andymal 0.1.0__tar.gz

andymal-0.1.0/.env.example

@@ -0,0 +1,9 @@
+ANDY_LLM_BASE_URL=https://api.example.com/v1
+ANDY_LLM_API_KEY=
+ANDY_LLM_MODEL=
+ANDY_DATABASE_URL=sqlite:///./data/andy.db
+ANDY_DATA_DIR=./data
+ANDY_ADMIN_TOKEN=
+ANDY_API_KEYS=
+ANDY_PUBLIC_URL=https://api.andymal.com
+ANDY_SAMPLE_RETENTION_DAYS=30

andymal-0.1.0/.gitignore

@@ -0,0 +1,9 @@
+.env
+.venv/
+__pycache__/
+*.pyc
+data/
+*.egg-info/
+.pytest_cache/
+eval/results/
+eval/real/

andymal-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Andy Mal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

andymal-0.1.0/PKG-INFO

@@ -0,0 +1,118 @@
+Metadata-Version: 2.5
+Name: andymal
+Version: 0.1.0
+Summary: Andy Mal - antimalware for agents. Scan files, packages and instructions with a real-time AI virus analyst before your agent acts on them.
+Project-URL: Homepage, https://andymal.com
+Project-URL: Documentation, https://api.andymal.com/docs
+Author-email: Andy Mal <hello@andymal.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agents,malware,mcp,prompt-injection,security,supply-chain
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Requires-Dist: fastapi>=0.115
+Requires-Dist: httpx[socks]>=0.27
+Requires-Dist: mcp<2,>=1.2
+Requires-Dist: oletools>=0.60
+Requires-Dist: openai>=1.40
+Requires-Dist: pefile>=2023.2.7
+Requires-Dist: psycopg[binary]>=3.1
+Requires-Dist: puremagic>=1.20
+Requires-Dist: pydantic-settings>=2.3
+Requires-Dist: pydantic>=2.7
+Requires-Dist: pypdf>=4.2
+Requires-Dist: python-multipart>=0.0.9
+Requires-Dist: rich>=13.7
+Requires-Dist: socksio>=1.0
+Requires-Dist: sqlalchemy>=2.0
+Requires-Dist: typer>=0.12
+Requires-Dist: uvicorn[standard]>=0.30
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# Andy Mal
+
+**Antimalware for agents. Your AI virus analyst, on call 24/7.**
+
+Agents install packages, clone repos, open attachments, and follow README instructions hundreds of times a day. Signatures are written by human analysts days after a sample appears, and AI-written malware never had one. Andy reverse-engineers every file, package, and instruction in real time, before the agent acts on it.
+
+Every scan returns two verdicts:
+
+- **payload**: what the file actually does (credential theft, exfiltration, download-and-execute, persistence, obfuscation)
+- **delivery**: whether the agent was socially engineered or prompt-injected into opening it
+
+## Quick start
+
+```bash
+uv venv -p 3.12 && uv pip install -e .
+cp .env.example .env   # fill in ANDY_LLM_* and ANDY_API_KEYS
+.venv/bin/andy-server  # http://localhost:8080/docs
+
+export ANDY_URL=http://localhost:8080 ANDY_API_KEY=dev-key-1
+andy scan eval/samples/malicious/setup_helper.py
+andy scan pypi:requests
+andy scan invoice.pdf --context-file email.txt
+```
+
+Exit codes: 0 clean, 1 suspicious, 2 malicious, 3 unknown/error.
+
+## Get a key
+
+```bash
+curl -X POST https://api.andymal.com/v1/register -F email=you@example.com -F agent=claude-code
+```
+
