agentsentinel-cli 0.9.7__tar.gz → 0.9.8__tar.gz

agentsentinel_cli-0.9.8/.claude/settings.local.json

@@ -0,0 +1,13 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(python3 -c ' *)",
+      "Bash(pip3 show *)",
+      "Bash(pip show *)",
+      "Bash(python3 -m pip show httpx)",
+      "Bash(sentinel --version)",
+      "Bash(python -m agentsentinel_cli --version)",
+      "Bash(pkill -f \"mcp_server.py --port 8765\")"
+    ]
+  }
+}

{agentsentinel_cli-0.9.7 → agentsentinel_cli-0.9.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsentinel-cli
-Version: 0.9.7
+Version: 0.9.8
 Summary: AI agent and MCP server security scanner — discovery, static analysis, supply chain audit, and multi-agent trust analysis
 Project-URL: Homepage, https://github.com/jaydenaung/agentsentinel-cli
 Project-URL: Repository, https://github.com/jaydenaung/agentsentinel-cli
@@ -41,59 +41,51 @@ Description-Content-Type: text/markdown
 **The nmap of AI agents and MCP servers. Deterministic. Protocol-based. No API key required.**
 
 ```bash
-pipx install agentsentinel-cli
+pipx install "agentsentinel-cli[all]"
 ```
 
 ---
 
 ## What it does
 
-`sentinel` discovers and audits AI agents and MCP servers. Every result is deterministic — same input, same output, every time. No cloud dependency, no API key required for any scan.
+`sentinel` actively attacks and audits AI agents and MCP servers. Every result is evidence-confirmed — if a traversal finding says it read `/etc/passwd`, it read `/etc/passwd`. No heuristics, no cloud dependency, no API key required for any scan.
 
-| Command | What it answers |
-|---------|----------------|
-| `sentinel discover` | What MCP servers are running on this host or network? |
-| `sentinel mcp scan` | How secure is this specific MCP server? |
-| `sentinel supply-chain` | Has this MCP tool manifest been tampered with? |
-| `sentinel scan` | What security risks are in this agent's source code? |
-| `sentinel secrets` | Are credentials or PII exposed in these files? |
-| `sentinel inspect` | What framework, model, and role is this agent? |
-| `sentinel a2a` | Are multi-agent trust boundaries safe? |
-| `sentinel host-scan` | What is my local AI security posture across all AI tools? |
-| `sentinel redteam mcp` | Can I actively exploit this MCP server? |
+| Command | What it does |
+|---------|-------------|
+| `sentinel redteam mcp` | Actively exploit an MCP server — confirmed traversal, auth bypass, OAuth attacks, injection |
+| `sentinel host-scan` | Audit your machine's full AI security posture across Claude, Cursor, Windsurf, VS Code, and more |
+| `sentinel a2a` | Build a call graph of your multi-agent system and audit trust boundaries |
+| `sentinel discover` | Find every MCP server on a host or subnet — confirmed via protocol handshake |
+| `sentinel mcp scan` | Deep security audit of a running MCP server |
+| `sentinel supply-chain` | Detect tool manifest tampering, description injection, and schema drift |
+| `sentinel scan` | AST-level static analysis of agent source code |
+| `sentinel secrets` | Find exposed credentials and PII in agent files and AI memory stores |
+| `sentinel inspect` | Fingerprint an agent file or live endpoint |
 
 ---
 
 ## Quick start
 
 ```bash
-# Discover MCP servers — local and across a network
-sentinel discover
-sentinel discover --host 10.0.1.45
-sentinel discover --subnet 10.0.0.0/24
-sentinel discover --subnet 10.0.0.0/24 --scan   # discover + deep audit in one pass
+# Active red-team — real confirmed exploitation
+sentinel redteam mcp full http://localhost:8000
+sentinel redteam mcp full http://localhost:8000 --auth-header "Authorization: Bearer token"
+sentinel redteam mcp preauth http://localhost:8000   # zero credentials — follows MCP 2025 OAuth chain
 
-# Audit a specific MCP server
-sentinel mcp scan http://localhost:8000/sse --auth-header "Authorization: Bearer token"
-sentinel supply-chain http://localhost:8000/sse
+# Local AI security posture — audits Claude, Cursor, Windsurf, VS Code, and more
+sentinel host-scan
+sentinel host-scan --fail-on HIGH
 
-# Scan agent source code
-sentinel scan ./agents/
+# Multi-agent trust analysis
 sentinel a2a ./agents/
 
-# Secrets and credentials
-sentinel secrets .
-sentinel secrets ~/.claude/projects/   # scan Claude Code memory
-
-# Local AI security posture — no network calls
-sentinel host-scan
-sentinel host-scan --fail-on HIGH
+# Discover and audit MCP servers on a network
+sentinel discover --subnet 10.0.0.0/24 --scan
 
-# Active red-team — real attacks, confirmed exploitation
-sentinel redteam mcp full http://localhost:8000
-sentinel redteam mcp preauth http://localhost:8000        # works with zero credentials
-sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
-sentinel redteam mcp auth http://localhost:8000           # credential bypass + OAuth 2.0
+# Static and source-level audits
+sentinel mcp scan http://localhost:8000/sse --auth-header "Authorization: Bearer token"
+sentinel scan ./agents/
+sentinel secrets ~/.claude/projects/
 ```
 
