agentsentinel-cli 0.9.4__tar.gz → 0.9.6__tar.gz

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsentinel-cli
-Version: 0.9.4
+Version: 0.9.6
 Summary: AI agent and MCP server security scanner — discovery, static analysis, supply chain audit, and multi-agent trust analysis
 Project-URL: Homepage, https://github.com/jaydenaung/agentsentinel-cli
 Project-URL: Repository, https://github.com/jaydenaung/agentsentinel-cli

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.6}/agentsentinel_cli/cli.py

@@ -1157,6 +1157,66 @@ def redteam_mcp_recon(
     _check_exit(findings, fail_on)
 
 
+# ── sentinel redteam mcp preauth ─────────────────────────────────────────────
+
+@redteam_mcp_group.command("preauth")
+@click.argument("target", required=False, metavar="URL")
+@click.option("--timeout", default=15.0, show_default=True, metavar="SECONDS")
+@click.option("--format", "fmt", type=click.Choice(["text", "json"]), default="text")
+@click.option("--output", "output_path", default=None, metavar="FILE")
+@click.option("--verbose", "-v", is_flag=True, default=False)
+@click.option("--fail-on", type=click.Choice(["CRITICAL", "HIGH", "MEDIUM", "LOW"]), default=None)
+def redteam_mcp_preauth(
+    target: str | None, timeout: float, fmt: str,
+    output_path: str | None, verbose: bool, fail_on: str | None,
+) -> None:
+    """HTTP-layer fingerprinting — runs with zero credentials.
+
+    Probes the server before any MCP initialize attempt: CORS config,
+    OAuth metadata, version disclosure, unauthenticated paths, SSE stream.
+    Produces findings even when the server blocks unauthenticated MCP access.
+
+    \b
+    Examples:
+        sentinel redteam mcp preauth http://localhost:3000
+        sentinel redteam mcp preauth http://localhost:3000 --verbose
+    """
+    import time
+    from agentsentinel_cli.redteam.mcp_preauth import run_preauth
+    from agentsentinel_cli.redteam.mcp_oauth import run_oauth
+    from agentsentinel_cli.redteam.models import RedTeamResult
+    from agentsentinel_cli.redteam.report import print_redteam_result, as_redteam_json
+
+    if not target:
+        console.print("[red]Error:[/red] provide a URL.")
+        console.print("  Example: [dim]sentinel redteam mcp preauth http://localhost:3000[/dim]")
+        sys.exit(1)
+
+    target = _normalize_url(target)
+    t0 = time.monotonic()
+
+    preauth_findings, preauth_count = run_preauth(url=target, timeout=timeout, verbose=verbose)
+    oauth_findings, oauth_count = run_oauth(
+        url=target, original_headers={}, timeout=timeout, verbose=verbose,
+    )
+    all_findings = preauth_findings + oauth_findings
+
+    result = RedTeamResult(
+        target=target, server_name="unknown", server_version="unknown",
+        transport="http", modules_run=["preauth", "oauth"], findings=all_findings,
+        tool_count=0, attack_count=preauth_count + oauth_count,
+        duration_s=time.monotonic() - t0,
+    )
+
+    if fmt == "json":
+        click.echo(as_redteam_json(result))
+    else:
+        print_redteam_result(result, verbose)
+
+    _save_output(output_path, result)
+    _check_exit(all_findings, fail_on)
+
+
 # ── sentinel redteam mcp auth ─────────────────────────────────────────────────
 
 @redteam_mcp_group.command("auth")
@@ -1216,9 +1276,18 @@ def redteam_mcp_auth(
         timeout=timeout, verbose=verbose,
     )
 
