agentwit 0.1.0__tar.gz → 0.3.0__tar.gz

{agentwit-0.1.0 → agentwit-0.3.0}/.claude/settings.local.json

@@ -8,7 +8,10 @@
       "Bash(gh auth:*)",
       "Bash(sudo apt:*)",
       "Bash(curl:*)",
-      "Bash(pip index:*)"
+      "Bash(pip index:*)",
+      "Bash(git push:*)",
+      "Bash(git tag:*)",
+      "Bash(python3:*)"
     ]
   }
 }

{agentwit-0.1.0 → agentwit-0.3.0}/.gitignore

@@ -71,3 +71,5 @@ witness_logs/
 *.pem
 *.key
 secrets.json
+gui/src-tauri/target/
+gui/src-tauri/target/

{agentwit-0.1.0 → agentwit-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentwit
-Version: 0.1.0
+Version: 0.3.0
 Summary: Transparent proxy witness for AI agent ↔ MCP server communications
 Project-URL: Homepage, https://github.com/tokotokokame/agentwit
 Project-URL: Repository, https://github.com/tokotokokame/agentwit
@@ -30,6 +30,9 @@ Provides-Extra: dev
 Requires-Dist: httpx>=0.27.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
+Provides-Extra: full
+Requires-Dist: httpx>=0.27.0; extra == 'full'
+Requires-Dist: langchain-core>=0.2.0; extra == 'full'
 Description-Content-Type: text/markdown
 
 # agentwit
@@ -42,6 +45,9 @@ Description-Content-Type: text/markdown
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Tests](https://img.shields.io/badge/tests-48%20passing-brightgreen.svg)](#)
 
+## Articles
+- 📝 [AIエージェントの「証人」を作った——設計思想（Zenn）](https://zenn.dev/tokotokokame/articles/bba6a258a458a1)
+
 ## What is agentwit?
 
 agentwit is a transparent proxy that sits between AI agents and MCP servers,

{agentwit-0.1.0 → agentwit-0.3.0}/README.md

@@ -8,6 +8,9 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Tests](https://img.shields.io/badge/tests-48%20passing-brightgreen.svg)](#)
 
+## Articles
+- 📝 [AIエージェントの「証人」を作った——設計思想（Zenn）](https://zenn.dev/tokotokokame/articles/bba6a258a458a1)
+
 ## What is agentwit?
 
 agentwit is a transparent proxy that sits between AI agents and MCP servers,

{agentwit-0.1.0 → agentwit-0.3.0}/agentwit/__init__.py

@@ -1,5 +1,5 @@
 """agentwit - Transparent proxy witness for AI agent ↔ MCP server communications."""
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 from .witness.log import WitnessLogger
 from .witness.chain import ChainManager
 __all__ = ["WitnessLogger", "ChainManager"]

