agentsentinel-cli 0.9.4__tar.gz → 0.9.5__tar.gz

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsentinel-cli
-Version: 0.9.4
+Version: 0.9.5
 Summary: AI agent and MCP server security scanner — discovery, static analysis, supply chain audit, and multi-agent trust analysis
 Project-URL: Homepage, https://github.com/jaydenaung/agentsentinel-cli
 Project-URL: Repository, https://github.com/jaydenaung/agentsentinel-cli

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.5}/agentsentinel_cli/redteam/mcp_fuzz.py

@@ -138,9 +138,13 @@ def _emit(
     if is_reflection:
         severity, title = "MEDIUM", "Input reflected in error response (no HTML encoding)"
         scenario = (
-            f"Tool '{tool_name}' echoes user-controlled input without encoding via parameter '{param}'. "
-            "In an agent context, reflected content enters the LLM context window directly. "
-            "In a web UI context, this would be a stored/reflected XSS vector."
+            f"Tool '{tool_name}' echoes user-controlled input without sanitization via parameter '{param}'. "
+            "Reflected content enters any connected agent's context window directly, making this an "
+            "injection vector for adversarial instructions embedded in the input."
+        )
+        remediation = (
+            "Sanitize user input before including it in error messages. "
+            "Strip or HTML-encode special characters in all error responses."
         )
     elif is_trace:
         severity, title = "HIGH", "Unhandled exception — stack trace leaked"
@@ -149,21 +153,34 @@ def _emit(
             "Stack traces reveal internal paths, library versions, and code structure "
             "that attackers use to craft further exploits."
         )
+        remediation = (
+            "Catch all exceptions server-side and return a generic error message. "
+            "Never expose stack traces, internal paths, or library names to clients."
+        )
     elif is_template:
         severity, title = "HIGH", "Template/expression injection confirmed"
         scenario = (
-            f"Tool '{tool_name}' evaluated a template expression. "
+            f"Tool '{tool_name}' evaluated a template expression in user-controlled input. "
             "Server-side template injection can escalate to arbitrary code execution."
         )
+        remediation = (
+            "Disable server-side template evaluation of user-controlled strings. "
+            "Use a templating engine that escapes by default and never eval user input."
+        )
     elif is_path:
         severity, title = "MEDIUM", "Internal file path leaked in error response"
         scenario = (
-            f"Tool '{tool_name}' exposes an internal filesystem path. "
+            f"Tool '{tool_name}' exposes an internal filesystem path in its error response. "
             "Attackers use path disclosure to target specific files in traversal attacks."
         )
+        remediation = (
+            "Sanitize error messages to exclude internal filesystem paths. "
+            "Return 'invalid input' without path context."
+        )
     else:
         severity, title = "LOW", "Unexpected information in fuzz response"
         scenario = f"Tool '{tool_name}' returned unexpected content in response to malformed input."
+        remediation = "Review what the tool returns on unexpected input and tighten input validation."
 
     param_str = f".{param}" if param else ""
     findings.append(RedTeamFinding(
@@ -178,6 +195,7 @@ def _emit(
         mitre_id="T1592.002",
         owasp_id="ASI03",
         confidence="HIGH",
+        remediation=remediation,
         request_body={"tool": tool_name, "payload": repr(raw_payload)[:100]} if verbose else None,
         response_body=result.raw_response[:500] if verbose else None,
     ))

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.5}/agentsentinel_cli/redteam/mcp_inject.py