 ---
@@ -101,25 +93,232 @@ sentinel redteam mcp auth http://localhost:8000           # credential bypass +
 ## Install
 
 ```bash
-# Zero dependencies — sentinel scan and sentinel a2a
+# Everything (recommended)
+pipx install "agentsentinel-cli[all]"
+
+# Zero dependencies — sentinel scan, a2a, secrets, inspect
 pip install agentsentinel-cli
 
-# + sentinel discover (psutil for process scanning)
+# + network tools (discover, mcp scan, supply-chain, redteam)
+pip install "agentsentinel-cli[mcp]"
+
+# + process scanning (discover --local)
 pip install "agentsentinel-cli[discover]"
+```
 
-# + sentinel mcp scan, supply-chain, inspect (httpx)
-pip install "agentsentinel-cli[mcp]"
+---
 
-# Everything
-pip install "agentsentinel-cli[all]"
+## Commands
 
-# Recommended — isolated install
-pipx install "agentsentinel-cli[all]"
+### `sentinel redteam mcp` — active MCP server exploitation
+
+The active red-team module. Every finding is backed by confirmed evidence from the server's actual response — a traversal finding includes the file content, a token finding includes the actual token. If nothing is confirmed, nothing is reported.
+
+**Phases 1–2 (`preauth` + OAuth) run with zero credentials** — useful when the target blocks unauthenticated MCP access entirely. `sentinel` follows the full MCP 2025 OAuth discovery chain to find and test the real authorization server, even when it lives on a separate host (Auth0, Okta, Azure AD, Keycloak).
+
+Requires `httpx`: `pip install "agentsentinel-cli[mcp]"`
+
+```bash
+# Full run — all 7 phases, unified report
+sentinel redteam mcp full http://localhost:8000
+sentinel redteam mcp full http://localhost:8000 --auth-header "Authorization: Bearer token"
+sentinel redteam mcp full http://localhost:8000 --intensity high --format json
+
+# Zero-credential pre-auth probe — follows MCP 2025 OAuth discovery chain
+sentinel redteam mcp preauth http://localhost:8000
+sentinel redteam mcp preauth http://localhost:8000 --skip-oauth   # skip external AS if out of scope
+
+# Targeted phases
+sentinel redteam mcp recon   http://localhost:8000   # enumerate attack surface
+sentinel redteam mcp auth    http://localhost:8000   # credential bypass + OAuth 2.0 attacks
+sentinel redteam mcp inject  http://localhost:8000   # path traversal, SSRF, cmd, SQLi, LLM injection
+sentinel redteam mcp poison  http://localhost:8000   # tool description and result injection
+sentinel redteam mcp fuzz    http://localhost:8000   # schema and type boundary fuzzing
+
+# Surgical injection — pick techniques, raise intensity
+sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
+sentinel redteam mcp inject http://localhost:8000 --type cmd --type sqli --intensity high
+
+# stdio transport (local MCP servers)
+sentinel redteam mcp full --stdio "python my_mcp_server.py"
+
+# CI gate — fail if any CRITICAL confirmed
+sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
+
+# Save full evidence bundle
+sentinel redteam mcp full http://localhost:8000 --output report.json
+```
+
+#### Phases (`full` runs all 7)
+
+| Phase | Command | Needs credentials | What it tests |
+|-------|---------|:-----------------:|---------------|
+| 1 — Pre-auth probe | `preauth` | No | CORS policy, version disclosure, unauthenticated paths, SSE stream, error disclosure |
+| 2 — OAuth attack surface | *(auto in `preauth` / `auth` / `full`)* | No | MCP 2025 discovery chain, client registration, token acquisition, PKCE, scope attacks |
+| 3 — Recon | `recon` | Yes | Full tool inventory with input schemas; dangerous capability detection |
+| 4 — Auth bypass | `auth` | Optional | 5 credential scenarios: no creds, empty bearer, garbage token, expired JWT, JWT alg:none |
+| 5 — Injection | `inject` | Yes | Path traversal, SSRF, command injection, SQL injection — evidence-confirmed only |
+| 6 — Poison | `poison` | Yes | Adversarial instructions in tool descriptions; LLM injection via tool result parameters |
+| 7 — Fuzz | `fuzz` | Yes | Stack traces, path disclosure, template injection eval, type confusion, input reflection |
+
+#### OAuth 2.0 attack surface — how the discovery chain works
+
+The MCP 2025 spec mandates OAuth 2.0. An MCP server is an OAuth **resource server** — it validates tokens but doesn't issue them. The **authorization server** (the service that issues tokens) is often a separate host: Auth0, Okta, Keycloak, AWS Cognito, Azure AD.
+
+`sentinel` follows the full RFC 9728 discovery chain automatically:
+
+```
+1. GET /.well-known/oauth-protected-resource   (on the MCP server)
+        ↓  authorization_servers: ["https://auth.company.com"]
+2. GET https://auth.company.com/.well-known/oauth-authorization-server
+        ↓  token_endpoint, registration_endpoint, authorization_endpoint
+3. Run all OAuth attack tests against the real AS endpoints
 ```
 
