coding-agent-audit 0.10.0__tar.gz → 0.11.0__tar.gz

{coding_agent_audit-0.10.0/src/coding_agent_audit.egg-info → coding_agent_audit-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.10.0
+Version: 0.11.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -183,6 +183,16 @@ next `npm install` / `pip install` ("slopsquatting"). Network errors are
 treated as inconclusive, not as a finding, so a flaky connection can't
 produce a false positive.
 
+**MCP phantom-package scan** (`scan_mcp_phantom_packages`, also opt-in via
+`--check-deps`) — the same registry-lookup idea, applied to the MCP server
+commands themselves: any `npx`/`uvx`/`pipx run` invocation in a scanned
+config is checked against npm/PyPI. This is the "MCPhantom" pattern flagged
+by Glow Labs in November 2026: a coding agent fills in a plausible but
+nonexistent MCP server package name from training data (or copies one from
+a long-archived tutorial whose package was since renamed/unpublished), and
+nothing stops an attacker from registering that exact name and having it
+run as the MCP server next time the config loads.
+
 New incidents can be added to `iocs.py` as data, without touching the
 check logic.
 

{coding_agent_audit-0.10.0 → coding_agent_audit-0.11.0}/README.md

@@ -162,6 +162,16 @@ next `npm install` / `pip install` ("slopsquatting"). Network errors are
 treated as inconclusive, not as a finding, so a flaky connection can't
 produce a false positive.
 
+**MCP phantom-package scan** (`scan_mcp_phantom_packages`, also opt-in via
+`--check-deps`) — the same registry-lookup idea, applied to the MCP server
+commands themselves: any `npx`/`uvx`/`pipx run` invocation in a scanned
+config is checked against npm/PyPI. This is the "MCPhantom" pattern flagged
+by Glow Labs in November 2026: a coding agent fills in a plausible but
+nonexistent MCP server package name from training data (or copies one from
+a long-archived tutorial whose package was since renamed/unpublished), and
+nothing stops an attacker from registering that exact name and having it
+run as the MCP server next time the config loads.
+
 New incidents can be added to `iocs.py` as data, without touching the
 check logic.
 

{coding_agent_audit-0.10.0 → coding_agent_audit-0.11.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.10.0"
+version = "0.11.0"
 description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server."
 readme = "README.md"
 requires-python = ">=3.9"

{coding_agent_audit-0.10.0 → coding_agent_audit-0.11.0}/src/agentaudit/__init__.py

@@ -3,4 +3,4 @@ for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
 servers).
 """
 
-__version__ = "0.10.0"
+__version__ = "0.11.0"

{coding_agent_audit-0.10.0 → coding_agent_audit-0.11.0}/src/agentaudit/cli.py

@@ -7,7 +7,12 @@ from pathlib import Path
 
 from . import __version__
 from .checks import run_all_ioc_checks
-from .configscan import default_config_paths, scan_paths, scan_tool_descriptions
+from .configscan import (
+    default_config_paths,
+    scan_paths,
+    scan_paths_for_phantom_mcp_packages,
+    scan_tool_descriptions,
+)
 from .findings import Finding, worst_severity
 from .phantomdeps import check_phantom_dependencies
 
@@ -65,10 +70,12 @@ def build_parser() -> argparse.ArgumentParser:
         "--check-deps",
         action="store_true",
         help=(
-            "with --project, also check package.json/requirements.txt/"
-            "pyproject.toml dependencies against npm/PyPI and flag any "
-            "that don't exist (possible AI-hallucinated/slopsquattable "
-            "package name). Makes read-only network requests."
+            "check package names against npm/PyPI and flag any that don't "
+            "exist (possible AI-hallucinated/slopsquattable or 'MCPhantom' "
+            "package name): with --project, also covers package.json/"
+            "requirements.txt/pyproject.toml; always covers npx/uvx/pipx "
+            "MCP server commands in the scanned config files. Makes "
+            "read-only network requests."
         ),
     )
     parser.add_argument(
@@ -95,17 +102,19 @@ def main(argv: list[str] | None = None) -> int:
     parser = build_parser()
     args = parser.parse_args(argv)
 
+    config_paths = default_config_paths(Path.home(), args.project)
+
     findings: list[Finding] = []
     if not args.skip_ioc:
         project_dirs = [args.project] if args.project is not None else []
         findings += run_all_ioc_checks(project_dirs=project_dirs)
     if not args.skip_config:
-        home = Path.home()
-        paths = default_config_paths(home, args.project)
-        findings += scan_paths(paths)
+        findings += scan_paths(config_paths)
 