agentwit-0.3.0/agentwit/analyzer/scorer.py

@@ -0,0 +1,169 @@
+"""Risk scoring for witness log events.
+
+Scans event tool names and payloads against a set of known risk patterns
+and returns structured risk indicators.
+"""
+from __future__ import annotations
+
+import json
+import re
+from typing import Any
+
+# Each tuple: (pattern_name, regex, severity)
+RISK_PATTERNS: list[tuple[str, str, str]] = [
+    # --- existing patterns ---
+    ("file_write", r"write_file|create_file|edit_file|overwrite", "medium"),
+    ("shell_exec", r"run_command|execute|bash|shell|subprocess|popen|eval", "high"),
+    ("data_exfil", r"http_request|fetch|curl|wget|requests\.get|requests\.post", "medium"),
+    ("credential_access", r"password|token|secret|api_key|apikey|bearer|credentials|private_key", "high"),
+    # --- new Phase 2 patterns ---
+    ("credential_access_extended", r"\.env|keystore|\.pem|\.p12|\.pfx|id_rsa|id_ed25519|aws_access|gcp_key", "high"),
+    ("data_exfiltration", r"https?://(?!localhost|127\.|0\.0\.0\.0)[a-zA-Z0-9].*?(upload|send|post|put|exfil|dump)", "high"),
+    ("persistence", r"crontab|systemctl\s+enable|/etc/init\.d|launchctl|schtasks|at\s+\d|rc\.local|autostart", "high"),
+    ("lateral_movement", r"nmap|masscan|ping\s+-[cC]|arp\s+-[an]|netstat|ss\s+-[tn]|/etc/hosts|host\s+discovery", "high"),
+    ("privilege_escalation", r"\bsudo\b|setuid|suid|chmod\s+[0-9]*[4-7][0-9]{2}|chown\s+root|visudo|/etc/sudoers|pkexec", "critical"),
+]
+
+# Severity ordering for comparisons
+_SEVERITY_ORDER = {"low": 0, "medium": 1, "high": 2, "critical": 3}
+
+
+class RiskScorer:
+    """Score a witness log event against known risk patterns.
+
+    Each pattern is matched against the tool name and the serialised
+    full_payload of the event.  Matching is case-insensitive.
+
+    Example::
+
+        scorer = RiskScorer()
+        indicators = scorer.score_event(event)
+        for ind in indicators:
+            print(ind["pattern"], ind["severity"], ind["matched"])
+    """
+
+    def __init__(self, patterns: list[tuple[str, str, str]] | None = None) -> None:
+        """Initialise the RiskScorer.
+
+        Args:
+            patterns: Optional override for the default :data:`RISK_PATTERNS`
+                list.  Each element must be a tuple of
+                ``(name, regex_pattern, severity)``.
+        """
+        self._patterns = patterns if patterns is not None else RISK_PATTERNS
+        self._compiled = [
+            (name, re.compile(regex, re.IGNORECASE), severity)
+            for name, regex, severity in self._patterns
+        ]
+
+    def score_event(self, event: dict) -> list[dict]:
+        """Score a single event and return a list of risk indicator dicts.
+
+        The tool name and the full serialised payload are both scanned.
+
+        Args:
+            event: A signed witness log event dict.
+
+        Returns:
+            A (possibly empty) list of dicts, each with keys:
+
+            - ``pattern``: The pattern name that matched.
+            - ``severity``: ``"low"``, ``"medium"``, ``"high"``, or ``"critical"``.
+            - ``matched``: The specific substring that triggered the match.
+        """
+        tool: str = event.get("tool") or ""
+        payload_text: str = json.dumps(event.get("full_payload", {}), default=str)
+        haystack = f"{tool} {payload_text}"
+
+        indicators: list[dict] = []
+        seen_patterns: set[str] = set()
+        for name, regex, severity in self._compiled:
+            if name in seen_patterns:
+                continue
+            m = regex.search(haystack)
+            if m:
+                indicators.append({
+                    "pattern": name,
+                    "severity": severity,
+                    "matched": m.group(0),
+                })
+                seen_patterns.add(name)
+
+        return indicators
+
+    def score_session(self, events: list[dict]) -> dict[str, Any]:
+        """Score an entire session and return a risk summary.
+
+        Analyses all events and detects patterns including consecutive
+        high-risk events that may indicate a coordinated attack chain.
+
+        Args:
+            events: Ordered list of witness log event dicts.
+
+        Returns:
+            A dict with keys:
+
+            - ``total_events``: int
+            - ``risk_level``: overall session level (CRITICAL/HIGH/MEDIUM/LOW)
+            - ``counts``: dict mapping severity label → count of *events* at that level
+            - ``indicators_total``: total number of matched indicators across all events
+            - ``high_risk_events``: list of (index, event) tuples for events with
+              HIGH or CRITICAL indicators
+            - ``consecutive_high_risk``: list of runs of consecutive high-risk event
+              indices (runs of length ≥ 2 are flagged)
+            - ``pattern_frequency``: dict mapping pattern name → hit count
+        """
+        counts: dict[str, int] = {"critical": 0, "high": 0, "medium": 0, "low": 0}
+        indicators_total = 0
+        high_risk_events: list[tuple[int, dict]] = []
+        pattern_frequency: dict[str, int] = {}
+        consecutive_runs: list[list[int]] = []
+        current_run: list[int] = []
+
+        for idx, event in enumerate(events):
+            indicators = self.score_event(event)
+            indicators_total += len(indicators)
+
+            event_max_severity = "low"
+            for ind in indicators:
+                sev = ind["severity"]
+                pattern_frequency[ind["pattern"]] = pattern_frequency.get(ind["pattern"], 0) + 1
+                if _SEVERITY_ORDER.get(sev, 0) > _SEVERITY_ORDER.get(event_max_severity, 0):
+                    event_max_severity = sev
+
+            if indicators:
+                counts[event_max_severity] = counts.get(event_max_severity, 0) + 1
+                if _SEVERITY_ORDER.get(event_max_severity, 0) >= _SEVERITY_ORDER["high"]:
+                    high_risk_events.append((idx, event))
+                    current_run.append(idx)
+                else:
+                    if len(current_run) >= 2:
+                        consecutive_runs.append(current_run)
+                    current_run = []
+            else:
+                if len(current_run) >= 2:
+                    consecutive_runs.append(current_run)
+                current_run = []
+
+        if len(current_run) >= 2:
+            consecutive_runs.append(current_run)
+
+        # Determine overall session risk level
+        if counts["critical"] > 0:
+            risk_level = "CRITICAL"
+        elif counts["high"] > 0:
+            risk_level = "HIGH"
+        elif counts["medium"] > 0:
+            risk_level = "MEDIUM"
+        else:
+            risk_level = "LOW"
+
+        return {
+            "total_events": len(events),
+            "risk_level": risk_level,
+            "counts": counts,
+            "indicators_total": indicators_total,
+            "high_risk_events": high_risk_events,
+            "consecutive_high_risk": consecutive_runs,
+            "pattern_frequency": pattern_frequency,
+        }