+**Co-located AS** (dev/test): MCP server and AS on the same host. Tests run automatically; the INFO finding says `(co-located)`.
+
+**Separate AS** (production): MCP at `api.company.com`, AS at `auth.company.com`. `sentinel` follows the pointer, emits an INFO finding naming the external AS, then runs all OAuth tests against the real AS. Use `--skip-oauth` if the external AS is a third-party service outside your engagement scope.
+
+**OAuth tests:**
+
+| Test | Severity | What `sentinel` does | Attacker impact if confirmed |
+|------|----------|---------------------|------------------------------|
+| Public client registration | CRITICAL | `POST /registration_endpoint` with no auth | Attacker registers an OAuth client, obtains a valid `client_id`, and can initiate auth flows |
+| Token without `client_secret` | CRITICAL | `POST /token` with only a `client_id` | Any attacker who knows a `client_id` gets a valid access token — no secret required |
+| Token with empty `client_secret` | CRITICAL | Same as above but `client_secret=""` | Empty string accepted — credential check bypassed entirely |
+| PKCE plain method | MEDIUM | `GET /authorize?code_challenge_method=plain` | Code verifier transmitted in cleartext; interceptable via logs or proxies. MCP 2025 requires S256. |
+| Scope escalation | HIGH | Refresh token requesting all supported scopes | Low-privilege token upgrades to higher-privilege scopes — breaks least-privilege enforcement |
+| X-Agent-Scopes forgery | CRITICAL | Authenticated call with forged `X-Agent-Scopes` header | Authenticated agent invokes tools outside its granted scope |
+
+#### Pre-auth probes
+
+All Phase 1 probes run over plain HTTP before any MCP handshake. No credentials required.
+
+| Probe | Sev | What it checks | Why it matters |
+|-------|-----|----------------|----------------|
+| CORS wildcard + credentials | CRITICAL | `Access-Control-Allow-Origin: *` with `Allow-Credentials: true` | Any website can make credentialed requests to MCP endpoints from the victim's browser |
+| CORS wildcard | HIGH | `Access-Control-Allow-Origin: *` | Any website can read MCP tool responses — cross-origin exfiltration |
+| CORS reflected origin | HIGH | Server echoes back the request `Origin` header | Equivalent to wildcard CORS — attacker sets any origin and browser permits the read |
+| Unauthenticated SSE stream | HIGH | `GET /sse` streams without a token | Attacker receives a live feed of all MCP events: tool results, agent responses, notifications |
+| Public client registration | HIGH | `registration_endpoint` reachable unauthenticated | Attacker registers OAuth client without any authorization |
+| Stack trace in error response | HIGH | Malformed request triggers full stack trace | Internal paths, library versions, and code structure exposed to unauthenticated callers |
+| Unauthenticated `/debug` or `/admin` | HIGH | Admin/debug endpoint returns 200 | Admin endpoints frequently expose sensitive operations or config dumps |
+| Server / framework version | MEDIUM | `Server:` header, `X-Powered-By:`, version in error body | Attacker maps exact versions to CVEs without authentication |
+| Unauthenticated `/docs` / `/openapi.json` | MEDIUM | API schema readable without credentials | Every endpoint, parameter, and schema exposed — full attack surface in one request |
+| Unauthenticated `/metrics` | MEDIUM | Prometheus metrics accessible | Runtime internals reveal traffic patterns and anomaly detection thresholds |
+| Implicit grant supported | MEDIUM | `implicit` or `token` in `grant_types_supported` | Access tokens in URL fragments — capturable via browser history or injected scripts |
+| Framework version in error body | MEDIUM | Error body contains a version string | Same CVE-mapping risk as the `Server` header |
+| Security headers missing | LOW | Absent `X-Content-Type-Options`, `Content-Security-Policy`, `X-Frame-Options` | Missing defensive headers expand MIME sniffing, clickjacking, and content injection surface |
+
+#### Injection techniques (`--type`)
+
+| Technique | What it confirms |
+|-----------|-----------------|
+| `traverse` | Arbitrary file read — evidence: actual `/etc/passwd` content or `.env` key values |
+| `ssrf` | Server-side request forgery — evidence: AWS IMDS tokens, Redis/SSH banners, cloud metadata |
+| `cmd` | OS command injection — evidence: `uid=0(root)` from `id`, sentinel value in output |
+| `sqli` | SQL injection — evidence: DB error messages (`ORA-`, `You have an error in your SQL syntax`) |
+| `llm` | LLM instruction injection via tool result — evidence: sentinel instruction echoed in clean response |
+
+#### Intensity levels (`--intensity`)
+
+| Level | Payloads per technique | Use case |
+|-------|----------------------|----------|
+| `low` | 5 | Fast CI gate |
+| `medium` | 15 | Standard engagement (default) |
+| `high` | Full library (~20) | Thorough pentest |
+
 ---
 