@@ -26,6 +26,11 @@ _TECHNIQUE_META: dict[str, dict] = {
         "severity": "CRITICAL",
         "title": "Path traversal — arbitrary file read",
         "scenario": "Attacker can read arbitrary files from the server filesystem via parameter '{param}'.",
+        "remediation": (
+            "Restrict file access to an explicit allowlist of base directories. "
+            "Reject paths containing `..` sequences and absolute paths outside the allowed root. "
+            "Use os.path.realpath() and verify the resolved path starts with the allowed base."
+        ),
     },
     "ssrf": {
         "mitre": "T1090.002",
@@ -33,6 +38,11 @@ _TECHNIQUE_META: dict[str, dict] = {
         "severity": "CRITICAL",
         "title": "SSRF — server-side request forgery",
         "scenario": "Attacker can make the server issue requests to internal network addresses via '{param}'.",
+        "remediation": (
+            "Validate and allowlist permitted URL schemes and hosts. "
+            "Block RFC-1918 ranges (169.254.x.x, 10.x.x.x, 172.16-31.x.x, 192.168.x.x) and localhost. "
+            "Resolve DNS before allowlist checks to prevent TOCTOU bypasses."
+        ),
     },
     "cmd": {
         "mitre": "T1059",
@@ -40,6 +50,11 @@ _TECHNIQUE_META: dict[str, dict] = {
         "severity": "CRITICAL",
         "title": "Command injection — OS command execution",
         "scenario": "Attacker can execute arbitrary OS commands on the host via parameter '{param}'.",
+        "remediation": (
+            "Never pass user-controlled input to a shell. "
+            "Use subprocess with an explicit argument list (no shell=True). "
+            "If shell execution is required, validate against a strict allowlist."
+        ),
     },
     "sqli": {
         "mitre": "T1190",
@@ -47,6 +62,11 @@ _TECHNIQUE_META: dict[str, dict] = {
         "severity": "HIGH",
         "title": "SQL injection — database query manipulation",
         "scenario": "Attacker can manipulate backend SQL queries through parameter '{param}'.",
+        "remediation": (
+            "Use parameterized queries or a query builder. "
+            "Never interpolate user input into SQL strings. "
+            "Apply input length and character-set validation as a second layer."
+        ),
     },
     "llm": {
         "mitre": "AML.T0051.000",
@@ -57,6 +77,10 @@ _TECHNIQUE_META: dict[str, dict] = {
             "Tool result containing adversarial instructions flows into any connected LLM context "
             "via parameter '{param}'. Attacker-controlled input can override agent behaviour."
         ),
+        "remediation": (
+            "Do not reflect user-controlled parameter values verbatim in tool responses. "
+            "Validate inputs and reject or strip LLM instruction patterns before processing."
+        ),
     },
 }
 
@@ -140,6 +164,10 @@ def run_inject(
                             mitre_id=meta["mitre"],
                             owasp_id=meta["owasp"],
                             confidence="MEDIUM",
+                            remediation=(
+                                "Do not echo raw user input in error messages. "
+                                "Return a generic error that excludes the parameter value."
+                            ),
                             request_body={"tool": tool.name, "arguments": args} if verbose else None,
                             response_body=result.raw_response[:500] if verbose else None,
                         ))
@@ -156,6 +184,7 @@ def run_inject(
                             mitre_id=meta["mitre"],
                             owasp_id=meta["owasp"],
                             confidence="HIGH",
+                            remediation=meta.get("remediation"),
                             request_body={"tool": tool.name, "arguments": args} if verbose else None,
                             response_body=result.raw_response[:500] if verbose else None,
                         ))

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.5}/agentsentinel_cli/redteam/mcp_poison.py

@@ -62,10 +62,67 @@ def run_poison(
 
     _static_description_scan(session, findings)
     attack_count += _dynamic_result_injection(session, findings, verbose)
+    _dedup_error_echo(findings)
 