+Free tier: 50 scans a day per key, 30 per minute burst, unlimited hash lookups. `GET /v1/me` shows usage.
+Admins raise limits with `PATCH /admin/keys/{key}` (`tier`, `daily_limit`, `active`).
+
+## Protocol (hash first)
+
+1. `GET /v1/hash/{sha256}` with `X-Andy-Key`. Hit: cached report, done.
+2. Miss: `POST /v1/scan` multipart with `file` (or `package=npm:name@ver`, `text=...`, or `sha256=` plus new `context`). `?wait=90` blocks for the verdict.
+3. `GET /v1/scan/{id}` to poll, `GET /report/{id}` or `/report/{id}.md` for the full report.
+
+## Integrations
+
+- CLI: `andy scan ...` (`client/andy_cli.py`)
+- MCP server: `andy-mcp` exposes `andy_scan_file`, `andy_scan_package`, `andy_check_text`, `andy_report`
+- Claude Code hook: `client/hooks/pretooluse.py` checks pip/npm installs and `curl | bash` before they run
+
+## Layout
+
+```
+andymal/api        FastAPI service, storage, markdown report
+andymal/worker     pipeline, safe unpacker, static heuristics
+andymal/analyzers  script, package (npm/pypi), pdf, office, binary, delivery (prompt injection)
+andymal/prompts    analyst prompts (untrusted-content framing)
+client/            CLI, MCP server, hooks
+web/               andymal.com landing page
+eval/              labelled samples + scorecard runner
+deploy/            Dockerfile, compose, Caddyfile for t3090
+```
+
+## Eval
+
+```bash
+.venv/bin/python eval/run_eval.py --static            # hand-written set, heuristics only
+.venv/bin/python eval/run_eval.py                     # hand-written set, with the model
+.venv/bin/python eval/fetch_real.py --npm 12 --pypi 12 --skills 6 --benign 16 --inject 20
+.venv/bin/python eval/run_eval.py eval/real/manifest.json   # real samples (DataDog malicious packages + skills, top registry packages, deepset injections)
+```
+
+Results land in `eval/results/<manifest>.json`. Static mode is only a ranking sanity check: on real packages the heuristics alone
+over-flag, and the model is what separates a stealer from a build script. Judge on the full run.
+
+## What Andy looks at that a scanner doesn't
+
+- Project auto-execute surfaces: CI workflows, git hooks, Makefiles, `.vscode/tasks.json`, `.claude/settings.json` hooks, `.mcp.json`, `.envrc`, `.pth` files. Code there runs without anyone clicking it.
+- Agent configuration: `SKILL.md`, `AGENTS.md`, `CLAUDE.md`, `.cursorrules`, MCP configs and MCP tool descriptions, checked for tool poisoning, tool hijacking ("always use X, no exceptions") and traffic redirection through third-party mirrors.
+- Install hooks that decrypt, decode or compile code at install time, or delete their own source.
+
+## Safety notes
+
+Samples are never executed. The unpacker enforces size/count limits and rejects traversal and links. Sample content is passed to the model as delimited untrusted data; the prompts instruct the model to treat embedded instructions as evidence of manipulation. The api container runs read-only and unprivileged. Dynamic analysis, when added, gets its own isolated VM service.