agentwit-0.3.0/agentwit/analyzer/timeline.py

@@ -0,0 +1,283 @@
+"""Session timeline construction and session comparison.
+
+Provides functions to load, summarise, and diff witness log sessions.
+"""
+from __future__ import annotations
+
+import json
+from datetime import datetime
+from pathlib import Path
+from typing import Any
+
+
+# ---------------------------------------------------------------------------
+# Public API
+# ---------------------------------------------------------------------------
+
+def load_session(session_path: str | Path) -> list[dict]:
+    """Load all events from a session directory.
+
+    Args:
+        session_path: Path to the session directory that contains
+            ``witness.jsonl``.
+
+    Returns:
+        Ordered list of event dicts.
+
+    Raises:
+        FileNotFoundError: If ``witness.jsonl`` is not found.
+    """
+    session_path = Path(session_path)
+    jsonl_file = session_path / "witness.jsonl"
+    events: list[dict] = []
+    with open(jsonl_file, "r", encoding="utf-8") as fh:
+        for line in fh:
+            line = line.strip()
+            if line:
+                events.append(json.loads(line))
+    return events
+
+
+def build_timeline(events: list[dict]) -> dict[str, Any]:
+    """Build a time-series summary from a list of events.
+
+    Args:
+        events: Ordered list of witness log event dicts.
+
+    Returns:
+        A dict with keys:
+
+        - ``total_events``: int
+        - ``start_time``: ISO8601 string of first event (or None)
+        - ``end_time``: ISO8601 string of last event (or None)
+        - ``duration_seconds``: float or None
+        - ``actors``: sorted list of distinct actor names
+        - ``tools_used``: sorted list of distinct tool names
+        - ``actions``: sorted list of distinct action names
+        - ``entries``: list of per-event summary dicts
+    """
+    if not events:
+        return {
+            "total_events": 0,
+            "start_time": None,
+            "end_time": None,
+            "duration_seconds": None,
+            "actors": [],
+            "tools_used": [],
+            "actions": [],
+            "entries": [],
+        }
+
+    entries: list[dict] = []
+    actors: set[str] = set()
+    tools_used: set[str] = set()
+    actions: set[str] = set()
+
+    for i, event in enumerate(events):
+        actor = event.get("actor", "unknown")
+        action = event.get("action", "")
+        tool = event.get("tool", "")
+        timestamp = event.get("timestamp", "")
+        risk_indicators = event.get("risk_indicators") or []
+
+        actors.add(actor)
+        if action:
+            actions.add(action)
+        if tool:
+            tools_used.add(tool)
+
+        has_high_risk = any(
+            ri.get("severity") in ("high", "critical") for ri in risk_indicators
+        )
+        worst_severity = _worst_severity(risk_indicators)
+
+        entries.append({
+            "index": i,
+            "timestamp": timestamp,
+            "actor": actor,
+            "action": action,
+            "tool": tool,
+            "risk_indicators": risk_indicators,
+            "risk_count": len(risk_indicators),
+            "has_high_risk": has_high_risk,
+            "worst_severity": worst_severity,
+            "witness_id": event.get("witness_id", ""),
+        })
+
+    start_time = events[0].get("timestamp", "")
+    end_time = events[-1].get("timestamp", "")
+    duration_seconds: float | None = None
+
+    if start_time and end_time:
+        try:
+            start_dt = datetime.fromisoformat(start_time)
+            end_dt = datetime.fromisoformat(end_time)
+            duration_seconds = (end_dt - start_dt).total_seconds()
+        except ValueError:
+            pass
+
+    return {
+        "total_events": len(events),
+        "start_time": start_time,
+        "end_time": end_time,
+        "duration_seconds": duration_seconds,
+        "actors": sorted(actors),
+        "tools_used": sorted(tools_used),
+        "actions": sorted(actions),
+        "entries": entries,
+    }
+
+
+def diff_sessions(
+    session_a: str | Path,
+    session_b: str | Path,
+) -> dict[str, Any]:
+    """Compare two sessions and return a structured diff.
+
+    Compares event counts, tools called, and risk profiles between two
+    sessions.  For tools that appear in both sessions the per-tool call
+    counts are compared.
+
+    Args:
+        session_a: Path to the first session directory.
+        session_b: Path to the second session directory.
+
+    Returns:
+        A dict with keys:
+
+        - ``session_a``: summary of session A
+        - ``session_b``: summary of session B
+        - ``diff``: dict describing additions, removals, and changes
+    """
+    events_a = load_session(session_a)
+    events_b = load_session(session_b)
+
