agentsentinel-cli 0.9.6__tar.gz → 0.9.7__tar.gz

{agentsentinel_cli-0.9.6 → agentsentinel_cli-0.9.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsentinel-cli
-Version: 0.9.6
+Version: 0.9.7
 Summary: AI agent and MCP server security scanner — discovery, static analysis, supply chain audit, and multi-agent trust analysis
 Project-URL: Homepage, https://github.com/jaydenaung/agentsentinel-cli
 Project-URL: Repository, https://github.com/jaydenaung/agentsentinel-cli
@@ -91,8 +91,9 @@ sentinel host-scan --fail-on HIGH
 
 # Active red-team — real attacks, confirmed exploitation
 sentinel redteam mcp full http://localhost:8000
+sentinel redteam mcp preauth http://localhost:8000        # works with zero credentials
 sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
-sentinel redteam mcp auth http://localhost:8000
+sentinel redteam mcp auth http://localhost:8000           # credential bypass + OAuth 2.0
 ```
 
 ---
@@ -392,20 +393,27 @@ No API key required. No network calls.
 
 The active red-team module for MCP servers. Every finding is backed by confirmed evidence from the server's actual response — no heuristics, no noise. If a traversal finding says it read `/etc/passwd`, it read `/etc/passwd`.
 
+**`preauth` and OAuth probing run with zero credentials** — useful when the target server blocks unauthenticated MCP access entirely.
+
 Requires `httpx`: `pip install "agentsentinel-cli[mcp]"`
 
 ```bash
-# Full run — all 5 phases, unified report
+# Full run — all 7 phases, unified report
 sentinel redteam mcp full http://localhost:8000
 sentinel redteam mcp full http://localhost:8000 --intensity high --format json
 
 # Targeted phases
+sentinel redteam mcp preauth http://localhost:8000          # HTTP fingerprint — zero creds required
 sentinel redteam mcp recon   http://localhost:8000          # enumerate attack surface
-sentinel redteam mcp auth    http://localhost:8000          # auth bypass (5 credential scenarios)
+sentinel redteam mcp auth    http://localhost:8000          # credential bypass + OAuth 2.0 attacks
 sentinel redteam mcp inject  http://localhost:8000          # all injection techniques
 sentinel redteam mcp poison  http://localhost:8000          # tool description + result injection
 sentinel redteam mcp fuzz    http://localhost:8000          # schema and type boundary fuzzing
 
