI tools* — MCP server configs audited with the same exfiltration, broad-filesystem, sensitive-path, and sprawl rules as Claude tools
+- **Cursor** — `~/.cursor/mcp.json`
+- **Windsurf** — `~/.codeium/windsurf/mcp_config.json`
+- **Continue.dev** — `~/.continue/config.json`
+- **Gemini CLI** — `~/.gemini/settings.json`
+- **VS Code** — `mcp.servers` in `settings.json` (MCP support added in VS Code 1.99)
+
+*Host security*
 - **Shell configs** — hardcoded AI API keys in `.zshrc`, `.bashrc`, `.zprofile`, etc.
 - **macOS TCC permissions** — Full Disk Access, Screen Recording, Accessibility granted to AI apps
 - **macOS system security** — SIP, FileVault, Gatekeeper status
@@ -351,15 +369,15 @@ sentinel host-scan --ignore-rule HOST_LARGE_MEMORY
 | `HOST_SHELL_UNRESTRICTED` | CRITICAL | config | `Bash` in `allowedTools` — shell runs without confirmation prompt |
 | `HOST_SIP_DISABLED` | CRITICAL | system | macOS System Integrity Protection is off |
 | `HOST_API_KEY_IN_SHELL` | HIGH | data_exposure | AI API keys hardcoded in shell config files |
-| `HOST_MCP_EXFIL_PATH` | HIGH | config | MCP server has both filesystem access and network capability |
+| `HOST_MCP_EXFIL_PATH` | HIGH | config | Any AI tool's MCP server has both filesystem access and network capability |
 | `HOST_FDA_AI_APP` | HIGH | permissions | Full Disk Access granted to an AI app or its terminal |
 | `HOST_SCREEN_RECORDING_AI` | HIGH | permissions | Screen Recording permission granted to an AI app |
 | `HOST_AI_PROCESS_EXPOSED` | HIGH | network | AI-related process listening on a non-localhost interface |
 | `HOST_FILEVAULT_OFF` | HIGH | system | FileVault disk encryption is disabled |
 | `HOST_ACCESSIBILITY_AI` | MEDIUM | permissions | Accessibility permission granted to an AI app |
 | `HOST_HOOKS_SHELL` | MEDIUM | config | Claude Code shell hooks that could interpolate AI output |
-| `HOST_MCP_BROAD_FS` | MEDIUM | config | MCP server configured with home-dir or root-level path |
-| `HOST_MCP_SENSITIVE_PATH` | MEDIUM | config | MCP server has access to `~/.ssh`, `~/.aws`, `~/.kube`, or Keychain |
+| `HOST_MCP_BROAD_FS` | MEDIUM | config | Any AI tool's MCP server configured with home-dir or root-level path |
+| `HOST_MCP_SENSITIVE_PATH` | MEDIUM | config | Any AI tool's MCP server has access to `~/.ssh`, `~/.aws`, `~/.kube`, or Keychain |
 | `HOST_MANY_MCP_SERVERS` | MEDIUM | config | 8+ MCP servers across all detected AI tools — large prompt injection attack surface |
 | `HOST_GATEKEEPER_OFF` | MEDIUM | system | Gatekeeper disabled — unsigned binaries run without warning |
 | `HOST_LARGE_MEMORY` | LOW | data_exposure | Claude Code memory files exceed 50 MB of accumulated conversation data |
@@ -370,6 +388,85 @@ No API key required. No network calls.
 