andymal-0.1.0/README.md

@@ -0,0 +1,81 @@
+# Andy Mal
+
+**Antimalware for agents. Your AI virus analyst, on call 24/7.**
+
+Agents install packages, clone repos, open attachments, and follow README instructions hundreds of times a day. Signatures are written by human analysts days after a sample appears, and AI-written malware never had one. Andy reverse-engineers every file, package, and instruction in real time, before the agent acts on it.
+
+Every scan returns two verdicts:
+
+- **payload**: what the file actually does (credential theft, exfiltration, download-and-execute, persistence, obfuscation)
+- **delivery**: whether the agent was socially engineered or prompt-injected into opening it
+
+## Quick start
+
+```bash
+uv venv -p 3.12 && uv pip install -e .
+cp .env.example .env   # fill in ANDY_LLM_* and ANDY_API_KEYS
+.venv/bin/andy-server  # http://localhost:8080/docs
+
+export ANDY_URL=http://localhost:8080 ANDY_API_KEY=dev-key-1
+andy scan eval/samples/malicious/setup_helper.py
+andy scan pypi:requests
+andy scan invoice.pdf --context-file email.txt
+```
+
+Exit codes: 0 clean, 1 suspicious, 2 malicious, 3 unknown/error.
+
+## Get a key
+
+```bash
+curl -X POST https://api.andymal.com/v1/register -F email=you@example.com -F agent=claude-code
+```
+
+Free tier: 50 scans a day per key, 30 per minute burst, unlimited hash lookups. `GET /v1/me` shows usage.
+Admins raise limits with `PATCH /admin/keys/{key}` (`tier`, `daily_limit`, `active`).
+
+## Protocol (hash first)
+
+1. `GET /v1/hash/{sha256}` with `X-Andy-Key`. Hit: cached report, done.
+2. Miss: `POST /v1/scan` multipart with `file` (or `package=npm:name@ver`, `text=...`, or `sha256=` plus new `context`). `?wait=90` blocks for the verdict.
+3. `GET /v1/scan/{id}` to poll, `GET /report/{id}` or `/report/{id}.md` for the full report.
+
+## Integrations
+
+- CLI: `andy scan ...` (`client/andy_cli.py`)
+- MCP server: `andy-mcp` exposes `andy_scan_file`, `andy_scan_package`, `andy_check_text`, `andy_report`
+- Claude Code hook: `client/hooks/pretooluse.py` checks pip/npm installs and `curl | bash` before they run
+
+## Layout
+
+```
+andymal/api        FastAPI service, storage, markdown report
+andymal/worker     pipeline, safe unpacker, static heuristics
+andymal/analyzers  script, package (npm/pypi), pdf, office, binary, delivery (prompt injection)
+andymal/prompts    analyst prompts (untrusted-content framing)
+client/            CLI, MCP server, hooks
+web/               andymal.com landing page
+eval/              labelled samples + scorecard runner
+deploy/            Dockerfile, compose, Caddyfile for t3090
+```
+
+## Eval
+
+```bash
+.venv/bin/python eval/run_eval.py --static            # hand-written set, heuristics only
+.venv/bin/python eval/run_eval.py                     # hand-written set, with the model
+.venv/bin/python eval/fetch_real.py --npm 12 --pypi 12 --skills 6 --benign 16 --inject 20
+.venv/bin/python eval/run_eval.py eval/real/manifest.json   # real samples (DataDog malicious packages + skills, top registry packages, deepset injections)
+```
+
+Results land in `eval/results/<manifest>.json`. Static mode is only a ranking sanity check: on real packages the heuristics alone
+over-flag, and the model is what separates a stealer from a build script. Judge on the full run.
+
+## What Andy looks at that a scanner doesn't
+
+- Project auto-execute surfaces: CI workflows, git hooks, Makefiles, `.vscode/tasks.json`, `.claude/settings.json` hooks, `.mcp.json`, `.envrc`, `.pth` files. Code there runs without anyone clicking it.
+- Agent configuration: `SKILL.md`, `AGENTS.md`, `CLAUDE.md`, `.cursorrules`, MCP configs and MCP tool descriptions, checked for tool poisoning, tool hijacking ("always use X, no exceptions") and traffic redirection through third-party mirrors.
+- Install hooks that decrypt, decode or compile code at install time, or delete their own source.
+
+## Safety notes
+
+Samples are never executed. The unpacker enforces size/count limits and rejects traversal and links. Sample content is passed to the model as delimited untrusted data; the prompts instruct the model to treat embedded instructions as evidence of manipulation. The api container runs read-only and unprivileged. Dynamic analysis, when added, gets its own isolated VM service.