+# Preauth — works even when server blocks unauthenticated MCP
+sentinel redteam mcp preauth http://localhost:8000
+sentinel redteam mcp preauth http://locked-server:8000      # CORS, OAuth metadata, version disclosure
+
 # Surgical injection — pick your techniques
 sentinel redteam mcp inject http://localhost:8000 --type traverse
 sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
@@ -425,15 +433,31 @@ sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
 sentinel redteam mcp full http://localhost:8000 --output report.json
 ```
 
-**Phases:**
-
-| Phase | Command | What it tests |
-|-------|---------|---------------|
-| 1 — Recon | `recon` | Tool inventory, resource listing, dangerous capability flags |
-| 2 — Auth Bypass | `auth` | 5 credential scenarios: no creds, empty bearer, garbage token, invalid JWT, JWT alg:none |
-| 3 — Injection | `inject` | Path traversal, SSRF, command injection, SQL injection — payload fired, pattern matched in response |
-| 4 — Poison | `poison` | Static: adversarial instructions in tool descriptions. Dynamic: LLM instruction injection via tool parameters |
-| 5 — Fuzz | `fuzz` | Stack traces, internal path disclosure, template injection eval, type confusion |
+**Phases (`full` runs all 7):**
+
+| Phase | Command | Needs credentials | What it tests |
+|-------|---------|:-----------------:|---------------|
+| 1 — Pre-auth | `preauth` | No | CORS, OAuth metadata, version disclosure, unauthenticated paths, SSE stream, error disclosure |
+| 2 — OAuth | *(auto in `auth`/`full`)* | No | Public client registration, token without secret, PKCE downgrade, scope escalation, X-Agent-Scopes forgery |
+| 3 — Recon | `recon` | Yes | Tool inventory, resource listing, dangerous capability flags with input schemas |
+| 4 — Auth Bypass | `auth` | Optional | 5 credential scenarios: no creds, empty bearer, garbage token, invalid JWT, JWT alg:none |
+| 5 — Injection | `inject` | Yes | Path traversal, SSRF, command injection, SQL injection — evidence-confirmed only |
+| 6 — Poison | `poison` | Yes | Adversarial instructions in tool descriptions; LLM injection via tool parameters |
+| 7 — Fuzz | `fuzz` | Yes | Stack traces, path disclosure, template injection eval, type confusion, input reflection |
+
+**Pre-auth probes (zero credentials):**
+
+| Probe | CRITICAL | HIGH | MEDIUM |
+|-------|----------|------|--------|
+| CORS wildcard + credentials | ✓ | | |
+| CORS wildcard / reflected origin | | ✓ | |
+| Unauthenticated SSE stream | | ✓ | |
+| Public OAuth client registration | | ✓ | |
+| Token issued without `client_secret` | ✓ | | |
+| X-Agent-Scopes header forgery | ✓ | | |
+| PKCE `plain` method accepted | | | ✓ |
+| Server/framework version disclosure | | | ✓ |
+| Unauthenticated `/docs`, `/metrics` | | | ✓ |
 
 **Injection techniques (`--type`):**
 
@@ -457,13 +481,13 @@ sentinel redteam mcp full http://localhost:8000 --output report.json
 
 | Severity | Example |
 |----------|---------|
-| CRITICAL | Path traversal confirmed — `/etc/passwd` content in response |
-| HIGH | LLM instruction injection — sentinel reflected in clean tool result |
-| MEDIUM | Input reflected in error message (injection vector, lower confidence) |
+| CRITICAL | Path traversal confirmed — `/etc/passwd` content in response; OAuth token issued without secret |
+| HIGH | LLM instruction injection — sentinel reflected in clean tool result; CORS wildcard |
+| MEDIUM | Input reflected in error message; PKCE plain method accepted; version disclosure |
 | LOW | Unexpected content returned on malformed input |
-| INFO | Auth enforced on handshake, tool inventory |
+| INFO | Auth enforced on handshake, tool inventory, OAuth metadata discovered |
 
-Every finding includes a **MITRE ATLAS** ID and **OWASP ASI** ID. Use `--verbose` to see full request/response bodies.
+Every finding includes a **Fix** line, a **MITRE ATLAS** ID, and an **OWASP ASI** ID. Confirmed multi-step attack chains are synthesized in the report. Use `--verbose` to see full request/response bodies.
 
 ---
 
@@ -496,10 +520,10 @@ Supported on: `sentinel scan`, `sentinel a2a`, `sentinel mcp scan`, `sentinel su
 |------------|-----|------------------|
 | Agent Goal Hijack | ASI01 | `sentinel scan` (PROMPT_INJECTION_VECTOR), `sentinel supply-chain` (SC01), **`sentinel redteam mcp poison`** (confirmed injection) |
 | Tool Misuse & Exploitation | ASI02 | `sentinel mcp scan`, `sentinel scan`, **`sentinel redteam mcp inject`** (confirmed exploitation) |
-| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED), **`sentinel redteam mcp auth`** (bypass confirmation) |
+| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED), **`sentinel redteam mcp auth`** (credential bypass + OAuth scope escalation + X-Agent-Scopes forgery) |
 | **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI semantic analysis), **`sentinel redteam mcp poison`** (static description scan) |
 | Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` (CODE_EXECUTION_TOOL), **`sentinel redteam mcp inject --type cmd`** |
-| **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage), `sentinel host-scan` (HOST_LARGE_MEMORY) |
+| **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage), `sentinel host-scan` (HOST_LARGE_MEMORY), **`sentinel redteam mcp preauth`** (CORS misconfiguration enabling cross-origin data theft) |
 | **Insecure Inter-Agent Communication** | **ASI07** | **`sentinel a2a`** (call graph + trust rules) |
 | Cascading Agent Failures | ASI08 | `sentinel discover` (surface unmonitored agents) |
 | Rogue Agents | ASI10 | `sentinel discover` (find agents that shouldn't exist), `sentinel host-scan` (HOST_AI_PROCESS_EXPOSED) |
@@ -540,6 +564,9 @@ jobs:
       - name: Host AI security posture
         run: sentinel host-scan --fail-on HIGH
 
+      - name: MCP pre-auth probe (zero credentials needed)
+        run: sentinel redteam mcp preauth http://localhost:8000 --fail-on HIGH
+
       - name: MCP red-team (active exploitation check)
         run: sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
 ```