-## Commands
+### `sentinel host-scan` — local AI security posture audit
+
+Audits your machine's AI security posture without any network calls. Discovers and audits MCP server configurations across every major AI coding tool on the host — Claude Code, Claude Desktop, Cursor, Windsurf, Continue.dev, Gemini CLI, and VS Code — then checks shell credentials, macOS privacy permissions, system security settings, and running AI processes.
+
+Works on macOS, Linux, and Windows. No API key required.
+
+```bash
+sentinel host-scan
+sentinel host-scan --format json
+sentinel host-scan --fail-on HIGH
+sentinel host-scan --ignore-rule HOST_LARGE_MEMORY
+```
+
+**What it checks:**
+
+*Anthropic tools*
+- **Claude Code** — `allowedTools` (shell bypass), MCP server configs, shell hooks
+- **Claude Desktop** — MCP server configs
+
+*Third-party AI tools* — MCP server configs audited with the same exfiltration, broad-filesystem, sensitive-path, and sprawl rules as Claude tools
+- **Cursor** — `~/.cursor/mcp.json`
+- **Windsurf** — `~/.codeium/windsurf/mcp_config.json`
+- **Continue.dev** — `~/.continue/config.json`
+- **Gemini CLI** — `~/.gemini/settings.json`
+- **VS Code** — `mcp.servers` in `settings.json` (MCP support added in VS Code 1.99)
+
+*Host security*
+- **Shell configs** — hardcoded AI API keys in `.zshrc`, `.bashrc`, `.zprofile`, etc. (macOS/Linux); PowerShell profiles on Windows
+- **macOS TCC permissions** — Full Disk Access, Screen Recording, Accessibility granted to AI apps
+- **macOS system security** — SIP, FileVault, Gatekeeper status
+- **Exposed AI processes** — AI-related processes listening on non-localhost interfaces
+- **Memory footprint** — Claude Code conversation memory size in `~/.claude/projects/`
+
+**Rules:**
+
+| Rule | Severity | Category | What it catches |
+|------|----------|----------|-----------------|
+| `HOST_SHELL_UNRESTRICTED` | CRITICAL | config | `Bash` in `allowedTools` — shell runs without confirmation prompt |
+| `HOST_SIP_DISABLED` | CRITICAL | system | macOS System Integrity Protection is off |
+| `HOST_API_KEY_IN_SHELL` | HIGH | data_exposure | AI API keys hardcoded in shell config files |
+| `HOST_MCP_EXFIL_PATH` | HIGH | config | Any AI tool's MCP server has both filesystem access and network capability |
+| `HOST_FDA_AI_APP` | HIGH | permissions | Full Disk Access granted to an AI app or its terminal |
+| `HOST_SCREEN_RECORDING_AI` | HIGH | permissions | Screen Recording permission granted to an AI app |
+| `HOST_AI_PROCESS_EXPOSED` | HIGH | network | AI-related process listening on a non-localhost interface |
+| `HOST_FILEVAULT_OFF` | HIGH | system | FileVault disk encryption is disabled |
+| `HOST_ACCESSIBILITY_AI` | MEDIUM | permissions | Accessibility permission granted to an AI app |
+| `HOST_HOOKS_SHELL` | MEDIUM | config | Claude Code shell hooks that could interpolate AI output |
+| `HOST_MCP_BROAD_FS` | MEDIUM | config | Any AI tool's MCP server configured with home-dir or root-level path |
+| `HOST_MCP_SENSITIVE_PATH` | MEDIUM | config | Any AI tool's MCP server has access to `~/.ssh`, `~/.aws`, `~/.kube`, or Keychain |
+| `HOST_MANY_MCP_SERVERS` | MEDIUM | config | 8+ MCP servers across all detected AI tools — large prompt injection attack surface |
+| `HOST_GATEKEEPER_OFF` | MEDIUM | system | Gatekeeper disabled — unsigned binaries run without warning |
+| `HOST_LARGE_MEMORY` | LOW | data_exposure | Claude Code memory files exceed 50 MB of accumulated conversation data |
+
+Every finding includes a remediation step. The posture score (0–100) uses CRITICAL −40, HIGH −20, MEDIUM −10, LOW −5.
+
+---
+
+### `sentinel a2a` — multi-agent trust analysis
+
+Builds a call graph from Python agent source and audits trust boundaries. Detects injection propagation across agent boundaries, unbounded spawning, and code-execution agents accepting unverified delegations.
+
+Supports **LangChain / LangGraph**, **AutoGen**, **CrewAI**, and **MCP client → server connections**.
+
+```bash
+sentinel a2a ./agents/
+sentinel a2a multi_agent.py
+sentinel a2a . --fail-on HIGH
+sentinel a2a . --format json
+```
+
+**Detected patterns:**
+- LangGraph `StateGraph.add_node` / `add_edge` / `add_conditional_edges`
+- AutoGen `initiate_chat`, `GroupChat`, `GroupChatManager`
+- CrewAI `Crew(agents=[...], process=Process.hierarchical)`
+- MCP client connections: `sse_client(url)`, `streamablehttp_client(url)` — surfaces agent → MCP server edges with URL resolution from constants
+
+**Rules:**
+
+| Rule | Severity | What it catches |
+|------|----------|-----------------|
+| `A2A03_IMPLICIT_TRUST` | CRITICAL | Code-execution agent accepts calls from other agents with no verification |
+| `A2A04_PROMPT_PASSTHROUGH` | HIGH | User input flows directly across an agent boundary without sanitization |
+| `A2A02_UNBOUNDED_SPAWNING` | HIGH | Agent instantiated inside a loop — unbounded creation risk |
+| `A2A06_CIRCULAR_DELEGATION` | HIGH | Cycle in the call graph — agents can loop indefinitely under injection |
+| `A2A05_UNSCOPED_DELEGATION` | MEDIUM | Orchestrator delegates full tool set instead of a restricted subset |
+
+Covers **ASI07** (Insecure Inter-Agent Communication).
+
+---
 