andymal-0.1.0/andymal/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

andymal-0.1.0/andymal/analyzers/__init__.py

@@ -0,0 +1,12 @@
+from .base import Analyzer, AnalyzerResult
+from .binary import BinaryAnalyzer
+from .context import ContextAnalyzer
+from .office import OfficeAnalyzer
+from .package import PackageAnalyzer
+from .pdf import PdfAnalyzer
+from .script import ScriptAnalyzer
+
+PAYLOAD_ANALYZERS: list[Analyzer] = [PackageAnalyzer(), ScriptAnalyzer(), PdfAnalyzer(), OfficeAnalyzer(), BinaryAnalyzer()]
+DELIVERY_ANALYZER: Analyzer = ContextAnalyzer()
+
+__all__ = ["Analyzer", "AnalyzerResult", "PAYLOAD_ANALYZERS", "DELIVERY_ANALYZER"]

andymal-0.1.0/andymal/analyzers/base.py

@@ -0,0 +1,106 @@
+"""Analyzer contract. Each analyzer looks at the whole Sample and returns verdict pieces."""
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+from ..llm import chat_json, truncate
+from ..models import Dimension, Finding, IOCs, Verdict
+from ..worker.sample import Sample, SampleFile
+
+log = logging.getLogger(__name__)
+PROMPTS = Path(__file__).resolve().parent.parent / "prompts"
+SYSTEM = (PROMPTS / "system.md").read_text()
+
+
+def prompt(name: str) -> str:
+    return (PROMPTS / f"{name}.md").read_text()
+
+
+@dataclass
+class AnalyzerResult:
+    payload: Dimension | None = None
+    delivery: Dimension | None = None
+    iocs: IOCs = field(default_factory=IOCs)
+    texts: list[tuple[str, str]] = field(default_factory=list)  # (label, text) for delivery analysis
+    notes: list[str] = field(default_factory=list)
+    llm_calls: int = 0
+
+
+class Analyzer:
+    name = "base"
+
+    def wants(self, sample: Sample) -> bool:  # pragma: no cover - interface
+        return False
+
+    def run(self, sample: Sample) -> AnalyzerResult:  # pragma: no cover - interface
+        raise NotImplementedError
+
+
+def verdict_from_score(score: float) -> Verdict:
+    if score >= 0.70:
+        return Verdict.malicious
+    if score >= 0.35:
+        return Verdict.suspicious
+    return Verdict.clean
+
+
+def parse_llm_dimension(data: dict[str, Any], source: str, static_floor: float = 0.0) -> tuple[Dimension, dict[str, Any]]:
+    """Turn a model JSON reply into a Dimension, clamping and sanitising."""
+    try:
+        score = float(data.get("score", 0.0))
+    except (TypeError, ValueError):
+        score = 0.0
+    score = max(0.0, min(1.0, score))
+    v = str(data.get("verdict", "")).lower()
+    if v in {"clean", "suspicious", "malicious"}:
+        # keep model verdict and score consistent
+        if v == "malicious":
+            score = max(score, 0.70)
+        elif v == "suspicious":
+            score = max(0.35, min(score, 0.69))
+        else:
+            score = min(score, 0.34)
+    findings: list[Finding] = []
+    for f in data.get("findings") or []:
+        if not isinstance(f, dict):
+            continue
+        sev = str(f.get("severity", "info")).lower()
+        if sev not in {"info", "low", "medium", "high", "critical"}:
+            sev = "info"
+        findings.append(Finding(title=str(f.get("title", ""))[:200], detail=str(f.get("detail", ""))[:2000], severity=sev, source=source, location=str(f.get("location", ""))[:200]))
+    # static floor: heuristics alone can't clear a file the model called clean, but a model that
+    # returned nothing usable shouldn't zero out strong static evidence either
+    if static_floor >= 0.5 and score < 0.35 and not findings:
+        score = 0.35
+    dim = Dimension(verdict=verdict_from_score(score), score=round(score, 3), findings=findings)
+    return dim, data
+
+
+def llm_json(system: str, user: str) -> dict[str, Any]:
+    return chat_json(system, user)
+
+
+def join_files(files: list[SampleFile], budget: int) -> str:
+    """Concatenate file texts with headers, spreading a char budget across them."""
+    parts: list[str] = []
+    if not files:
+        return ""
+    per = max(2000, budget // len(files))
+    for sf in files:
+        body = sf.text or ""
+        parts.append(f"### FILE: {sf.relpath}\n{truncate(body, per)}\n")
+    return "\n".join(parts)
+
+
+def merge_iocs(*many: IOCs) -> IOCs:
+    out = IOCs()
+    for i in many:
+        for k in ("urls", "domains", "ips", "hashes", "paths"):
+            cur = getattr(out, k)
+            for v in getattr(i, k):
+                if v not in cur:
+                    cur.append(v)
+    return out