 ---
 
+### `sentinel redteam mcp` — active MCP server exploitation
+
+The active red-team module for MCP servers. Every finding is backed by confirmed evidence from the server's actual response — no heuristics, no noise. If a traversal finding says it read `/etc/passwd`, it read `/etc/passwd`.
+
+Requires `httpx`: `pip install "agentsentinel-cli[mcp]"`
+
+```bash
+# Full run — all 5 phases, unified report
+sentinel redteam mcp full http://localhost:8000
+sentinel redteam mcp full http://localhost:8000 --intensity high --format json
+
+# Targeted phases
+sentinel redteam mcp recon   http://localhost:8000          # enumerate attack surface
+sentinel redteam mcp auth    http://localhost:8000          # auth bypass (5 credential scenarios)
+sentinel redteam mcp inject  http://localhost:8000          # all injection techniques
+sentinel redteam mcp poison  http://localhost:8000          # tool description + result injection
+sentinel redteam mcp fuzz    http://localhost:8000          # schema and type boundary fuzzing
+
+# Surgical injection — pick your techniques
+sentinel redteam mcp inject http://localhost:8000 --type traverse
+sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
+sentinel redteam mcp inject http://localhost:8000 --type cmd --type sqli --intensity high
+
+# With auth
+sentinel redteam mcp full http://localhost:8000 \
+  --auth-header "Authorization: Bearer token"
+
+# stdio transport (local MCP servers)
+sentinel redteam mcp full --stdio "python my_mcp_server.py"
+
+# CI gate — fail if any CRITICAL confirmed
+sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
+
+# Save report
+sentinel redteam mcp full http://localhost:8000 --output report.json
+```
+
+**Phases:**
+
+| Phase | Command | What it tests |
+|-------|---------|---------------|
+| 1 — Recon | `recon` | Tool inventory, resource listing, dangerous capability flags |
+| 2 — Auth Bypass | `auth` | 5 credential scenarios: no creds, empty bearer, garbage token, invalid JWT, JWT alg:none |
+| 3 — Injection | `inject` | Path traversal, SSRF, command injection, SQL injection — payload fired, pattern matched in response |
+| 4 — Poison | `poison` | Static: adversarial instructions in tool descriptions. Dynamic: LLM instruction injection via tool parameters |
+| 5 — Fuzz | `fuzz` | Stack traces, internal path disclosure, template injection eval, type confusion |
+
+**Injection techniques (`--type`):**
+
+| Technique | What it confirms |
+|-----------|-----------------|
+| `traverse` | Arbitrary file read via path traversal — evidence: `/etc/passwd` content, `.env` keys |
+| `ssrf` | Server-side request forgery — evidence: AWS IMDS tokens, Redis/SSH banners, cloud metadata |
+| `cmd` | OS command injection — evidence: `uid=0(root)` from `id`, `REDTEAM_CMD_CONFIRMED` sentinel |
+| `sqli` | SQL injection — evidence: DB error messages (`ORA-`, `You have an error in your SQL syntax`) |
+| `llm` | LLM instruction injection via tool result — evidence: sentinel string echoed in clean response |
+
+**Intensity levels (`--intensity`):**
+
+| Level | Payloads per technique | Use case |
+|-------|----------------------|----------|
+| `low` | 5 | Fast CI gate |
+| `medium` | 15 | Standard engagement (default) |
+| `high` | Full library (~20) | Thorough pentest |
+
+**Finding severities:**
+
+| Severity | Example |
+|----------|---------|
+| CRITICAL | Path traversal confirmed — `/etc/passwd` content in response |
+| HIGH | LLM instruction injection — sentinel reflected in clean tool result |
+| MEDIUM | Input reflected in error message (injection vector, lower confidence) |
+| LOW | Unexpected content returned on malformed input |
+| INFO | Auth enforced on handshake, tool inventory |
+
+Every finding includes a **MITRE ATLAS** ID and **OWASP ASI** ID. Use `--verbose` to see full request/response bodies.
+
+---
+
 ## Finding suppression
 
 Use `--ignore-rule` to suppress findings by rule ID. Suppressed findings are excluded from `--fail-on` evaluation — they don't break CI gates.
@@ -397,11 +494,11 @@ Supported on: `sentinel scan`, `sentinel a2a`, `sentinel mcp scan`, `sentinel su
 
 | OWASP Risk | ID | sentinel coverage |
 |------------|-----|------------------|
-| Agent Goal Hijack | ASI01 | `sentinel scan` (PROMPT_INJECTION_VECTOR), `sentinel supply-chain` (SC01) |
-| Tool Misuse & Exploitation | ASI02 | `sentinel mcp scan`, `sentinel scan` |
-| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED) |
-| **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI semantic analysis) |
-| Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` (CODE_EXECUTION_TOOL) |
+| Agent Goal Hijack | ASI01 | `sentinel scan` (PROMPT_INJECTION_VECTOR), `sentinel supply-chain` (SC01), **`sentinel redteam mcp poison`** (confirmed injection) |
+| Tool Misuse & Exploitation | ASI02 | `sentinel mcp scan`, `sentinel scan`, **`sentinel redteam mcp inject`** (confirmed exploitation) |
+| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED), **`sentinel redteam mcp auth`** (bypass confirmation) |
+| **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI semantic analysis), **`sentinel redteam mcp poison`** (static description scan) |
+| Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` (CODE_EXECUTION_TOOL), **`sentinel redteam mcp inject --type cmd`** |
 | **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage), `sentinel host-scan` (HOST_LARGE_MEMORY) |
 | **Insecure Inter-Agent Communication** | **ASI07** | **`sentinel a2a`** (call graph + trust rules) |
 | Cascading Agent Failures | ASI08 | `sentinel discover` (surface unmonitored agents) |
@@ -442,6 +539,9 @@ jobs:
 