+    timeline_a = build_timeline(events_a)
+    timeline_b = build_timeline(events_b)
+
+    risk_a = _count_by_severity(events_a)
+    risk_b = _count_by_severity(events_b)
+
+    tools_a: set[str] = {e.get("tool", "") for e in events_a if e.get("tool")}
+    tools_b: set[str] = {e.get("tool", "") for e in events_b if e.get("tool")}
+
+    tool_calls_a: dict[str, list[dict]] = {}
+    for e in events_a:
+        t = e.get("tool", "")
+        if t:
+            tool_calls_a.setdefault(t, []).append(e)
+
+    tool_calls_b: dict[str, list[dict]] = {}
+    for e in events_b:
+        t = e.get("tool", "")
+        if t:
+            tool_calls_b.setdefault(t, []).append(e)
+
+    common_tools = tools_a & tools_b
+    tool_comparison: dict[str, dict] = {}
+    for tool in common_tools:
+        calls_a = tool_calls_a.get(tool, [])
+        calls_b = tool_calls_b.get(tool, [])
+        # Compare input hashes of matching pairs
+        input_changes: list[dict] = []
+        for idx, (ca, cb) in enumerate(zip(calls_a, calls_b)):
+            if ca.get("input_hash") != cb.get("input_hash"):
+                input_changes.append({
+                    "call_index": idx,
+                    "input_hash_a": ca.get("input_hash"),
+                    "input_hash_b": cb.get("input_hash"),
+                })
+        tool_comparison[tool] = {
+            "count_a": len(calls_a),
+            "count_b": len(calls_b),
+            "count_diff": len(calls_b) - len(calls_a),
+            "input_changes": input_changes,
+        }
+
+    return {
+        "session_a": {
+            "path": str(session_a),
+            "total_events": timeline_a["total_events"],
+            "tools_used": timeline_a["tools_used"],
+            "risk_counts": risk_a,
+            "start_time": timeline_a["start_time"],
+            "end_time": timeline_a["end_time"],
+        },
+        "session_b": {
+            "path": str(session_b),
+            "total_events": timeline_b["total_events"],
+            "tools_used": timeline_b["tools_used"],
+            "risk_counts": risk_b,
+            "start_time": timeline_b["start_time"],
+            "end_time": timeline_b["end_time"],
+        },
+        "diff": {
+            "event_count_change": timeline_b["total_events"] - timeline_a["total_events"],
+            "tools_added": sorted(tools_b - tools_a),
+            "tools_removed": sorted(tools_a - tools_b),
+            "tools_common": sorted(common_tools),
+            "tool_comparison": tool_comparison,
+            "risk_changes": {
+                sev: risk_b.get(sev, 0) - risk_a.get(sev, 0)
+                for sev in ("critical", "high", "medium", "low")
+            },
+        },
+    }
+
+
+# ---------------------------------------------------------------------------
+# Legacy class-based API (kept for backwards compatibility)
+# ---------------------------------------------------------------------------
+
+class Timeline:
+    """Build and display a chronological timeline of witness log events."""
+
+    def __init__(self, events: list[dict]) -> None:
+        self.events = events
+
+    def build(self) -> list[dict]:
+        """Build and return timeline entries."""
+        return build_timeline(self.events)["entries"]
+
+    def render_text(self) -> str:
+        """Render the timeline as a human-readable text string."""
+        timeline = build_timeline(self.events)
+        lines = [
+            f"Timeline: {timeline['total_events']} events",
+            f"  Period : {timeline['start_time']} → {timeline['end_time']}",
+            f"  Actors : {', '.join(timeline['actors']) or '-'}",
+            f"  Tools  : {', '.join(timeline['tools_used']) or '-'}",
+            "",
+        ]
+        for entry in timeline["entries"]:
+            risk_tag = ""
+            if entry["risk_count"]:
+                risk_tag = f"  [{entry['worst_severity'].upper()} RISK x{entry['risk_count']}]"
+            lines.append(
+                f"  [{entry['index']:03d}] {entry['timestamp']}  "
+                f"{entry['action']}  tool={entry['tool'] or '-'}{risk_tag}"
+            )
+        return "\n".join(lines)
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _worst_severity(risk_indicators: list[dict]) -> str:
+    order = {"low": 0, "medium": 1, "high": 2, "critical": 3}
+    worst = "none"
+    for ri in risk_indicators:
+        sev = ri.get("severity", "low")
+        if order.get(sev, 0) > order.get(worst, -1):
+            worst = sev
+    return worst
+
+
+def _count_by_severity(events: list[dict]) -> dict[str, int]:
+    counts: dict[str, int] = {"critical": 0, "high": 0, "medium": 0, "low": 0}
+    for event in events:
+        for ri in event.get("risk_indicators") or []:
+            sev = ri.get("severity", "low")
+            counts[sev] = counts.get(sev, 0) + 1
+    return counts