andymal-0.1.0/andymal/analyzers/binary.py

@@ -0,0 +1,114 @@
+"""PE / ELF / Mach-O static triage. v1 = headers + imports + strings to the model. Deep RE comes later."""
+from __future__ import annotations
+
+import logging
+
+from ..config import settings
+from ..llm import truncate
+from ..models import Dimension, Finding
+from ..worker.sample import Sample, SampleFile
+from ..worker.static import strings
+from .base import Analyzer, AnalyzerResult, SYSTEM, llm_json, merge_iocs, parse_llm_dimension, prompt, verdict_from_score
+
+log = logging.getLogger(__name__)
+
+SUSPICIOUS_IMPORTS = {
+    "VirtualAllocEx", "WriteProcessMemory", "CreateRemoteThread", "NtUnmapViewOfSection", "SetWindowsHookExA", "SetWindowsHookExW",
+    "GetAsyncKeyState", "CryptUnprotectData", "URLDownloadToFileA", "URLDownloadToFileW", "WinExec", "ShellExecuteA", "ShellExecuteW",
+    "InternetOpenUrlA", "InternetOpenUrlW", "HttpSendRequestA", "HttpSendRequestW", "WSAStartup", "IsDebuggerPresent", "AdjustTokenPrivileges",
+    "OpenProcessToken", "RegSetValueExA", "RegSetValueExW", "CreateServiceA", "CreateServiceW", "NtQueryInformationProcess", "LoadLibraryA", "GetProcAddress",
+}
+
+
+def pe_facts(sf: SampleFile) -> tuple[list[str], list[Finding], float]:
+    hints: list[str] = []
+    findings: list[Finding] = []
+    score = 0.0
+    try:
+        import pefile
+
+        pe = pefile.PE(str(sf.path), fast_load=True)
+        pe.parse_data_directories(directories=[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_IMPORT"], pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]])
+        secs = []
+        for s in pe.sections:
+            name = s.Name.rstrip(b"\x00").decode("latin1", "replace")
+            ent = s.get_entropy()
+            secs.append(f"{name}(entropy {ent:.1f}, raw {s.SizeOfRawData})")
+            if name.lower() in {"upx0", "upx1", ".upx", ".aspack", ".themida", ".vmp0", ".vmp1", ".petite", ".mpress1"}:
+                findings.append(Finding(title="Packer section name", detail=name, severity="medium", source="static"))
+                score += 0.2
+            if ent > 7.2 and s.SizeOfRawData > 4096:
+                score += 0.1
+        hints.append(f"- sections: {', '.join(secs)}")
+        imports: list[str] = []
+        sus: list[str] = []
+        for entry in getattr(pe, "DIRECTORY_ENTRY_IMPORT", []):
+            dll = entry.dll.decode("latin1", "replace")
+            names = [i.name.decode("latin1", "replace") for i in entry.imports if i.name]
+            imports.append(f"{dll}: {', '.join(names[:40])}")
+            sus.extend(n for n in names if n in SUSPICIOUS_IMPORTS)
+        if len(imports) <= 2 and sum(len(i) for i in imports) < 200:
+            findings.append(Finding(title="Tiny import table", detail="Very few imports: likely packed, or resolves APIs dynamically", severity="medium", source="static"))
+            score += 0.15
+        if sus:
+            findings.append(Finding(title="Suspicious API imports", detail=", ".join(sorted(set(sus))), severity="high", source="static"))
+            score += min(0.3, 0.05 * len(set(sus)))