-    if args.check_deps and args.project is not None:
-        findings += check_phantom_dependencies(args.project)
+    if args.check_deps:
+        if args.project is not None:
+            findings += check_phantom_dependencies(args.project)
+        findings += scan_paths_for_phantom_mcp_packages(config_paths)
 
     if args.tools_json is not None:
         try:

{coding_agent_audit-0.10.0 → coding_agent_audit-0.11.0}/src/agentaudit/configscan.py

@@ -14,6 +14,7 @@ import re
 from pathlib import Path
 from typing import Iterable
 
+from . import phantomdeps
 from .findings import Finding
 
 # Commands/strings that show up in real exfiltration or persistence attempts.
@@ -287,6 +288,83 @@ def scan_mcp_servers(config: dict, source_path: str) -> list[Finding]:
     return findings
 
 
+_MCP_RUNNER_RE = re.compile(r"\b(npx|uvx|pipx\s+run)\b", re.IGNORECASE)
+
+
+def _extract_mcp_package_spec(full_cmdline: str) -> tuple[str, str] | None:
+    """Return ``(ecosystem, package_name)`` for the package a `npx`/`uvx`/
+    `pipx run` MCP server command would fetch, or ``None`` if no such
+    runner (or no package argument after it) is found."""
+    match = _MCP_RUNNER_RE.search(full_cmdline)
+    if not match:
+        return None
+    ecosystem = "npm" if match.group(1).lower() == "npx" else "pypi"
+    for token in full_cmdline[match.end():].split():
+        if token.startswith("-"):
+            continue
+        if token.startswith("@"):
+            # scoped npm package, optionally pinned: @scope/name[@version]
+            scoped, _, _version = token[1:].partition("@")
+            return ecosystem, f"@{scoped}"
+        name, _, _version = token.partition("@")
+        name = name.split("==", 1)[0]
+        return ecosystem, name
+    return None
+
+
+def scan_mcp_phantom_packages(config: dict, source_path: str) -> list[Finding]:
+    """Flag MCP servers launched via `npx`/`uvx`/`pipx run` that point at a
+    package name which doesn't exist on the registry - the "MCPhantom"
+    pattern (Glow Labs research, Nov 2026): coding agents fill in a
+    plausible-sounding MCP server name from training data, or copy one
+    from a long-archived tutorial/repo whose package was since renamed or
+    unpublished. Either way, nothing stops an attacker from registering
+    that exact name and having it run with the user's own permissions on
+    the very next launch. Makes read-only registry lookups; network
+    errors are treated as "unknown", never as "phantom" (see phantomdeps).
+    """
+    servers = config.get("mcpServers") or config.get("mcp_servers")
+    if not isinstance(servers, dict):
+        return []
+    findings: list[Finding] = []
+    for server_name, server_cfg in servers.items():
+        if not isinstance(server_cfg, dict):
+            continue
+        command = server_cfg.get("command", "")
+        args = server_cfg.get("args") or []
+        full_cmdline = " ".join([command, *[str(a) for a in args]])
+        spec = _extract_mcp_package_spec(full_cmdline)
+        if spec is None:
+            continue
+        ecosystem, name = spec
+        if ecosystem == "npm":
+            if not phantomdeps._is_plausible_npm_name(name):
+                continue
+            exists = phantomdeps.check_npm_package_exists(name)
+        else:
+            exists = phantomdeps.check_pypi_package_exists(name)
+        if exists is not False:
+            continue
+        findings.append(
+            Finding(
+                check_id="mcp-phantom-package",
+                severity="critical",
+                title=f"MCP server '{server_name}' launches a package that doesn't exist ('{name}')",
+                detail=(
+                    f"Command '{full_cmdline}' fetches '{name}' from "
+                    f"{'npm' if ecosystem == 'npm' else 'PyPI'} on every launch, but no "
+                    f"package by that name currently exists there (the "
+                    f"'MCPhantom' pattern: a hallucinated or long-deprecated "
+                    f"MCP server name). Anyone can register it and have "
+                    f"their code run as this MCP server, with no update or "
+                    f"confirmation step in between."
+                ),
+                path=source_path,
+            )
+        )
+    return findings
+
+
 def scan_permissions(config: dict, source_path: str) -> list[Finding]:
     permissions = config.get("permissions")
     if not isinstance(permissions, dict):
@@ -429,3 +507,20 @@ def scan_paths(paths: Iterable[Path]) -> list[Finding]:
         if isinstance(config, dict):
             findings += scan_config_dict(config, str(path))
     return findings
+
+
+def scan_paths_for_phantom_mcp_packages(paths: Iterable[Path]) -> list[Finding]:
+    """Like `scan_paths`, but only runs `scan_mcp_phantom_packages` (the
+    network-dependent check), for callers that opt in with `--check-deps`.
+    """
+    findings: list[Finding] = []
+    for path in paths:
+        if not path.is_file():
+            continue
+        try:
+            config = json.loads(path.read_text())
+        except (OSError, json.JSONDecodeError):
+            continue
+        if isinstance(config, dict):
+            findings += scan_mcp_phantom_packages(config, str(path))
+    return findings