{agentwit-0.1.0 → agentwit-0.3.0}/agentwit/cli.py

@@ -22,25 +22,66 @@ def main() -> None:
 # proxy
 # ---------------------------------------------------------------------------
 
-@main.command()
-@click.option("--target", required=True, help="Target MCP server URL")
-@click.option("--port", default=8765, show_default=True, help="Port to listen on")
-@click.option("--host", default="127.0.0.1", show_default=True, help="Host to bind")
+@main.command(context_settings={"allow_extra_args": True, "ignore_unknown_options": True})
+@click.option("--target", default=None, help="Target MCP server URL (HTTP mode)")
+@click.option("--port", default=8765, show_default=True, help="Port to listen on (HTTP mode)")
+@click.option("--host", default="127.0.0.1", show_default=True, help="Host to bind (HTTP mode)")
 @click.option("--log-dir", default="./witness_logs", show_default=True, help="Directory for witness logs")
 @click.option("--actor", default="agent", show_default=True, help="Actor identifier")
-def proxy(target: str, port: int, host: str, log_dir: str, actor: str) -> None:
-    """Start the transparent HTTP proxy server.
+@click.option("--stdio", is_flag=True, default=False, help="stdio proxy mode: intercept subprocess stdin/stdout")
+@click.option("--webhook", default=None, help="Webhook URL for risk notifications")
+@click.option("--webhook-on", default="HIGH,CRITICAL", show_default=True, help="Comma-separated severity levels that trigger webhook")
+@click.argument("cmd", nargs=-1, type=click.UNPROCESSED)
+def proxy(
+    target: str | None,
+    port: int,
+    host: str,
+    log_dir: str,
+    actor: str,
+    stdio: bool,
+    webhook: str | None,
+    webhook_on: str,
+    cmd: tuple,
+) -> None:
+    """Start the transparent proxy server (HTTP or stdio mode).
+
+    HTTP mode forwards requests to TARGET and records them:
 
-    All requests forwarded to TARGET are recorded in LOG_DIR.  Each session
-    gets its own timestamped sub-directory containing a ``witness.jsonl`` file.
+        agentwit proxy --target http://localhost:3000 --port 8765
 
-    Example:
+    stdio mode wraps a subprocess MCP server:
 
-        agentwit proxy --target http://localhost:3000 --port 8765
+        agentwit proxy --stdio -- python mcp_server.py
     """
-    import uvicorn
+    import asyncio
 
     from .witness.log import WitnessLogger
+
+    if stdio:
+        if not cmd:
+            click.echo("Error: --stdio requires a command after --", err=True)
+            sys.exit(1)
+
+        click.echo(f"Starting agentwit stdio proxy")
+        click.echo(f"Command: {list(cmd)}")
+        click.echo(f"Witness logs → {log_dir}", err=True)
+
+        logger = WitnessLogger(session_dir=log_dir, actor=actor)
+        click.echo(f"Session: {logger.session_path}", err=True)
+
+        from .proxy.stdio_proxy import run_stdio_proxy
+
+        exit_code = asyncio.run(run_stdio_proxy(list(cmd), logger, actor=actor))
+        logger.close()
+        sys.exit(exit_code)
+
+    # HTTP mode
+    if not target:
+        click.echo("Error: --target is required in HTTP proxy mode", err=True)
+        sys.exit(1)
+
+    import uvicorn
+
     from .proxy.http_proxy import create_proxy_app
 
     click.echo(f"Starting agentwit proxy → {target}")

agentwit-0.3.0/agentwit/integrations/__init__.py

@@ -0,0 +1 @@
+"""Integrations with third-party AI frameworks."""