{agentsentinel_cli-0.9.6 → agentsentinel_cli-0.9.7}/README.md

@@ -57,8 +57,9 @@ sentinel host-scan --fail-on HIGH
 
 # Active red-team — real attacks, confirmed exploitation
 sentinel redteam mcp full http://localhost:8000
+sentinel redteam mcp preauth http://localhost:8000        # works with zero credentials
 sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
-sentinel redteam mcp auth http://localhost:8000
+sentinel redteam mcp auth http://localhost:8000           # credential bypass + OAuth 2.0
 ```
 
 ---
@@ -358,20 +359,27 @@ No API key required. No network calls.
 
 The active red-team module for MCP servers. Every finding is backed by confirmed evidence from the server's actual response — no heuristics, no noise. If a traversal finding says it read `/etc/passwd`, it read `/etc/passwd`.
 
+**`preauth` and OAuth probing run with zero credentials** — useful when the target server blocks unauthenticated MCP access entirely.
+
 Requires `httpx`: `pip install "agentsentinel-cli[mcp]"`
 
 ```bash
-# Full run — all 5 phases, unified report
+# Full run — all 7 phases, unified report
 sentinel redteam mcp full http://localhost:8000
 sentinel redteam mcp full http://localhost:8000 --intensity high --format json
 
 # Targeted phases
+sentinel redteam mcp preauth http://localhost:8000          # HTTP fingerprint — zero creds required
 sentinel redteam mcp recon   http://localhost:8000          # enumerate attack surface
-sentinel redteam mcp auth    http://localhost:8000          # auth bypass (5 credential scenarios)
+sentinel redteam mcp auth    http://localhost:8000          # credential bypass + OAuth 2.0 attacks
 sentinel redteam mcp inject  http://localhost:8000          # all injection techniques
 sentinel redteam mcp poison  http://localhost:8000          # tool description + result injection
 sentinel redteam mcp fuzz    http://localhost:8000          # schema and type boundary fuzzing
 