       - name: Host AI security posture
         run: sentinel host-scan --fail-on HIGH
+
+      - name: MCP red-team (active exploitation check)
+        run: sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
 ```
 
 Use `.sentinelignore` at the repo root to suppress accepted risks without weakening the gate:
@@ -456,7 +556,7 @@ NO_AUTH    # server is behind an authenticated reverse proxy
 ## Requirements
 
 - Python 3.10+
-- No API key required for: `sentinel discover`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel scan`, `sentinel secrets`, `sentinel inspect --no-ai`, `sentinel a2a`, `sentinel host-scan`
+- No API key required for: `sentinel discover`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel scan`, `sentinel secrets`, `sentinel inspect --no-ai`, `sentinel a2a`, `sentinel host-scan`, `sentinel redteam mcp`
 - `ANTHROPIC_API_KEY` required for: `sentinel supply-chain --ai`, `sentinel inspect` (AI summary)
 
 ---

{agentsentinel_cli-0.9.2 → agentsentinel_cli-0.9.4}/README.md

@@ -25,7 +25,8 @@ pipx install agentsentinel-cli
 | `sentinel secrets` | Are credentials or PII exposed in these files? |
 | `sentinel inspect` | What framework, model, and role is this agent? |
 | `sentinel a2a` | Are multi-agent trust boundaries safe? |
-| `sentinel host-scan` | What is my local AI security posture? |
+| `sentinel host-scan` | What is my local AI security posture across all AI tools? |
+| `sentinel redteam mcp` | Can I actively exploit this MCP server? |
 
 ---
 
@@ -53,6 +54,11 @@ sentinel secrets ~/.claude/projects/   # scan Claude Code memory
 # Local AI security posture — no network calls
 sentinel host-scan
 sentinel host-scan --fail-on HIGH
+
+# Active red-team — real attacks, confirmed exploitation
+sentinel redteam mcp full http://localhost:8000
+sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
+sentinel redteam mcp auth http://localhost:8000
 ```
 
 ---
@@ -291,7 +297,9 @@ Covers **ASI07** (Insecure Inter-Agent Communication).
 
 ### `sentinel host-scan` — local AI security posture audit
 
-Audits your machine's AI security posture without any network calls. Reads Claude Code and Claude Desktop configurations, shell credential files, macOS privacy permissions (TCC), system security settings, and running AI processes.
+Audits your machine's AI security posture without any network calls. Discovers and audits MCP server configurations across every major AI coding tool on the host — Claude Code, Claude Desktop, Cursor, Windsurf, Continue.dev, Gemini CLI, and VS Code — then checks shell credentials, macOS privacy permissions, system security settings, and running AI processes.
+
+Works on macOS, Linux, and Windows. No API key required.
 
 ```bash
 sentinel host-scan
@@ -301,9 +309,19 @@ sentinel host-scan --ignore-rule HOST_LARGE_MEMORY
 ```
 