     return findings, attack_count
 
 
+def _dedup_error_echo(findings: list[RedTeamFinding]) -> None:
+    """
+    Merge same-root-cause error echo findings into one finding.
+    When multiple tools share the same parameter name and the same issue
+    (error echo), listing them separately inflates counts without adding
+    signal. Merge into one finding that lists all affected tools.
+    """
+    # Group by (attack_type, severity, confidence, parameter, title-template)
+    # where title contains "error response" — that's our dedup signal.
+    from collections import defaultdict
+    groups: dict[tuple, list[int]] = defaultdict(list)
+    for i, f in enumerate(findings):
+        if "error response" in f.title.lower() and f.attack_type == "poison":
+            key = (f.attack_type, f.severity, f.confidence, f.parameter or "")
+            groups[key].append(i)
+
+    # Only merge groups with 2+ findings; process in reverse order to preserve indices
+    to_remove: set[int] = set()
+    for key, indices in groups.items():
+        if len(indices) < 2:
+            continue
+        primary_idx = indices[0]
+        primary = findings[primary_idx]
+        affected_tools = [findings[i].tool_name for i in indices]
+        param = key[3]
+
+        findings[primary_idx] = RedTeamFinding(
+            attack_type=primary.attack_type,
+            severity=primary.severity,
+            title=(
+                f"Input reflected in error responses (injection vector) — "
+                f"{len(affected_tools)} tools affected"
+            ),
+            tool_name=", ".join(affected_tools),
+            parameter=primary.parameter,
+            payload=primary.payload,
+            evidence=primary.evidence,
+            exploit_scenario=(
+                f"Tools [{', '.join(affected_tools)}] all echo user-controlled input verbatim "
+                f"in error messages via the '{param}' parameter. Adversarial LLM instructions "
+                "injected through any of these tools will appear in a connected agent's context "
+                "window inside an error message. Whether the agent's LLM acts on error-wrapped "
+                "instructions depends on its alignment and system prompt."
+            ),
+            mitre_id=primary.mitre_id,
+            owasp_id=primary.owasp_id,
+            confidence=primary.confidence,
+            remediation=primary.remediation,
+        )
+        to_remove.update(indices[1:])
+
+    # Remove merged duplicates (in reverse order to keep indices stable)
+    for i in sorted(to_remove, reverse=True):
+        findings.pop(i)
+
+
 def _static_description_scan(
     session: RedTeamSession,
     findings: list[RedTeamFinding],
@@ -95,6 +152,11 @@ def _static_description_scan(
                     mitre_id="AML.T0051.001",
                     owasp_id="ASI04",
                     confidence="HIGH",
+                    remediation=(
+                        "Audit all tool descriptions before deployment. Remove any instructions "
+                        "targeting LLM behavior ('ignore previous instructions', role overrides, etc.). "
+                        "Descriptions should only describe what the tool does, never direct the model."
+                    ),
                 ))
                 break  # One finding per tool
 
@@ -117,6 +179,7 @@ def _static_description_scan(
                     mitre_id="AML.T0051.001",
                     owasp_id="ASI04",
                     confidence="MEDIUM",
+                    remediation="Review tool description manually and remove any covert instruction patterns.",
                 ))
                 break
 
@@ -180,6 +243,10 @@ def _dynamic_result_injection(
                         "will appear in any connected agent's context window inside an error message. "
                         "Exploitation depends on whether the agent's LLM processes error content as instructions."
                     )
+                    remediation = (
+                        f"Do not echo raw user input in error messages. Return a generic error "
+                        f"(e.g. 'invalid path') that excludes the parameter value."
+                    )
                 else:
                     severity = "HIGH"
                     confidence = "HIGH"
@@ -190,6 +257,10 @@ def _dynamic_result_injection(
                         "calling this tool. This enables goal hijacking without access to "
                         "the agent or its system prompt."
                     )
+                    remediation = (
+                        "Do not reflect user-controlled parameter values in tool responses. "
+                        "Validate inputs and reject LLM instruction patterns before processing."
+                    )
 
                 findings.append(RedTeamFinding(
                     attack_type="poison",
@@ -207,6 +278,7 @@ def _dynamic_result_injection(
                     mitre_id="AML.T0051.000",
                     owasp_id="ASI01",
                     confidence=confidence,
+                    remediation=remediation,
                     request_body={"tool": tool.name, "arguments": args} if verbose else None,
                     response_body=result.raw_response[:500] if verbose else None,
                 ))

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.5}/agentsentinel_cli/redteam/mcp_recon.py

@@ -85,6 +85,13 @@ def run_recon(session: RedTeamSession, verbose: bool = False) -> tuple[list[RedT
 