+    # OAuth 2.0 attack surface (HTTP-layer, no session needed)
+    if target and not stdio_cmd:
+        from agentsentinel_cli.redteam.mcp_oauth import run_oauth
+        oauth_findings, oauth_count = run_oauth(
+            url=target, original_headers=headers, timeout=timeout, verbose=verbose,
+        )
+        findings = findings + oauth_findings
+        scenarios_tested += oauth_count
+
     result = RedTeamResult(
         target=display, server_name=server_name, server_version=server_version,
-        transport=transport, modules_run=["auth"], findings=findings,
+        transport=transport, modules_run=["auth", "oauth"], findings=findings,
         tool_count=tool_count, attack_count=scenarios_tested,
         duration_s=time.monotonic() - t0,
     )
@@ -1507,6 +1576,8 @@ def redteam_mcp_full(
     """
     import time
     from agentsentinel_cli.redteam.transport import RedTeamSession
+    from agentsentinel_cli.redteam.mcp_preauth import run_preauth
+    from agentsentinel_cli.redteam.mcp_oauth import run_oauth
     from agentsentinel_cli.redteam.mcp_recon import run_recon
     from agentsentinel_cli.redteam.mcp_auth import run_auth_bypass
     from agentsentinel_cli.redteam.mcp_inject import run_inject
@@ -1529,7 +1600,21 @@ def redteam_mcp_full(
 
     t0 = time.monotonic()
 
-    # ── Phase 1–5: run inside a single persistent session ────────────────────
+    # ── Phase 1–2: HTTP-layer probes — no session or credentials required ────
+    if target and not stdio_cmd:
+        preauth_findings, preauth_count = run_preauth(
+            url=target, timeout=timeout, verbose=verbose,
+        )
+        all_findings.extend(preauth_findings)
+        total_attacks += preauth_count
+
+        oauth_findings, oauth_count = run_oauth(
+            url=target, original_headers=headers, timeout=timeout, verbose=verbose,
+        )
+        all_findings.extend(oauth_findings)
+        total_attacks += oauth_count
+
+    # ── Phase 3–7: run inside a single persistent MCP session ───────────────
     try:
         with RedTeamSession(url=target, stdio_cmd=stdio_cmd,
                             extra_headers=headers, timeout=timeout) as session:
@@ -1554,11 +1639,11 @@ def redteam_mcp_full(
                 transient=True,
             ) as progress:
 
-                task = progress.add_task("Phase 1/5 — recon…", total=None)
+                task = progress.add_task("Phase 3/7 — recon…", total=None)
                 recon_findings, _ = run_recon(session, verbose)
                 all_findings.extend(recon_findings)
 
-                progress.update(task, description="Phase 2/5 — auth bypass…")
+                progress.update(task, description="Phase 4/7 — auth bypass…")
                 auth_findings, auth_scenarios = run_auth_bypass(
                     url=target, stdio_cmd=stdio_cmd,
                     original_headers=headers, timeout=timeout, verbose=verbose,
@@ -1566,10 +1651,9 @@ def redteam_mcp_full(
                 all_findings.extend(auth_findings)
                 total_attacks += auth_scenarios
 
-                progress.update(task, description="Phase 3/5 — injection…")
+                progress.update(task, description="Phase 5/7 — injection…")
                 inject_findings, inject_count = run_inject(
                     session,
-                    # LLM injection is handled by poison phase — no duplication
                     techniques=["traverse", "ssrf", "cmd", "sqli"],
                     intensity=intensity,
                     include_dangerous=include_dangerous,
@@ -1578,30 +1662,34 @@ def redteam_mcp_full(
                 all_findings.extend(inject_findings)
                 total_attacks += inject_count
 
-                progress.update(task, description="Phase 4/5 — poisoning…")
+                progress.update(task, description="Phase 6/7 — poisoning…")
                 poison_findings, poison_count = run_poison(session, verbose)
                 all_findings.extend(poison_findings)
                 total_attacks += poison_count
 