 **What it checks:**
-- **Claude Code** — `allowedTools` (Bash bypass), MCP server configs, shell hooks
+
+*Anthropic tools*
+- **Claude Code** — `allowedTools` (shell bypass), MCP server configs, shell hooks
 - **Claude Desktop** — MCP server configs
-- **Third-party AI tools** — Cursor (`~/.cursor/mcp.json`), Windsurf (`~/.codeium/windsurf/mcp_config.json`), Continue.dev (`~/.continue/config.json`), Gemini CLI (`~/.gemini/settings.json`), VS Code (`mcp.servers` in `settings.json`) — all MCP server configs audited with the same rules
+
+*Third-party AI tools* — MCP server configs audited with the same exfiltration, broad-filesystem, sensitive-path, and sprawl rules as Claude tools
+- **Cursor** — `~/.cursor/mcp.json`
+- **Windsurf** — `~/.codeium/windsurf/mcp_config.json`
+- **Continue.dev** — `~/.continue/config.json`
+- **Gemini CLI** — `~/.gemini/settings.json`
+- **VS Code** — `mcp.servers` in `settings.json` (MCP support added in VS Code 1.99)
+
+*Host security*
 - **Shell configs** — hardcoded AI API keys in `.zshrc`, `.bashrc`, `.zprofile`, etc.
 - **macOS TCC permissions** — Full Disk Access, Screen Recording, Accessibility granted to AI apps
 - **macOS system security** — SIP, FileVault, Gatekeeper status
@@ -317,15 +335,15 @@ sentinel host-scan --ignore-rule HOST_LARGE_MEMORY
 | `HOST_SHELL_UNRESTRICTED` | CRITICAL | config | `Bash` in `allowedTools` — shell runs without confirmation prompt |
 | `HOST_SIP_DISABLED` | CRITICAL | system | macOS System Integrity Protection is off |
 | `HOST_API_KEY_IN_SHELL` | HIGH | data_exposure | AI API keys hardcoded in shell config files |
-| `HOST_MCP_EXFIL_PATH` | HIGH | config | MCP server has both filesystem access and network capability |
+| `HOST_MCP_EXFIL_PATH` | HIGH | config | Any AI tool's MCP server has both filesystem access and network capability |
 | `HOST_FDA_AI_APP` | HIGH | permissions | Full Disk Access granted to an AI app or its terminal |
 | `HOST_SCREEN_RECORDING_AI` | HIGH | permissions | Screen Recording permission granted to an AI app |
 | `HOST_AI_PROCESS_EXPOSED` | HIGH | network | AI-related process listening on a non-localhost interface |
 | `HOST_FILEVAULT_OFF` | HIGH | system | FileVault disk encryption is disabled |
 | `HOST_ACCESSIBILITY_AI` | MEDIUM | permissions | Accessibility permission granted to an AI app |
 | `HOST_HOOKS_SHELL` | MEDIUM | config | Claude Code shell hooks that could interpolate AI output |
-| `HOST_MCP_BROAD_FS` | MEDIUM | config | MCP server configured with home-dir or root-level path |
-| `HOST_MCP_SENSITIVE_PATH` | MEDIUM | config | MCP server has access to `~/.ssh`, `~/.aws`, `~/.kube`, or Keychain |
+| `HOST_MCP_BROAD_FS` | MEDIUM | config | Any AI tool's MCP server configured with home-dir or root-level path |
+| `HOST_MCP_SENSITIVE_PATH` | MEDIUM | config | Any AI tool's MCP server has access to `~/.ssh`, `~/.aws`, `~/.kube`, or Keychain |
 | `HOST_MANY_MCP_SERVERS` | MEDIUM | config | 8+ MCP servers across all detected AI tools — large prompt injection attack surface |
 | `HOST_GATEKEEPER_OFF` | MEDIUM | system | Gatekeeper disabled — unsigned binaries run without warning |
 | `HOST_LARGE_MEMORY` | LOW | data_exposure | Claude Code memory files exceed 50 MB of accumulated conversation data |
@@ -336,6 +354,85 @@ No API key required. No network calls.
 
 ---
 
+### `sentinel redteam mcp` — active MCP server exploitation
+
+The active red-team module for MCP servers. Every finding is backed by confirmed evidence from the server's actual response — no heuristics, no noise. If a traversal finding says it read `/etc/passwd`, it read `/etc/passwd`.
+
+Requires `httpx`: `pip install "agentsentinel-cli[mcp]"`
+
+```bash
+# Full run — all 5 phases, unified report
+sentinel redteam mcp full http://localhost:8000
+sentinel redteam mcp full http://localhost:8000 --intensity high --format json
+
+# Targeted phases
+sentinel redteam mcp recon   http://localhost:8000          # enumerate attack surface
+sentinel redteam mcp auth    http://localhost:8000          # auth bypass (5 credential scenarios)
+sentinel redteam mcp inject  http://localhost:8000          # all injection techniques
+sentinel redteam mcp poison  http://localhost:8000          # tool description + result injection
+sentinel redteam mcp fuzz    http://localhost:8000          # schema and type boundary fuzzing
+
+# Surgical injection — pick your techniques
+sentinel redteam mcp inject http://localhost:8000 --type traverse
+sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
+sentinel redteam mcp inject http://localhost:8000 --type cmd --type sqli --intensity high
+
+# With auth
+sentinel redteam mcp full http://localhost:8000 \
+  --auth-header "Authorization: Bearer token"
+
+# stdio transport (local MCP servers)
+sentinel redteam mcp full --stdio "python my_mcp_server.py"
+
+# CI gate — fail if any CRITICAL confirmed
+sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
+
+# Save report
+sentinel redteam mcp full http://localhost:8000 --output report.json
+```
+
+**Phases:**
+
+| Phase | Command | What it tests |
+|-------|---------|---------------|
+| 1 — Recon | `recon` | Tool inventory, resource listing, dangerous capability flags |
+| 2 — Auth Bypass | `auth` | 5 credential scenarios: no creds, empty bearer, garbage token, invalid JWT, JWT alg:none |
+| 3 — Injection | `inject` | Path traversal, SSRF, command injection, SQL injection — payload fired, pattern matched in response |
+| 4 — Poison | `poison` | Static: adversarial instructions in tool descriptions. Dynamic: LLM instruction injection via tool parameters |
+| 5 — Fuzz | `fuzz` | Stack traces, internal path disclosure, template injection eval, type confusion |
+
+**Injection techniques (`--type`):**
+
+| Technique | What it confirms |
+|-----------|-----------------|
+| `traverse` | Arbitrary file read via path traversal — evidence: `/etc/passwd` content, `.env` keys |
+| `ssrf` | Server-side request forgery — evidence: AWS IMDS tokens, Redis/SSH banners, cloud metadata |
+| `cmd` | OS command injection — evidence: `uid=0(root)` from `id`, `REDTEAM_CMD_CONFIRMED` sentinel |
+| `sqli` | SQL injection — evidence: DB error messages (`ORA-`, `You have an error in your SQL syntax`) |
+| `llm` | LLM instruction injection via tool result — evidence: sentinel string echoed in clean response |
+
+**Intensity levels (`--intensity`):**
+
+| Level | Payloads per technique | Use case |
+|-------|----------------------|----------|
+| `low` | 5 | Fast CI gate |
+| `medium` | 15 | Standard engagement (default) |
+| `high` | Full library (~20) | Thorough pentest |
+
+**Finding severities:**
+
+| Severity | Example |
+|----------|---------|
+| CRITICAL | Path traversal confirmed — `/etc/passwd` content in response |
+| HIGH | LLM instruction injection — sentinel reflected in clean tool result |
+| MEDIUM | Input reflected in error message (injection vector, lower confidence) |
+| LOW | Unexpected content returned on malformed input |
+| INFO | Auth enforced on handshake, tool inventory |
+
+Every finding includes a **MITRE ATLAS** ID and **OWASP ASI** ID. Use `--verbose` to see full request/response bodies.
+
+---
+
 ## Finding suppression
 