+# Preauth — works even when server blocks unauthenticated MCP
+sentinel redteam mcp preauth http://localhost:8000
+sentinel redteam mcp preauth http://locked-server:8000      # CORS, OAuth metadata, version disclosure
+
 # Surgical injection — pick your techniques
 sentinel redteam mcp inject http://localhost:8000 --type traverse
 sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
@@ -391,15 +399,31 @@ sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
 sentinel redteam mcp full http://localhost:8000 --output report.json
 ```
 
-**Phases:**
-
-| Phase | Command | What it tests |
-|-------|---------|---------------|
-| 1 — Recon | `recon` | Tool inventory, resource listing, dangerous capability flags |
-| 2 — Auth Bypass | `auth` | 5 credential scenarios: no creds, empty bearer, garbage token, invalid JWT, JWT alg:none |
-| 3 — Injection | `inject` | Path traversal, SSRF, command injection, SQL injection — payload fired, pattern matched in response |
-| 4 — Poison | `poison` | Static: adversarial instructions in tool descriptions. Dynamic: LLM instruction injection via tool parameters |
-| 5 — Fuzz | `fuzz` | Stack traces, internal path disclosure, template injection eval, type confusion |
+**Phases (`full` runs all 7):**
+
+| Phase | Command | Needs credentials | What it tests |
+|-------|---------|:-----------------:|---------------|
+| 1 — Pre-auth | `preauth` | No | CORS, OAuth metadata, version disclosure, unauthenticated paths, SSE stream, error disclosure |
+| 2 — OAuth | *(auto in `auth`/`full`)* | No | Public client registration, token without secret, PKCE downgrade, scope escalation, X-Agent-Scopes forgery |
+| 3 — Recon | `recon` | Yes | Tool inventory, resource listing, dangerous capability flags with input schemas |
+| 4 — Auth Bypass | `auth` | Optional | 5 credential scenarios: no creds, empty bearer, garbage token, invalid JWT, JWT alg:none |
+| 5 — Injection | `inject` | Yes | Path traversal, SSRF, command injection, SQL injection — evidence-confirmed only |
+| 6 — Poison | `poison` | Yes | Adversarial instructions in tool descriptions; LLM injection via tool parameters |
+| 7 — Fuzz | `fuzz` | Yes | Stack traces, path disclosure, template injection eval, type confusion, input reflection |
+
+**Pre-auth probes (zero credentials):**
+
+| Probe | CRITICAL | HIGH | MEDIUM |
+|-------|----------|------|--------|
+| CORS wildcard + credentials | ✓ | | |
+| CORS wildcard / reflected origin | | ✓ | |
+| Unauthenticated SSE stream | | ✓ | |
+| Public OAuth client registration | | ✓ | |
+| Token issued without `client_secret` | ✓ | | |
+| X-Agent-Scopes header forgery | ✓ | | |
+| PKCE `plain` method accepted | | | ✓ |
+| Server/framework version disclosure | | | ✓ |
+| Unauthenticated `/docs`, `/metrics` | | | ✓ |
 
 **Injection techniques (`--type`):**
 
@@ -423,13 +447,13 @@ sentinel redteam mcp full http://localhost:8000 --output report.json
 
 | Severity | Example |
 |----------|---------|
-| CRITICAL | Path traversal confirmed — `/etc/passwd` content in response |
-| HIGH | LLM instruction injection — sentinel reflected in clean tool result |
-| MEDIUM | Input reflected in error message (injection vector, lower confidence) |
+| CRITICAL | Path traversal confirmed — `/etc/passwd` content in response; OAuth token issued without secret |
+| HIGH | LLM instruction injection — sentinel reflected in clean tool result; CORS wildcard |
+| MEDIUM | Input reflected in error message; PKCE plain method accepted; version disclosure |
 | LOW | Unexpected content returned on malformed input |
-| INFO | Auth enforced on handshake, tool inventory |
+| INFO | Auth enforced on handshake, tool inventory, OAuth metadata discovered |
 
-Every finding includes a **MITRE ATLAS** ID and **OWASP ASI** ID. Use `--verbose` to see full request/response bodies.
+Every finding includes a **Fix** line, a **MITRE ATLAS** ID, and an **OWASP ASI** ID. Confirmed multi-step attack chains are synthesized in the report. Use `--verbose` to see full request/response bodies.
 
 ---
 
@@ -462,10 +486,10 @@ Supported on: `sentinel scan`, `sentinel a2a`, `sentinel mcp scan`, `sentinel su
 |------------|-----|------------------|
 | Agent Goal Hijack | ASI01 | `sentinel scan` (PROMPT_INJECTION_VECTOR), `sentinel supply-chain` (SC01), **`sentinel redteam mcp poison`** (confirmed injection) |
 | Tool Misuse & Exploitation | ASI02 | `sentinel mcp scan`, `sentinel scan`, **`sentinel redteam mcp inject`** (confirmed exploitation) |
-| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED), **`sentinel redteam mcp auth`** (bypass confirmation) |
+| Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED), **`sentinel redteam mcp auth`** (credential bypass + OAuth scope escalation + X-Agent-Scopes forgery) |
 | **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI semantic analysis), **`sentinel redteam mcp poison`** (static description scan) |
 | Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` (CODE_EXECUTION_TOOL), **`sentinel redteam mcp inject --type cmd`** |
-| **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage), `sentinel host-scan` (HOST_LARGE_MEMORY) |
+| **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage), `sentinel host-scan` (HOST_LARGE_MEMORY), **`sentinel redteam mcp preauth`** (CORS misconfiguration enabling cross-origin data theft) |
 | **Insecure Inter-Agent Communication** | **ASI07** | **`sentinel a2a`** (call graph + trust rules) |
 | Cascading Agent Failures | ASI08 | `sentinel discover` (surface unmonitored agents) |
 | Rogue Agents | ASI10 | `sentinel discover` (find agents that shouldn't exist), `sentinel host-scan` (HOST_AI_PROCESS_EXPOSED) |
@@ -506,6 +530,9 @@ jobs:
       - name: Host AI security posture
         run: sentinel host-scan --fail-on HIGH
 
+      - name: MCP pre-auth probe (zero credentials needed)
+        run: sentinel redteam mcp preauth http://localhost:8000 --fail-on HIGH
+
       - name: MCP red-team (active exploitation check)
         run: sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
 ```