 ### `sentinel discover` — find MCP servers and agent processes
 
@@ -135,7 +334,6 @@ sentinel discover --host 10.0.1.45 --auth-header "Authorization: Bearer token"
 
 # Subnet sweep
 sentinel discover --subnet 10.0.0.0/24
-sentinel discover --subnet 10.0.0.0/24 --auth-header "Authorization: Bearer token"
 
 # Discover + deep security audit in one pass
 sentinel discover --host 10.0.1.45 --scan
@@ -230,7 +428,7 @@ sentinel scan my_agent.py
 sentinel scan ./agents/
 sentinel scan ./agents/ --fail-on CRITICAL
 sentinel scan ./agents/ --format json
-sentinel scan ./agents/ --ignore-rule DANGEROUS_GRANTS  # suppress accepted finding
+sentinel scan ./agents/ --ignore-rule DANGEROUS_GRANTS
 ```
 
 **Detects tools defined via:**
@@ -269,7 +467,6 @@ sentinel secrets . --format json
 ```
 
 **Detects:**
-
 - Credentials: Anthropic, OpenAI, AWS, GitHub, Stripe, Google, HuggingFace API keys · private keys · database URLs · JWT tokens
 - PII (global): email addresses · credit cards (Luhn-validated) · US SSN · US phone
 - PII (Singapore): NRIC/FIN (mod-11 checksum-validated) · passport · mobile · landline · UEN · postal code
@@ -297,200 +494,6 @@ With `ANTHROPIC_API_KEY` set, generates a plain English security summary.
 