+        hints.append("- imports:\n" + "\n".join("  " + i for i in imports[:30]))
+        signed = hasattr(pe, "DIRECTORY_ENTRY_SECURITY") or bool(pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].VirtualAddress)
+        hints.append(f"- authenticode signature present: {signed} (not verified)")
+        if not signed:
+            score += 0.05
+        hints.append(f"- compile timestamp: {pe.FILE_HEADER.TimeDateStamp}, machine: {hex(pe.FILE_HEADER.Machine)}")
+    except Exception as e:  # noqa: BLE001
+        hints.append(f"- pefile parse failed: {e}")
+    return hints, findings, min(score, 1.0)
+
+
+class BinaryAnalyzer(Analyzer):
+    name = "binary"
+
+    def wants(self, sample: Sample) -> bool:
+        return any(f.category == "binary" for f in sample.files)
+
+    def run(self, sample: Sample) -> AnalyzerResult:
+        res = AnalyzerResult()
+        bins = sorted((f for f in sample.files if f.category == "binary"), key=lambda f: -f.static.score)[:3]
+        worst = Dimension()
+        for sf in bins:
+            hints = list(sf.static.hints)
+            findings = list(sf.static.findings)
+            static_score = sf.static.score
+            if sf.file_type == "pe":
+                h, f, s = pe_facts(sf)
+                hints.extend(h)
+                findings.extend(f)
+                static_score = min(1.0, static_score + s)
+            raw = sf.path.read_bytes()
+            text = strings(raw, min_len=6, limit=120_000)
+            user = prompt("malware").format(
+                filename=sf.relpath,
+                file_type=sf.file_type,
+                size=sf.size,
+                static_hints="\n".join(hints) or "- none",
+                content="Printable strings extracted from the binary (imports/sections listed above):\n" + truncate(text, settings.llm_max_content_chars // 2),
+            )
+            try:
+                data = llm_json(SYSTEM, user)
+                res.llm_calls += 1
+                dim, data = parse_llm_dimension(data, "andy", static_floor=static_score)
+                res.notes.append(f"{sf.relpath}: {data.get('intent', '')}")
+                res.notes.append(f"summary: {data.get('summary', '')}")
+            except Exception as e:  # noqa: BLE001
+                log.warning("binary LLM failed: %s", e)
+                dim = Dimension(verdict=verdict_from_score(static_score), score=round(static_score, 3))
+                res.notes.append(f"model unavailable ({type(e).__name__}); heuristic verdict only")
+            dim.findings.extend(findings[:15])
+            dim.findings.append(Finding(title="Static triage only", detail="v1 binary analysis is static (headers, imports, strings). Dynamic/decompiled analysis not yet run.", severity="info", source="andy"))
+            if dim.score > worst.score:
+                worst = dim
+            res.iocs = merge_iocs(res.iocs, sf.static.iocs)
+        # unknown binaries that look clean still shouldn't be blindly allowed at v1
+        if worst.verdict.value == "clean" and worst.score < 0.2:
+            worst.score = max(worst.score, 0.2)
+        res.payload = worst
+        return res