{agentsentinel_cli-0.9.6 → agentsentinel_cli-0.9.7}/agentsentinel_cli/cli.py

@@ -1166,20 +1166,25 @@ def redteam_mcp_recon(
 @click.option("--output", "output_path", default=None, metavar="FILE")
 @click.option("--verbose", "-v", is_flag=True, default=False)
 @click.option("--fail-on", type=click.Choice(["CRITICAL", "HIGH", "MEDIUM", "LOW"]), default=None)
+@click.option("--skip-oauth", "skip_oauth", is_flag=True, default=False,
+              help="Skip OAuth tests against external authorization servers (use when AS is out of scope).")
 def redteam_mcp_preauth(
     target: str | None, timeout: float, fmt: str,
     output_path: str | None, verbose: bool, fail_on: str | None,
+    skip_oauth: bool,
 ) -> None:
     """HTTP-layer fingerprinting — runs with zero credentials.
 
     Probes the server before any MCP initialize attempt: CORS config,
     OAuth metadata, version disclosure, unauthenticated paths, SSE stream.
+    Follows the MCP 2025 OAuth discovery chain to find external auth servers.
     Produces findings even when the server blocks unauthenticated MCP access.
 
     \b
     Examples:
         sentinel redteam mcp preauth http://localhost:3000
         sentinel redteam mcp preauth http://localhost:3000 --verbose
+        sentinel redteam mcp preauth http://localhost:3000 --skip-oauth
     """
     import time
     from agentsentinel_cli.redteam.mcp_preauth import run_preauth
@@ -1198,6 +1203,7 @@ def redteam_mcp_preauth(
     preauth_findings, preauth_count = run_preauth(url=target, timeout=timeout, verbose=verbose)
     oauth_findings, oauth_count = run_oauth(
         url=target, original_headers={}, timeout=timeout, verbose=verbose,
+        skip_external=skip_oauth,
     )
     all_findings = preauth_findings + oauth_findings
 
@@ -1229,9 +1235,12 @@ def redteam_mcp_preauth(
 @click.option("--output", "output_path", default=None, metavar="FILE")
 @click.option("--verbose", "-v", is_flag=True, default=False)
 @click.option("--fail-on", type=click.Choice(["CRITICAL", "HIGH", "MEDIUM", "LOW"]), default=None)
+@click.option("--skip-oauth", "skip_oauth", is_flag=True, default=False,
+              help="Skip OAuth tests against external authorization servers.")
 def redteam_mcp_auth(
     target: str | None, stdio_cmd: str | None, auth_header: str | None,
     timeout: float, fmt: str, output_path: str | None, verbose: bool, fail_on: str | None,
+    skip_oauth: bool,
 ) -> None:
     """Test authentication bypass — calls every tool with invalid credentials.
 
@@ -1281,6 +1290,7 @@ def redteam_mcp_auth(
         from agentsentinel_cli.redteam.mcp_oauth import run_oauth
         oauth_findings, oauth_count = run_oauth(
             url=target, original_headers=headers, timeout=timeout, verbose=verbose,
+            skip_external=skip_oauth,
         )
         findings = findings + oauth_findings
         scenarios_tested += oauth_count
@@ -1557,10 +1567,13 @@ def redteam_mcp_fuzz(
               help="Save complete JSON evidence bundle.")
 @click.option("--verbose", "-v", is_flag=True, default=False)
 @click.option("--fail-on", type=click.Choice(["CRITICAL", "HIGH", "MEDIUM", "LOW"]), default=None)
+@click.option("--skip-oauth", "skip_oauth", is_flag=True, default=False,
+              help="Skip OAuth tests against external authorization servers.")
 def redteam_mcp_full(
     target: str | None, stdio_cmd: str | None, auth_header: str | None,
     intensity: str, include_dangerous: bool,
     timeout: float, fmt: str, output_path: str | None, verbose: bool, fail_on: str | None,
+    skip_oauth: bool,
 ) -> None:
     """Run all red-team modules in sequence — full engagement.
 