     # HIGH: dangerous tools exposed
     if dangerous:
+        dangerous_tools_info = [t for t in info.tools if t.is_dangerous]
+        tool_details: list[str] = []
+        for t in dangerous_tools_info:
+            params = list(t.input_schema.get("properties", {}).keys())
+            param_str = f"({', '.join(params)})" if params else "(no params)"
+            tool_details.append(f"{t.name} {param_str}")
+
         findings.append(RedTeamFinding(
             attack_type="recon",
             severity="HIGH",
@@ -92,14 +99,20 @@ def run_recon(session: RedTeamSession, verbose: bool = False) -> tuple[list[RedT
             tool_name="<server>",
             parameter=None,
             payload=None,
-            evidence=", ".join(dangerous),
+            evidence="\n".join(tool_details),
             exploit_scenario=(
                 "These tools perform write/delete/execute operations. "
-                "Prompt injection into any connected agent can invoke them directly."
+                "Prompt injection into any connected agent can invoke them directly. "
+                "Use --include-dangerous to test these tools actively."
             ),
             mitre_id="AML.T0040",
             owasp_id="ASI02",
             confidence="HIGH",
+            remediation=(
+                "Apply the principle of least privilege: remove tools the server does not need. "
+                "Gate dangerous tools behind scope headers (X-Agent-Scopes) or separate "
+                "authenticated endpoints so agents cannot invoke them via prompt injection."
+            ),
         ))
 
     recon = ReconData(

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.5}/agentsentinel_cli/redteam/models.py

@@ -73,6 +73,7 @@ class RedTeamFinding:
     mitre_id: str | None
     owasp_id: str | None
     confidence: str = "HIGH"          # HIGH | MEDIUM | LOW
+    remediation: str | None = None    # what to fix
     request_body: dict | None = None  # full request (verbose mode)
     response_body: str | None = None  # full response (verbose mode)
 

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.5}/agentsentinel_cli/redteam/payloads.py

@@ -291,10 +291,15 @@ def find_evidence(technique: str, text: str) -> str | None:
     for pattern in DETECTION.get(technique, []):
         m = pattern.search(text)
         if m:
-            start = max(0, m.start() - 40)
-            end = min(len(text), m.end() + 80)
+            # Start at the beginning of the line containing the match so the
+            # snippet never starts mid-word (m.start()-40 could land mid-token).
+            line_start = text.rfind("\n", 0, m.start())
+            start = (line_start + 1) if line_start >= 0 else 0
+            # Cap how far back we go — don't include 10 unrelated lines
+            start = max(start, m.start() - 80)
+            end = min(len(text), m.end() + 120)
             snippet = text[start:end].replace("\n", "  ").strip()
-            return snippet[:200]
+            return snippet[:300]
     return None
 
 

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.5}/agentsentinel_cli/redteam/report.py

@@ -47,6 +47,7 @@ def print_redteam_result(result: RedTeamResult, verbose: bool = False) -> None:
     console.print()
     _print_header(result)
     _print_findings(result.findings, verbose)
+    _print_attack_chains(result.findings)
     _print_summary(result)
 
 
@@ -112,6 +113,9 @@ def _print_finding(f: RedTeamFinding, verbose: bool) -> None:
 
     console.print(f"  [dim]Scenario: [/dim]  {f.exploit_scenario}")
 
+    if f.remediation and f.severity not in ("INFO",):
+        console.print(f"  [dim]Fix:      [/dim]  [green]{f.remediation}[/green]")
+
     refs: list[str] = []
     if f.mitre_id:
         refs.append(f"MITRE: {f.mitre_id}")
@@ -128,6 +132,89 @@ def _print_finding(f: RedTeamFinding, verbose: bool) -> None:
         console.print(f"  [dim]Response: [/dim]  [dim]{f.response_body[:200]}[/dim]")
 