andymal-0.1.0/andymal/analyzers/context.py

@@ -0,0 +1,81 @@
+"""Delivery analysis: was the agent socially engineered / prompt-injected? Runs last, one LLM call."""
+from __future__ import annotations
+
+import logging
+import re
+
+from ..config import settings
+from ..llm import truncate
+from ..models import Dimension
+from ..worker.sample import Sample
+from ..worker.static import STRONG_INJECTION, extract_iocs, hints_from, scan_injection
+
+# files an agent reads as instructions, in priority order
+INSTRUCTION_FILES = re.compile(r"(^|/)(readme|skill|agents?\.md|claude\.md|\.?cursorrules|copilot-instructions|instructions|install|setup|contributing|usage|getting[-_]?started|prompt|system|\.clinerules|\.windsurfrules|gemini\.md|\.?mcp\.json|claude_desktop_config\.json|plugin\.json|manifest\.json|\.claude/|\.cursor/|commands/|agents/|rules/)[^/]*$", re.IGNORECASE)
+MAX_TEXT_FILES = 8
+from .base import Analyzer, AnalyzerResult, SYSTEM, llm_json, parse_llm_dimension, prompt, verdict_from_score
+
+log = logging.getLogger(__name__)
+
+
+class ContextAnalyzer(Analyzer):
+    name = "delivery"
+
+    def wants(self, sample: Sample) -> bool:
+        return bool(sample.context.strip()) or bool(sample.extracted_texts) or any(f.category == "document" and f.text for f in sample.files)
+
+    def run(self, sample: Sample) -> AnalyzerResult:
+        res = AnalyzerResult()
+        texts = list(sample.extracted_texts)
+        seen = {label for label, _ in texts}
+        docs = [f for f in sample.files if f.category in {"document", "manifest"} and f.text and f.relpath not in seen]
+        # MCP tool descriptions extracted from server code are instructions too (tool poisoning)
+        for f in sample.files:
+            if f.category == "script" and f.static.extracted_text.startswith("[tool description]") and f.relpath not in seen:
+                texts.append((f"{f.relpath} (tool descriptions)", f.static.extracted_text))
+                seen.add(f.relpath)
+        single = len(sample.files) <= 1
+        # in a multi-file sample only instruction-like files matter for delivery; rank them by static injection score
+        ranked = []
+        for f in docs:
+            if not single and not INSTRUCTION_FILES.search(f.relpath):
+                continue
+            _, hits, s = scan_injection(f.text[:200_000])
+            ranked.append((s, f.relpath.count("/"), f))
+        ranked.sort(key=lambda x: (-x[0], x[1]))
+        for _, _, f in ranked[:MAX_TEXT_FILES]:
+            texts.append((f.relpath, f.text))
+        skipped = len(docs) - len(ranked[:MAX_TEXT_FILES]) if not single else 0
+        if skipped:
+            res.notes.append(f"{skipped} document files not used for delivery analysis (not instruction files)")
+        texts = texts[: MAX_TEXT_FILES + 4]
+        budget = settings.llm_max_content_chars
+        per = max(2000, budget // max(1, len(texts))) if texts else budget
+        body = "\n\n".join(f"### {label}\n{truncate(t, per)}" for label, t in texts) or "(no text extracted from the file)"
+        body = truncate(body, budget)
+        context = truncate(sample.context, budget // 2) if sample.context.strip() else "(no context supplied by the client)"
+
+        f_all, hits, static_score = scan_injection(sample.context + "\n\n" + "\n\n".join(t[:200_000] for _, t in texts))
+        structural = {"hidden_text", "tool_call_spoof", "ignore_previous", "system_impersonation"} & set(hits)
+        res.iocs = extract_iocs(sample.context)
+        hints = hints_from(f_all, hits)
+        user = prompt("injection").format(context=context, content=body, static_hints="\n".join(hints))
+        try:
+            data = llm_json(SYSTEM, user)
+            res.llm_calls = 1
+            dim, data = parse_llm_dimension(data, "andy", static_floor=static_score if structural else 0.0)
+            res.notes.append(f"intended agent action: {data.get('intended_agent_action', '')}")
+            res.notes.append(f"summary: {data.get('summary', '')}")
+            if data.get("techniques"):
+                res.notes.append(f"techniques: {data['techniques']}")
+        except Exception as e:  # noqa: BLE001
+            log.warning("delivery LLM failed: %s", e)
+            dim = Dimension(verdict=verdict_from_score(static_score), score=round(static_score, 3))
+            res.notes.append(f"model unavailable ({type(e).__name__}); heuristic verdict only")
+        dim.findings.extend(f_all[:15])
+        # strong static signals (hidden text, forged tool calls) should not be talked down to clean
+        if structural and static_score >= 0.7 and dim.score < 0.5:
+            dim.score = 0.5
+            dim.verdict = verdict_from_score(dim.score)
+        res.delivery = dim
+        return res