@@ -1610,6 +1623,7 @@ def redteam_mcp_full(
 
         oauth_findings, oauth_count = run_oauth(
             url=target, original_headers=headers, timeout=timeout, verbose=verbose,
+            skip_external=skip_oauth,
         )
         all_findings.extend(oauth_findings)
         total_attacks += oauth_count
@@ -1673,14 +1687,16 @@ def redteam_mcp_full(
                 total_attacks += fuzz_count
 
     except McpAuthRequired as exc:
-        console.print(f"\n[bold yellow]Auth required[/bold yellow] (HTTP {exc.status_code})")
-        console.print("  Preauth + OAuth findings above are still valid without a token.")
-        console.print("  Use: [bold]--auth-header 'Authorization: Bearer <token>'[/bold]")
+        if fmt == "text":
+            console.print(f"\n[bold yellow]Auth required[/bold yellow] (HTTP {exc.status_code})")
+            console.print("  Preauth + OAuth findings above are still valid without a token.")
+            console.print("  Use: [bold]--auth-header 'Authorization: Bearer <token>'[/bold]")
         if not all_findings:
             sys.exit(1)
         # Fall through — report whatever preauth/oauth found
     except McpError as exc:
-        console.print(f"\n[red]Connection failed:[/red] {exc}")
+        if fmt == "text":
+            console.print(f"\n[red]Connection failed:[/red] {exc}")
         if not all_findings:
             sys.exit(1)
 

{agentsentinel_cli-0.9.6 → agentsentinel_cli-0.9.7}/agentsentinel_cli/redteam/mcp_oauth.py

@@ -32,6 +32,7 @@ def run_oauth(
     original_headers: dict[str, str],
     timeout: float,
     verbose: bool,
+    skip_external: bool = False,
 ) -> tuple[list[RedTeamFinding], int]:
     """
     Run OAuth 2.0 attack surface tests.
@@ -45,16 +46,59 @@ def run_oauth(
     findings: list[RedTeamFinding] = []
     probes = 0
     parsed = urllib.parse.urlparse(url.rstrip("/"))
-    origin = f"{parsed.scheme}://{parsed.netloc}"
+    mcp_origin = f"{parsed.scheme}://{parsed.netloc}"
 
     with httpx.Client(timeout=timeout, follow_redirects=True) as client:
-        meta = _discover_metadata(client, origin)
+        meta, as_origin, is_external = _discover_metadata(client, mcp_origin)
 
         if meta is None:
-            # No OAuth server found — nothing to test
-            return findings, probes + 3  # count the 3 discovery probes
-
-        probes += 3  # metadata probes
+            return findings, probes + 3  # count the discovery probes
+
+        probes += 3
+
+        # Report external AS — always emit the INFO, then optionally skip tests
+        if is_external:
+            findings.append(RedTeamFinding(
+                attack_type="oauth",
+                severity="INFO",
+                title=f"External OAuth AS discovered — {as_origin}",
+                tool_name="<auth-server>",
+                parameter=None,
+                payload=f"GET {mcp_origin}/.well-known/oauth-protected-resource",
+                evidence=(
+                    f"MCP server ({mcp_origin}) delegates authentication to:\n"
+                    f"  Authorization server: {as_origin}\n"
+                    f"  token_endpoint: {meta.get('token_endpoint', 'unknown')}"
+                ),
+                exploit_scenario=(
+                    "The MCP server follows the MCP 2025 spec and delegates OAuth to a "
+                    f"separate authorization server at {as_origin}. "
+                    "All OAuth attack tests below target that AS directly. "
+                    "Use --skip-oauth if this AS is out of scope for your engagement."
+                ),
+                mitre_id="T1078.004",
+                owasp_id="ASI06",
+                confidence="HIGH",
+            ))
+
+            if skip_external:
+                findings.append(RedTeamFinding(
+                    attack_type="oauth",
+                    severity="INFO",
+                    title=f"OAuth tests skipped — external AS out of scope (--skip-oauth)",
+                    tool_name="<auth-server>",
+                    parameter=None,
+                    payload="",
+                    evidence=f"Authorization server at {as_origin} not tested per --skip-oauth.",
+                    exploit_scenario=(
+                        "OAuth attack tests were suppressed because --skip-oauth was set. "
+                        "Re-run without --skip-oauth if you have authorization to test the AS."
+                    ),
+                    mitre_id=None,
+                    owasp_id=None,
+                    confidence="HIGH",
+                ))
+                return findings, probes
 