 
+def _print_attack_chains(findings: list[RedTeamFinding]) -> None:
+    """
+    Synthesize multi-step attack chains from confirmed findings.
+    Only emits when two or more findings chain into a meaningful escalation path.
+    """
+    chains: list[tuple[str, str]] = []
+
+    attack_types = {f.attack_type for f in findings}
+    severities = {f.severity for f in findings}
+    confirmed_critical = {f.attack_type for f in findings if f.severity == "CRITICAL"}
+
+    # Detect tool names from recon findings
+    all_tool_names: set[str] = set()
+    for f in findings:
+        if f.attack_type == "recon" and f.severity == "HIGH":
+            # Evidence line contains "tool_name (params)" entries
+            for part in f.evidence.split("\n"):
+                name = part.split("(")[0].strip()
+                if name:
+                    all_tool_names.add(name)
+        all_tool_names.add(f.tool_name)
+
+    has_shell = any(
+        "shell" in n or "exec" in n or "cmd" in n or "run" in n
+        for n in all_tool_names
+    )
+    has_write = any(
+        "write" in n or "append" in n or "create" in n or "delete" in n or "upload" in n
+        for n in all_tool_names
+    )
+    has_traverse = "traverse" in confirmed_critical
+    has_auth_bypass = any(
+        f.attack_type == "auth" and f.severity in ("CRITICAL", "HIGH")
+        for f in findings
+    )
+
+    if has_traverse and has_shell:
+        chains.append((
+            "CRITICAL",
+            "Read + Execute — Full host compromise path\n"
+            "    Step 1: path traversal on read_file → read ~/.ssh/id_rsa, .env, API keys\n"
+            "    Step 2: prompt inject agent → invoke execute_shell with attacker payload\n"
+            "    Impact: credential theft + arbitrary code execution on the host",
+        ))
+    elif has_traverse and has_write:
+        chains.append((
+            "CRITICAL",
+            "Read + Write — Data exfiltration and persistence\n"
+            "    Step 1: path traversal → read sensitive files (keys, configs, DB creds)\n"
+            "    Step 2: write tools → drop backdoor file or overwrite config\n"
+            "    Impact: persistent access and data exfiltration",
+        ))
+    elif has_traverse:
+        chains.append((
+            "HIGH",
+            "Read-only traversal — Reconnaissance and credential theft\n"
+            "    Step 1: path traversal → read /etc/passwd, ~/.ssh/id_rsa, .env files\n"
+            "    Impact: credential theft enabling lateral movement",
+        ))
+
+    if has_auth_bypass and (has_shell or has_write or has_traverse):
+        chains.append((
+            "CRITICAL",
+            "Unauthenticated access + dangerous tools — Zero-credential exploitation\n"
+            "    Auth bypass confirmed → all dangerous tools callable without credentials\n"
+            "    Impact: any tool capability exploitable by an unauthenticated attacker",
+        ))
+
+    if not chains:
+        return
+
+    console.print()
+    console.rule("[bold red]ATTACK CHAINS[/bold red]", style="red")
+    console.print()
+    for sev, chain_text in chains:
+        color = "bold red" if sev == "CRITICAL" else "bold orange1"
+        lines = chain_text.split("\n")
+        console.print(f"  [{color}]▶ {sev}[/{color}]  {lines[0]}")
+        for line in lines[1:]:
+            console.print(f"  [dim]{line}[/dim]")
+        console.print()
+
+
 def _print_summary(result: RedTeamResult) -> None:
     console.print()
     console.rule("[bold white]ATTACK SUMMARY[/bold white]", style="bright_blue")
@@ -181,6 +268,7 @@ def as_redteam_json(result: RedTeamResult) -> str:
             "payload":          f.payload,
             "evidence":         f.evidence,
             "exploit_scenario": f.exploit_scenario,
+            "remediation":      f.remediation,
             "mitre_id":         f.mitre_id,
             "owasp_id":         f.owasp_id,
             "confidence":       f.confidence,

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentsentinel-cli"
-version = "0.9.4"
+version = "0.9.5"
 description = "AI agent and MCP server security scanner — discovery, static analysis, supply chain audit, and multi-agent trust analysis"
 readme = "README.md"
 requires-python = ">=3.10"