 ---
 
-### `sentinel a2a` — multi-agent trust analysis
-
-Builds a call graph from Python agent source and audits trust boundaries. Detects injection propagation across agent boundaries, unbounded spawning, and code-execution agents accepting unverified delegations.
-
-Supports **LangChain / LangGraph**, **AutoGen**, **CrewAI**, and **MCP client → server connections**.
-
-```bash
-sentinel a2a ./agents/
-sentinel a2a multi_agent.py
-sentinel a2a . --fail-on HIGH
-sentinel a2a . --format json
-```
-
-**Detected patterns:**
-- LangGraph `StateGraph.add_node` / `add_edge` / `add_conditional_edges`
-- AutoGen `initiate_chat`, `GroupChat`, `GroupChatManager`
-- CrewAI `Crew(agents=[...], process=Process.hierarchical)`
-- MCP client connections: `sse_client(url)`, `streamablehttp_client(url)` — surfaces agent → MCP server edges with URL resolution from constants
-
-**Rules:**
-
-| Rule | Severity | What it catches |
-|------|----------|-----------------|
-| `A2A03_IMPLICIT_TRUST` | CRITICAL | Code-execution agent accepts calls from other agents with no verification |
-| `A2A04_PROMPT_PASSTHROUGH` | HIGH | User input flows directly across an agent boundary without sanitization |
-| `A2A02_UNBOUNDED_SPAWNING` | HIGH | Agent instantiated inside a loop — unbounded creation risk |
-| `A2A06_CIRCULAR_DELEGATION` | HIGH | Cycle in the call graph — agents can loop indefinitely under injection |
-| `A2A05_UNSCOPED_DELEGATION` | MEDIUM | Orchestrator delegates full tool set instead of a restricted subset |
-
-Covers **ASI07** (Insecure Inter-Agent Communication).
-
----
-
-### `sentinel host-scan` — local AI security posture audit
-
-Audits your machine's AI security posture without any network calls. Discovers and audits MCP server configurations across every major AI coding tool on the host — Claude Code, Claude Desktop, Cursor, Windsurf, Continue.dev, Gemini CLI, and VS Code — then checks shell credentials, macOS privacy permissions, system security settings, and running AI processes.
-
-Works on macOS, Linux, and Windows. No API key required.
-
-```bash
-sentinel host-scan
-sentinel host-scan --format json
-sentinel host-scan --fail-on HIGH
-sentinel host-scan --ignore-rule HOST_LARGE_MEMORY
-```
-
-**What it checks:**
-
-*Anthropic tools*
-- **Claude Code** — `allowedTools` (shell bypass), MCP server configs, shell hooks
-- **Claude Desktop** — MCP server configs
-
-*Third-party AI tools* — MCP server configs audited with the same exfiltration, broad-filesystem, sensitive-path, and sprawl rules as Claude tools
-- **Cursor** — `~/.cursor/mcp.json`
-- **Windsurf** — `~/.codeium/windsurf/mcp_config.json`
-- **Continue.dev** — `~/.continue/config.json`
-- **Gemini CLI** — `~/.gemini/settings.json`
-- **VS Code** — `mcp.servers` in `settings.json` (MCP support added in VS Code 1.99)
-
-*Host security*
-- **Shell configs** — hardcoded AI API keys in `.zshrc`, `.bashrc`, `.zprofile`, etc.
-- **macOS TCC permissions** — Full Disk Access, Screen Recording, Accessibility granted to AI apps
-- **macOS system security** — SIP, FileVault, Gatekeeper status
-- **Exposed AI processes** — AI-related processes listening on non-localhost network interfaces
-- **Memory footprint** — Claude Code conversation memory size in `~/.claude/projects/`
-
-**Rules:**
-
-| Rule | Severity | Category | What it catches |
-|------|----------|----------|-----------------|
-| `HOST_SHELL_UNRESTRICTED` | CRITICAL | config | `Bash` in `allowedTools` — shell runs without confirmation prompt |
-| `HOST_SIP_DISABLED` | CRITICAL | system | macOS System Integrity Protection is off |
-| `HOST_API_KEY_IN_SHELL` | HIGH | data_exposure | AI API keys hardcoded in shell config files |
-| `HOST_MCP_EXFIL_PATH` | HIGH | config | Any AI tool's MCP server has both filesystem access and network capability |
-| `HOST_FDA_AI_APP` | HIGH | permissions | Full Disk Access granted to an AI app or its terminal |
-| `HOST_SCREEN_RECORDING_AI` | HIGH | permissions | Screen Recording permission granted to an AI app |
-| `HOST_AI_PROCESS_EXPOSED` | HIGH | network | AI-related process listening on a non-localhost interface |
-| `HOST_FILEVAULT_OFF` | HIGH | system | FileVault disk encryption is disabled |
-| `HOST_ACCESSIBILITY_AI` | MEDIUM | permissions | Accessibility permission granted to an AI app |
-| `HOST_HOOKS_SHELL` | MEDIUM | config | Claude Code shell hooks that could interpolate AI output |
-| `HOST_MCP_BROAD_FS` | MEDIUM | config | Any AI tool's MCP server configured with home-dir or root-level path |
-| `HOST_MCP_SENSITIVE_PATH` | MEDIUM | config | Any AI tool's MCP server has access to `~/.ssh`, `~/.aws`, `~/.kube`, or Keychain |
-| `HOST_MANY_MCP_SERVERS` | MEDIUM | config | 8+ MCP servers across all detected AI tools — large prompt injection attack surface |
-| `HOST_GATEKEEPER_OFF` | MEDIUM | system | Gatekeeper disabled — unsigned binaries run without warning |
-| `HOST_LARGE_MEMORY` | LOW | data_exposure | Claude Code memory files exceed 50 MB of accumulated conversation data |
-
-Every finding includes a **remediation** step. The posture score (0–100) uses the same deduction weights as other sentinel commands: CRITICAL −40, HIGH −20, MEDIUM −10, LOW −5.
-
-No API key required. No network calls.
-
----
-
-### `sentinel redteam mcp` — active MCP server exploitation
-
-The active red-team module for MCP servers. Every finding is backed by confirmed evidence from the server's actual response — no heuristics, no noise. If a traversal finding says it read `/etc/passwd`, it read `/etc/passwd`.
-
-**`preauth` and OAuth probing run with zero credentials** — useful when the target server blocks unauthenticated MCP access entirely.
-
-Requires `httpx`: `pip install "agentsentinel-cli[mcp]"`
-
-```bash
-# Full run — all 7 phases, unified report
-sentinel redteam mcp full http://localhost:8000
-sentinel redteam mcp full http://localhost:8000 --intensity high --format json
-
-# Targeted phases
-sentinel redteam mcp preauth http://localhost:8000          # HTTP fingerprint — zero creds required
-sentinel redteam mcp recon   http://localhost:8000          # enumerate attack surface
-sentinel redteam mcp auth    http://localhost:8000          # credential bypass + OAuth 2.0 attacks
-sentinel redteam mcp inject  http://localhost:8000          # all injection techniques
-sentinel redteam mcp poison  http://localhost:8000          # tool description + result injection
-sentinel redteam mcp fuzz    http://localhost:8000          # schema and type boundary fuzzing
-
-# Preauth — works even when server blocks unauthenticated MCP
-sentinel redteam mcp preauth http://localhost:8000
-sentinel redteam mcp preauth http://locked-server:8000      # CORS, OAuth metadata, version disclosure
-
-# Surgical injection — pick your techniques
-sentinel redteam mcp inject http://localhost:8000 --type traverse
-sentinel redteam mcp inject http://localhost:8000 --type traverse --type ssrf
-sentinel redteam mcp inject http://localhost:8000 --type cmd --type sqli --intensity high
-
-# With auth
-sentinel redteam mcp full http://localhost:8000 \
-  --auth-header "Authorization: Bearer token"
-
-# stdio transport (local MCP servers)
-sentinel redteam mcp full --stdio "python my_mcp_server.py"
-
-# CI gate — fail if any CRITICAL confirmed
-sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
-
-# Save report
-sentinel redteam mcp full http://localhost:8000 --output report.json
-```
-
-**Phases (`full` runs all 7):**
-
-| Phase | Command | Needs credentials | What it tests |
-|-------|---------|:-----------------:|---------------|
-| 1 — Pre-auth | `preauth` | No | CORS, OAuth metadata, version disclosure, unauthenticated paths, SSE stream, error disclosure |
-| 2 — OAuth | *(auto in `auth`/`full`)* | No | Public client registration, token without secret, PKCE downgrade, scope escalation, X-Agent-Scopes forgery |
-| 3 — Recon | `recon` | Yes | Tool inventory, resource listing, dangerous capability flags with input schemas |
-| 4 — Auth Bypass | `auth` | Optional | 5 credential scenarios: no creds, empty bearer, garbage token, invalid JWT, JWT alg:none |
-| 5 — Injection | `inject` | Yes | Path traversal, SSRF, command injection, SQL injection — evidence-confirmed only |
-| 6 — Poison | `poison` | Yes | Adversarial instructions in tool descriptions; LLM injection via tool parameters |
-| 7 — Fuzz | `fuzz` | Yes | Stack traces, path disclosure, template injection eval, type confusion, input reflection |
-
-**Pre-auth probes (zero credentials):**
-
-| Probe | CRITICAL | HIGH | MEDIUM |
-|-------|----------|------|--------|
-| CORS wildcard + credentials | ✓ | | |
-| CORS wildcard / reflected origin | | ✓ | |
-| Unauthenticated SSE stream | | ✓ | |
-| Public OAuth client registration | | ✓ | |
-| Token issued without `client_secret` | ✓ | | |
-| X-Agent-Scopes header forgery | ✓ | | |
-| PKCE `plain` method accepted | | | ✓ |
-| Server/framework version disclosure | | | ✓ |
-| Unauthenticated `/docs`, `/metrics` | | | ✓ |
-
-**Injection techniques (`--type`):**
-
-| Technique | What it confirms |
-|-----------|-----------------|
-| `traverse` | Arbitrary file read via path traversal — evidence: `/etc/passwd` content, `.env` keys |
-| `ssrf` | Server-side request forgery — evidence: AWS IMDS tokens, Redis/SSH banners, cloud metadata |
-| `cmd` | OS command injection — evidence: `uid=0(root)` from `id`, `REDTEAM_CMD_CONFIRMED` sentinel |
-| `sqli` | SQL injection — evidence: DB error messages (`ORA-`, `You have an error in your SQL syntax`) |
-| `llm` | LLM instruction injection via tool result — evidence: sentinel string echoed in clean response |
-
-**Intensity levels (`--intensity`):**
-
-| Level | Payloads per technique | Use case |
-|-------|----------------------|----------|
-| `low` | 5 | Fast CI gate |
-| `medium` | 15 | Standard engagement (default) |
-| `high` | Full library (~20) | Thorough pentest |
-
-**Finding severities:**
-
-| Severity | Example |
-|----------|---------|
-| CRITICAL | Path traversal confirmed — `/etc/passwd` content in response; OAuth token issued without secret |
-| HIGH | LLM instruction injection — sentinel reflected in clean tool result; CORS wildcard |
-| MEDIUM | Input reflected in error message; PKCE plain method accepted; version disclosure |
-| LOW | Unexpected content returned on malformed input |
-| INFO | Auth enforced on handshake, tool inventory, OAuth metadata discovered |
-
-Every finding includes a **Fix** line, a **MITRE ATLAS** ID, and an **OWASP ASI** ID. Confirmed multi-step attack chains are synthesized in the report. Use `--verbose` to see full request/response bodies.
-
----
-
 ## Finding suppression
 