         # Tests that don't need a valid token
         probes += _test_public_registration(client, meta, findings, verbose)
@@ -71,16 +115,49 @@ def run_oauth(
     return findings, probes
 
 
-def _discover_metadata(client, origin: str) -> dict | None:
-    """Discover OAuth metadata from well-known endpoints."""
-    paths = [
+def _discover_metadata(
+    client,
+    mcp_origin: str,
+) -> tuple[dict | None, str, bool]:
+    """
+    Follow the MCP 2025 OAuth discovery chain.
+
+    Returns (metadata, as_origin, is_external):
+      metadata    — OAuth AS metadata dict, or None if no AS found
+      as_origin   — base URL where the AS lives (may differ from MCP server)
+      is_external — True when the AS is hosted on a different origin
+    """
+    # Step 1: MCP 2025 spec — oauth-protected-resource on the MCP server
+    # advertises which authorization server to use
+    try:
+        resp = client.get(f"{mcp_origin}/.well-known/oauth-protected-resource")
+        if resp.status_code == 200:
+            protected = resp.json()
+            auth_servers = protected.get("authorization_servers", [])
+            if auth_servers:
+                as_base = auth_servers[0].rstrip("/")
+                as_meta = _fetch_as_metadata(client, as_base)
+                if as_meta:
+                    return as_meta, as_base, _is_different_origin(mcp_origin, as_base)
+    except Exception:
+        pass
+
+    # Step 2: Co-located AS — check AS metadata directly on MCP server origin
+    as_meta = _fetch_as_metadata(client, mcp_origin)
+    if as_meta:
+        return as_meta, mcp_origin, False
+
+    return None, mcp_origin, False
+
+
+def _fetch_as_metadata(client, base_url: str) -> dict | None:
+    """Try standard OAuth AS discovery paths on a given base URL."""
+    for path in [
         "/.well-known/oauth-authorization-server",
         "/.well-known/openid-configuration",
-        "/.well-known/oauth-protected-resource",
-    ]
-    for path in paths:
+    ]:
         try:
-            resp = client.get(f"{origin}{path}")
+            resp = client.get(f"{base_url}{path}")
             if resp.status_code == 200:
                 return resp.json()
         except Exception:
@@ -88,6 +165,13 @@ def _discover_metadata(client, origin: str) -> dict | None:
     return None
 
 
+def _is_different_origin(url1: str, url2: str) -> bool:
+    """Return True when url1 and url2 have different scheme+host+port."""
+    p1 = urllib.parse.urlparse(url1)
+    p2 = urllib.parse.urlparse(url2)
+    return p1.netloc != p2.netloc
+
+
 def _test_public_registration(
     client,
     meta: dict,

{agentsentinel_cli-0.9.6 → agentsentinel_cli-0.9.7}/agentsentinel_cli/redteam/mcp_preauth.py

@@ -291,6 +291,10 @@ def _probe_oauth_metadata(
     parsed = urllib.parse.urlparse(base)
     origin = f"{parsed.scheme}://{parsed.netloc}"
 
+    # Track registration endpoints already reported to avoid duplicate findings
+    # when both oauth-authorization-server and openid-configuration expose the same URL
+    seen_reg_endpoints: set[str] = set()
+
     for path in _OAUTH_META_PATHS:
         probes += 1
         try:
@@ -306,7 +310,68 @@ def _probe_oauth_metadata(
         except Exception:
             continue
 