-                progress.update(task, description="Phase 5/5 — fuzzing…")
+                progress.update(task, description="Phase 7/7 — fuzzing…")
                 fuzz_findings, fuzz_count = run_fuzz(session, verbose)
                 all_findings.extend(fuzz_findings)
                 total_attacks += fuzz_count
 
     except McpAuthRequired as exc:
         console.print(f"\n[bold yellow]Auth required[/bold yellow] (HTTP {exc.status_code})")
+        console.print("  Preauth + OAuth findings above are still valid without a token.")
         console.print("  Use: [bold]--auth-header 'Authorization: Bearer <token>'[/bold]")
-        sys.exit(1)
+        if not all_findings:
+            sys.exit(1)
+        # Fall through — report whatever preauth/oauth found
     except McpError as exc:
         console.print(f"\n[red]Connection failed:[/red] {exc}")
-        sys.exit(1)
+        if not all_findings:
+            sys.exit(1)
 
     result = RedTeamResult(
         target=display,
         server_name=server_name,
         server_version=server_version,
         transport=transport,
-        modules_run=["recon", "auth", "inject", "poison", "fuzz"],
+        modules_run=["preauth", "oauth", "recon", "auth", "inject", "poison", "fuzz"],
         findings=all_findings,
         tool_count=tool_count,
         attack_count=total_attacks,

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.6}/agentsentinel_cli/redteam/mcp_fuzz.py

@@ -138,9 +138,13 @@ def _emit(
     if is_reflection:
         severity, title = "MEDIUM", "Input reflected in error response (no HTML encoding)"
         scenario = (
-            f"Tool '{tool_name}' echoes user-controlled input without encoding via parameter '{param}'. "
-            "In an agent context, reflected content enters the LLM context window directly. "
-            "In a web UI context, this would be a stored/reflected XSS vector."
+            f"Tool '{tool_name}' echoes user-controlled input without sanitization via parameter '{param}'. "
+            "Reflected content enters any connected agent's context window directly, making this an "
+            "injection vector for adversarial instructions embedded in the input."
+        )
+        remediation = (
+            "Sanitize user input before including it in error messages. "
+            "Strip or HTML-encode special characters in all error responses."
         )
     elif is_trace:
         severity, title = "HIGH", "Unhandled exception — stack trace leaked"
@@ -149,21 +153,34 @@ def _emit(
             "Stack traces reveal internal paths, library versions, and code structure "
             "that attackers use to craft further exploits."
         )
+        remediation = (
+            "Catch all exceptions server-side and return a generic error message. "
+            "Never expose stack traces, internal paths, or library names to clients."
+        )
     elif is_template:
         severity, title = "HIGH", "Template/expression injection confirmed"
         scenario = (
-            f"Tool '{tool_name}' evaluated a template expression. "
+            f"Tool '{tool_name}' evaluated a template expression in user-controlled input. "
             "Server-side template injection can escalate to arbitrary code execution."
         )
+        remediation = (
+            "Disable server-side template evaluation of user-controlled strings. "
+            "Use a templating engine that escapes by default and never eval user input."
+        )
     elif is_path:
         severity, title = "MEDIUM", "Internal file path leaked in error response"
         scenario = (
-            f"Tool '{tool_name}' exposes an internal filesystem path. "
+            f"Tool '{tool_name}' exposes an internal filesystem path in its error response. "
             "Attackers use path disclosure to target specific files in traversal attacks."
         )
+        remediation = (
+            "Sanitize error messages to exclude internal filesystem paths. "
+            "Return 'invalid input' without path context."
+        )
     else:
         severity, title = "LOW", "Unexpected information in fuzz response"
         scenario = f"Tool '{tool_name}' returned unexpected content in response to malformed input."
+        remediation = "Review what the tool returns on unexpected input and tighten input validation."
 
     param_str = f".{param}" if param else ""
     findings.append(RedTeamFinding(
@@ -178,6 +195,7 @@ def _emit(
         mitre_id="T1592.002",
         owasp_id="ASI03",
         confidence="HIGH",
+        remediation=remediation,
         request_body={"tool": tool_name, "payload": repr(raw_payload)[:100]} if verbose else None,
         response_body=result.raw_response[:500] if verbose else None,
     ))