 Use `--ignore-rule` to suppress findings by rule ID. Suppressed findings are excluded from `--fail-on` evaluation — they don't break CI gates.
@@ -521,10 +524,10 @@ Supported on: `sentinel scan`, `sentinel a2a`, `sentinel mcp scan`, `sentinel su
 | Agent Goal Hijack | ASI01 | `sentinel scan` (PROMPT_INJECTION_VECTOR), `sentinel supply-chain` (SC01), **`sentinel redteam mcp poison`** (confirmed injection) |
 | Tool Misuse & Exploitation | ASI02 | `sentinel mcp scan`, `sentinel scan`, **`sentinel redteam mcp inject`** (confirmed exploitation) |
 | Agent Identity & Privilege Abuse | ASI03 | `sentinel scan` (PRIVILEGE_EXCESS), `sentinel host-scan` (HOST_SHELL_UNRESTRICTED), **`sentinel redteam mcp auth`** (credential bypass + OAuth scope escalation + X-Agent-Scopes forgery) |
-| **Agentic Supply Chain Compromise** | **ASI04** | **`sentinel supply-chain`** (static + AI semantic analysis), **`sentinel redteam mcp poison`** (static description scan) |
+| Agentic Supply Chain Compromise | ASI04 | **`sentinel supply-chain`** (static + AI semantic analysis), **`sentinel redteam mcp poison`** (static description scan) |
 | Unexpected Code Execution | ASI05 | `sentinel scan` (CODE_EXECUTION_GRANT), `sentinel mcp scan` (CODE_EXECUTION_TOOL), **`sentinel redteam mcp inject --type cmd`** |
-| **Memory & Context Poisoning** | **ASI06** | **`sentinel secrets`** (memory contamination, system prompt leakage), `sentinel host-scan` (HOST_LARGE_MEMORY), **`sentinel redteam mcp preauth`** (CORS misconfiguration enabling cross-origin data theft) |
-| **Insecure Inter-Agent Communication** | **ASI07** | **`sentinel a2a`** (call graph + trust rules) |
+| Memory & Context Poisoning | ASI06 | **`sentinel secrets`** (memory contamination, system prompt leakage), `sentinel host-scan` (HOST_LARGE_MEMORY), **`sentinel redteam mcp preauth`** (CORS misconfiguration) |
+| Insecure Inter-Agent Communication | ASI07 | **`sentinel a2a`** (call graph + trust rules) |
 | Cascading Agent Failures | ASI08 | `sentinel discover` (surface unmonitored agents) |
 | Rogue Agents | ASI10 | `sentinel discover` (find agents that shouldn't exist), `sentinel host-scan` (HOST_AI_PROCESS_EXPOSED) |
 