-        # Interesting fields
+        # ── oauth-protected-resource (MCP 2025 spec) ──────────────────────────
+        # This document is on the MCP *resource* server and points to the real AS.
+        if path == "/.well-known/oauth-protected-resource":
+            auth_servers = meta.get("authorization_servers", [])
+            resource_fields: list[str] = []
+            for key in ("resource", "scopes_provided", "bearer_methods_supported"):
+                if key in meta:
+                    resource_fields.append(f"{key}: {meta[key]}")
+
+            if auth_servers:
+                as_url = auth_servers[0]
+                is_ext = _netloc(origin) != _netloc(as_url)
+                placement = "external" if is_ext else "co-located"
+                findings.append(RedTeamFinding(
+                    attack_type="preauth",
+                    severity="INFO",
+                    title=(
+                        f"MCP 2025 OAuth discovery: AS at {as_url} ({placement})"
+                    ),
+                    tool_name="<server>",
+                    parameter=None,
+                    payload=f"GET {path}",
+                    evidence=(
+                        f"authorization_servers: {auth_servers}\n"
+                        + "\n".join(resource_fields[:3])
+                    ),
+                    exploit_scenario=(
+                        f"The MCP server advertises its authorization server at {as_url}. "
+                        + (
+                            "The AS is hosted on a separate origin — OAuth attack tests "
+                            "should target that AS directly. "
+                            "Use `sentinel redteam mcp auth <mcp-url>` to follow the chain "
+                            "and test the external AS."
+                            if is_ext else
+                            "The AS is co-located on the same host — OAuth tests against "
+                            "this origin will reach the authorization server."
+                        )
+                    ),
+                    mitre_id="T1590",
+                    owasp_id=None,
+                    confidence="HIGH",
+                ))
+            else:
+                findings.append(RedTeamFinding(
+                    attack_type="preauth",
+                    severity="INFO",
+                    title=f"MCP protected-resource metadata discovered — {path}",
+                    tool_name="<server>",
+                    parameter=None,
+                    payload=f"GET {path}",
+                    evidence="\n".join(resource_fields[:6]),
+                    exploit_scenario=(
+                        "The MCP server exposes its OAuth protected-resource document. "
+                        "This identifies the authorization server and permitted scopes."
+                    ),
+                    mitre_id="T1590",
+                    owasp_id=None,
+                    confidence="HIGH",
+                ))
+            continue  # rest of the loop handles AS metadata paths
+
+        # ── oauth-authorization-server / openid-configuration ─────────────────
         endpoints: list[str] = []
         for key in ("authorization_endpoint", "token_endpoint", "registration_endpoint",
                     "introspection_endpoint", "revocation_endpoint"):
@@ -318,8 +383,10 @@ def _probe_oauth_metadata(
 
         has_registration = "registration_endpoint" in meta
         has_implicit = "implicit" in grant_types or "token" in grant_types
+        reg_url = meta.get("registration_endpoint", "")
 
-        if has_registration:
+        if has_registration and reg_url not in seen_reg_endpoints:
+            seen_reg_endpoints.add(reg_url)
             findings.append(RedTeamFinding(
                 attack_type="preauth",
                 severity="HIGH",
@@ -328,7 +395,7 @@ def _probe_oauth_metadata(
                 parameter=None,
                 payload=f"GET {path}",
                 evidence=(
-                    f"registration_endpoint: {meta['registration_endpoint']}\n"
+                    f"registration_endpoint: {reg_url}\n"
                     + "\n".join(endpoints[:5])
                 ),
                 exploit_scenario=(
@@ -346,6 +413,8 @@ def _probe_oauth_metadata(
                     "Disable public registration unless explicitly required."
                 ),
             ))
+        elif has_registration and reg_url in seen_reg_endpoints:
+            pass  # same registration_endpoint already reported via another path
         elif has_implicit:
             findings.append(RedTeamFinding(
                 attack_type="preauth",
@@ -369,7 +438,6 @@ def _probe_oauth_metadata(
                 ),
             ))
         else:
-            # Just an INFO finding for the metadata itself
             findings.append(RedTeamFinding(
                 attack_type="preauth",
                 severity="INFO",
@@ -390,6 +458,11 @@ def _probe_oauth_metadata(
     return probes
 
 
+def _netloc(url: str) -> str:
+    """Extract scheme+netloc from a URL for origin comparison."""
+    return urllib.parse.urlparse(url).netloc
+
+
 def _probe_info_paths(
     client,
     base: str,

{agentsentinel_cli-0.9.6 → agentsentinel_cli-0.9.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentsentinel-cli"
-version = "0.9.6"
+version = "0.9.7"
 description = "AI agent and MCP server security scanner — discovery, static analysis, supply chain audit, and multi-agent trust analysis"
 readme = "README.md"
 requires-python = ">=3.10"