{coding_agent_audit-0.10.0 → coding_agent_audit-0.11.0}/src/agentaudit/mcp_server.py

@@ -18,7 +18,7 @@ from mcp.types import ToolAnnotations
 
 from . import __version__
 from .checks import run_all_ioc_checks
-from .configscan import default_config_paths, scan_paths
+from .configscan import default_config_paths, scan_paths, scan_paths_for_phantom_mcp_packages
 from .findings import Finding, worst_severity
 from .phantomdeps import check_phantom_dependencies
 
@@ -113,6 +113,30 @@ def scan_phantom_dependencies(project_dir: str) -> str:
     return _render(check_phantom_dependencies(Path(project_dir)))
 
 
+@server.tool(annotations=_NETWORK_READ_ONLY)
+def scan_mcp_phantom_packages(project_dir: Optional[str] = None) -> str:
+    """Check the `npx`/`uvx`/`pipx run` commands in this machine's (and
+    optionally a project's) MCP server config against the npm/PyPI
+    registries, and flag any package name that doesn't actually exist
+    there - the "MCPhantom" pattern (Glow Labs, Nov 2026): a coding agent
+    fills in a plausible-sounding MCP server name from training data, or
+    copies one from a long-archived tutorial whose package was since
+    renamed or unpublished. An attacker can register that exact name and
+    have it run as the MCP server, with the user's own permissions, the
+    next time the config is loaded. Read-only HTTP lookups only; this
+    never connects to or executes the MCP server itself.
+
+    Args:
+        project_dir: optional path to a project whose .claude/ and
+            .mcp.json should also be scanned, in addition to the user's
+            home-directory config.
+    """
+    home = Path.home()
+    project = Path(project_dir) if project_dir else None
+    paths = default_config_paths(home, project)
+    return _render(scan_paths_for_phantom_mcp_packages(paths))
+
+
 @server.tool(annotations=_LOCAL_READ_ONLY)
 def scan_tool_descriptions(tools: list[dict]) -> str:
     """Scan a list of MCP tool definitions (the 'tools/list' response an

{coding_agent_audit-0.10.0 → coding_agent_audit-0.11.0/src/coding_agent_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.10.0
+Version: 0.11.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -183,6 +183,16 @@ next `npm install` / `pip install` ("slopsquatting"). Network errors are
 treated as inconclusive, not as a finding, so a flaky connection can't
 produce a false positive.
 
+**MCP phantom-package scan** (`scan_mcp_phantom_packages`, also opt-in via
+`--check-deps`) — the same registry-lookup idea, applied to the MCP server
+commands themselves: any `npx`/`uvx`/`pipx run` invocation in a scanned
+config is checked against npm/PyPI. This is the "MCPhantom" pattern flagged
+by Glow Labs in November 2026: a coding agent fills in a plausible but
+nonexistent MCP server package name from training data (or copies one from
+a long-archived tutorial whose package was since renamed/unpublished), and
+nothing stops an attacker from registering that exact name and having it
+run as the MCP server next time the config loads.
+
 New incidents can be added to `iocs.py` as data, without touching the
 check logic.
 