@@ -546,29 +549,29 @@ jobs:
       - name: Install sentinel
         run: pip install "agentsentinel-cli[mcp]"
 
-      - name: Posture scan
-        run: sentinel scan ./agents/ --fail-on CRITICAL
-
-      - name: Secrets scan
-        run: sentinel secrets . --fail-on HIGH
+      - name: Active red-team (zero credentials)
+        run: sentinel redteam mcp preauth http://localhost:8000 --fail-on HIGH
 
-      - name: MCP supply chain audit
-        run: sentinel supply-chain http://localhost:8000/sse --fail-on CRITICAL
+      - name: Active red-team (full exploitation check)
+        run: sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
 
-      - name: MCP security audit
-        run: sentinel mcp scan http://localhost:8000/sse --fail-on CRITICAL
+      - name: Host AI security posture
+        run: sentinel host-scan --fail-on HIGH
 
       - name: Multi-agent trust analysis
         run: sentinel a2a ./agents/ --fail-on HIGH
 
-      - name: Host AI security posture
-        run: sentinel host-scan --fail-on HIGH
+      - name: MCP security audit
+        run: sentinel mcp scan http://localhost:8000/sse --fail-on CRITICAL
 
-      - name: MCP pre-auth probe (zero credentials needed)
-        run: sentinel redteam mcp preauth http://localhost:8000 --fail-on HIGH
+      - name: MCP supply chain audit
+        run: sentinel supply-chain http://localhost:8000/sse --fail-on CRITICAL
 
-      - name: MCP red-team (active exploitation check)
-        run: sentinel redteam mcp full http://localhost:8000 --fail-on CRITICAL
+      - name: Posture scan
+        run: sentinel scan ./agents/ --fail-on CRITICAL
+
+      - name: Secrets scan
+        run: sentinel secrets . --fail-on HIGH
 ```
 
 Use `.sentinelignore` at the repo root to suppress accepted risks without weakening the gate:
@@ -583,7 +586,7 @@ NO_AUTH    # server is behind an authenticated reverse proxy
 ## Requirements
 
 - Python 3.10+
-- No API key required for: `sentinel discover`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel scan`, `sentinel secrets`, `sentinel inspect --no-ai`, `sentinel a2a`, `sentinel host-scan`, `sentinel redteam mcp`
+- No API key required for: `sentinel redteam mcp`, `sentinel host-scan`, `sentinel a2a`, `sentinel discover`, `sentinel mcp scan`, `sentinel supply-chain`, `sentinel scan`, `sentinel secrets`, `sentinel inspect --no-ai`
 - `ANTHROPIC_API_KEY` required for: `sentinel supply-chain --ai`, `sentinel inspect` (AI summary)
 
 ---