 Use `--ignore-rule` to suppress findings by rule ID. Suppressed findings are excluded from `--fail-on` evaluation — they don't break CI gates.
@@ -363,11 +460,11 @@ Supported on: `sentinel scan`, `sentinel a2a`, `sentinel mcp scan`, `sentinel su
 
 | OWASP Risk | ID | sentinel coverage |
 |------------|-----|------------------|
-| Agent Goal Hijack | ASI01 | `sentinel scan` (PROMPT_INJECTION_VECTOR), `sentinel supply-chain` (SC01) |
-| Tool Misuse & Exploitation | ASI02 | `sentinel mcp scan`, `sentinel scan` |
-| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED) |
-| **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI semantic analysis) |
-| Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` (CODE_EXECUTION_TOOL) |
+| Agent Goal Hijack | ASI01 | `sentinel scan` (PROMPT_INJECTION_VECTOR), `sentinel supply-chain` (SC01), **`sentinel redteam mcp poison`** (confirmed injection) |
+| Tool Misuse & Exploitation | ASI02 | `sentinel mcp scan`, `sentinel scan`, **`sentinel redteam mcp inject`** (confirmed exploitation) |
+| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED), **`sentinel redteam mcp auth`** (bypass confirmation) |
+| **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI semantic analysis), **`sentinel redteam mcp poison`** (static description scan) |
+| Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` (CODE_EXECUTION_TOOL), **`sentinel redteam mcp inject --type cmd`** |
 | **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage), `sentinel host-scan` (HOST_LARGE_MEMORY) |
 | **Insecure Inter-Agent Communication** | **ASI07** | **`sentinel a2a`** (call graph + trust rules) |
 | Cascading Agent Failures | ASI08 | `sentinel discover` (surface unmonitored agents) |
@@ -408,6 +505,9 @@ jobs:
 
       - name: Host AI security posture
         run: sentinel host-scan --fail-on HIGH
+
+      - name: MCP red-team (active exploitation check)
+        run: sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
 ```
 
 Use `.sentinelignore` at the repo root to suppress accepted risks without weakening the gate:
@@ -422,7 +522,7 @@ NO_AUTH    # server is behind an authenticated reverse proxy
 ## Requirements
 
 - Python 3.10+
-- No API key required for: `sentinel discover`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel scan`, `sentinel secrets`, `sentinel inspect --no-ai`, `sentinel a2a`, `sentinel host-scan`
+- No API key required for: `sentinel discover`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel scan`, `sentinel secrets`, `sentinel inspect --no-ai`, `sentinel a2a`, `sentinel host-scan`, `sentinel redteam mcp`
 - `ANTHROPIC_API_KEY` required for: `sentinel supply-chain --ai`, `sentinel inspect` (AI summary)
 
 ---