{coding_agent_audit-0.10.0 → coding_agent_audit-0.11.0}/tests/test_configscan.py

@@ -1,4 +1,5 @@
 from pathlib import Path
+from unittest.mock import patch
 
 from agentaudit.configscan import (
     default_config_paths,
@@ -6,8 +7,10 @@ from agentaudit.configscan import (
     scan_hooks,
     scan_known_cve_packages,
     scan_lethal_trifecta,
+    scan_mcp_phantom_packages,
     scan_mcp_servers,
     scan_paths,
+    scan_paths_for_phantom_mcp_packages,
     scan_permissions,
     scan_tool_descriptions,
 )
@@ -155,6 +158,96 @@ def test_scan_known_cve_packages_not_a_dict():
     assert scan_known_cve_packages({"mcpServers": "nope"}, "src") == []
 
 
+def test_scan_mcp_phantom_packages_flags_nonexistent_npm():
+    config = {
+        "mcpServers": {
+            "ghost": {"command": "npx", "args": ["-y", "mcp-server-totally-made-up-9x7z"]}
+        }
+    }
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=False):
+        findings = scan_mcp_phantom_packages(config, "src")
+    assert len(findings) == 1
+    assert findings[0].check_id == "mcp-phantom-package"
+    assert findings[0].severity == "critical"
+    assert "mcp-server-totally-made-up-9x7z" in findings[0].title
+
+
+def test_scan_mcp_phantom_packages_flags_nonexistent_pypi():
+    config = {
+        "mcpServers": {"ghost": {"command": "uvx", "args": ["mcp-server-ghost-xyz"]}}
+    }
+    with patch("agentaudit.phantomdeps.check_pypi_package_exists", return_value=False):
+        findings = scan_mcp_phantom_packages(config, "src")
+    assert len(findings) == 1
+    assert "mcp-server-ghost-xyz" in findings[0].title
+
+
+def test_scan_mcp_phantom_packages_real_package_not_flagged():
+    config = {
+        "mcpServers": {
+            "fs": {"command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem"]}
+        }
+    }
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=True):
+        findings = scan_mcp_phantom_packages(config, "src")
+    assert findings == []
+
+
+def test_scan_mcp_phantom_packages_network_unknown_not_flagged():
+    config = {"mcpServers": {"ghost": {"command": "npx", "args": ["-y", "some-pkg"]}}}
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=None):
+        findings = scan_mcp_phantom_packages(config, "src")
+    assert findings == []
+
+
+def test_scan_mcp_phantom_packages_versioned_pin_strips_version():
+    config = {
+        "mcpServers": {
+            "ghost": {"command": "npx", "args": ["-y", "mcp-server-ghost-xyz@1.2.3"]}
+        }
+    }
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=False) as mock_check:
+        findings = scan_mcp_phantom_packages(config, "src")
+    mock_check.assert_called_once_with("mcp-server-ghost-xyz")
+    assert len(findings) == 1
+
+
+def test_scan_mcp_phantom_packages_scoped_versioned_pin():
+    config = {
+        "mcpServers": {
+            "ghost": {"command": "npx", "args": ["-y", "@scope/ghost-pkg@2.0.0"]}
+        }
+    }
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=False) as mock_check:
+        findings = scan_mcp_phantom_packages(config, "src")
+    mock_check.assert_called_once_with("@scope/ghost-pkg")
+    assert len(findings) == 1
+
+
+def test_scan_mcp_phantom_packages_no_runner_not_flagged():
+    config = {"mcpServers": {"local": {"command": "/usr/local/bin/my-server"}}}
+    assert scan_mcp_phantom_packages(config, "src") == []
+
+
+def test_scan_mcp_phantom_packages_not_a_dict():
+    assert scan_mcp_phantom_packages({"mcpServers": "nope"}, "src") == []
+
+
+def test_scan_paths_for_phantom_mcp_packages(tmp_path: Path):
+    config_path = tmp_path / ".mcp.json"
+    config_path.write_text(
+        '{"mcpServers": {"ghost": {"command": "npx", "args": ["-y", "mcp-ghost-xyz"]}}}'
+    )
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=False):
+        findings = scan_paths_for_phantom_mcp_packages([config_path])
+    assert len(findings) == 1
+    assert findings[0].check_id == "mcp-phantom-package"
+
+
+def test_scan_paths_for_phantom_mcp_packages_missing_file(tmp_path: Path):
+    assert scan_paths_for_phantom_mcp_packages([tmp_path / "missing.json"]) == []
+
+
 def test_scan_permissions_scoped_rule_ok():
     config = {"permissions": {"allow": ["Bash(git diff:*)", "Read(//workspace/**)"]}}
     assert scan_permissions(config, "src") == []