{agentsentinel_cli-0.9.4 → agentsentinel_cli-0.9.6}/agentsentinel_cli/redteam/mcp_inject.py

@@ -26,6 +26,11 @@ _TECHNIQUE_META: dict[str, dict] = {
         "severity": "CRITICAL",
         "title": "Path traversal — arbitrary file read",
         "scenario": "Attacker can read arbitrary files from the server filesystem via parameter '{param}'.",
+        "remediation": (
+            "Restrict file access to an explicit allowlist of base directories. "
+            "Reject paths containing `..` sequences and absolute paths outside the allowed root. "
+            "Use os.path.realpath() and verify the resolved path starts with the allowed base."
+        ),
     },
     "ssrf": {
         "mitre": "T1090.002",
@@ -33,6 +38,11 @@ _TECHNIQUE_META: dict[str, dict] = {
         "severity": "CRITICAL",
         "title": "SSRF — server-side request forgery",
         "scenario": "Attacker can make the server issue requests to internal network addresses via '{param}'.",
+        "remediation": (
+            "Validate and allowlist permitted URL schemes and hosts. "
+            "Block RFC-1918 ranges (169.254.x.x, 10.x.x.x, 172.16-31.x.x, 192.168.x.x) and localhost. "
+            "Resolve DNS before allowlist checks to prevent TOCTOU bypasses."
+        ),
     },
     "cmd": {
         "mitre": "T1059",
@@ -40,6 +50,11 @@ _TECHNIQUE_META: dict[str, dict] = {
         "severity": "CRITICAL",
         "title": "Command injection — OS command execution",
         "scenario": "Attacker can execute arbitrary OS commands on the host via parameter '{param}'.",
+        "remediation": (
+            "Never pass user-controlled input to a shell. "
+            "Use subprocess with an explicit argument list (no shell=True). "
+            "If shell execution is required, validate against a strict allowlist."
+        ),
     },
     "sqli": {
         "mitre": "T1190",
@@ -47,6 +62,11 @@ _TECHNIQUE_META: dict[str, dict] = {
         "severity": "HIGH",
         "title": "SQL injection — database query manipulation",
         "scenario": "Attacker can manipulate backend SQL queries through parameter '{param}'.",
+        "remediation": (
+            "Use parameterized queries or a query builder. "
+            "Never interpolate user input into SQL strings. "
+            "Apply input length and character-set validation as a second layer."
+        ),
     },
     "llm": {
         "mitre": "AML.T0051.000",
@@ -57,6 +77,10 @@ _TECHNIQUE_META: dict[str, dict] = {
             "Tool result containing adversarial instructions flows into any connected LLM context "
             "via parameter '{param}'. Attacker-controlled input can override agent behaviour."
         ),
+        "remediation": (
+            "Do not reflect user-controlled parameter values verbatim in tool responses. "
+            "Validate inputs and reject or strip LLM instruction patterns before processing."
+        ),
     },
 }
 
@@ -140,6 +164,10 @@ def run_inject(
                             mitre_id=meta["mitre"],
                             owasp_id=meta["owasp"],
                             confidence="MEDIUM",
+                            remediation=(
+                                "Do not echo raw user input in error messages. "
+                                "Return a generic error that excludes the parameter value."
+                            ),
                             request_body={"tool": tool.name, "arguments": args} if verbose else None,
                             response_body=result.raw_response[:500] if verbose else None,
                         ))
@@ -156,6 +184,7 @@ def run_inject(
                             mitre_id=meta["mitre"],
                             owasp_id=meta["owasp"],
                             confidence="HIGH",
+                            remediation=meta.get("remediation"),
                             request_body={"tool": tool.name, "arguments": args} if verbose else None,
                             response_body=result.raw_response[:500] if verbose else None,
                         ))