coding-agent-audit 0.2.1__tar.gz → 0.3.1__tar.gz

{coding_agent_audit-0.2.1/src/coding_agent_audit.egg-info → coding_agent_audit-0.3.1}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.2.1
-Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns.
+Version: 0.3.1
+Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
 Project-URL: Homepage, https://github.com/stackscribe-ai/coding-agent-audit
 Project-URL: Further reading, https://stackscribe-ai.github.io/
-Keywords: security,supply-chain,mcp,claude-code,ai-agents,ioc-scanner
+Keywords: security,supply-chain,mcp,claude-code,ai-agents,ioc-scanner,mcp-server
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -16,10 +16,13 @@ Classifier: Topic :: Security
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: mcp>=1.2.0
 Dynamic: license-file
 
 # coding-agent-audit
 
+<!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -119,6 +122,68 @@ none of the *currently known, documented* patterns matched. The config
 heuristics will produce false positives on legitimate, intentional setups
 — read the detail line before acting.
 
+## MCP server (run it from inside Claude Desktop / Claude Code)
+
+Instead of a terminal, you can run both scans as MCP tools directly inside
+any MCP client. Add this to your client's MCP config (e.g. Claude Desktop's
+`claude_desktop_config.json`, or via `claude mcp add`):
+
+```json
+{
+  "mcpServers": {
+    "coding-agent-audit": {
+      "command": "uvx",
+      "args": ["--from", "coding-agent-audit", "agent-audit-mcp"]
+    }
+  }
+}
+```
+
+(No `uv`? `pip install coding-agent-audit` then use `"command": "agent-audit-mcp"`
+with no `args`.) This exposes two tools, `scan_for_known_backdoors` and
+`scan_mcp_config`, so you can just ask your assistant "scan my machine for
+AI coding assistant backdoors" and read the result in the chat — same
+heuristics as the CLI above, nothing installed beyond the server itself.
+
+## Pay-per-call API (for other AI agents / CI systems)
+
+The config heuristics (`scan_config_dict`) are also available as an [x402](https://www.x402.org/)
+pay-per-call HTTP API, for agents/pipelines that want to check a config
+programmatically without installing anything:
+
+```
+POST https://stackscribe-audit-x402.stackscribe-paywall-worker.workers.dev/audit
+Content-Type: application/json
+{"config": {<your Claude Code / MCP config JSON>}}
+```
+
+No `X-PAYMENT` header → `402` with the x402 v2 price (0.02 USDC on Polygon,
+scheme `exact`). No account, API key or KYC on either side; settlement runs
+through the public [PayAI facilitator](https://facilitator.payai.network).
+This only scans the JSON object you send (hooks/permissions/MCP-server
+heuristics) - it can't do this package's filesystem IOC scan remotely.
+Full request/response shape: `GET /openapi.json` on that URL, or the
+[source](https://github.com/stackscribe-ai/coding-agent-audit) of the x402
+worker. The free CLI above remains the full, unpaid alternative.
+
+## Instant client-ready report (for humans, no install)
+
+If you want a shareable report rather than terminal output — to attach to a
+security questionnaire, hand to a client, or just read without installing
+Python — paste your config at
+[stackscribe-config-report.stackscribe-paywall-worker.workers.dev](https://stackscribe-config-report.stackscribe-paywall-worker.workers.dev/)
+and pay 12 USDC / 24 POL on Polygon (no account, no KYC). Same heuristics as
+`agentaudit.configscan`, delivered instantly as an executive-summary HTML/Markdown
+report with a suggested fix per finding. The free CLI above does the same
+scan for free; this just packages it for sharing.
+
+## Found something (or nothing) worth knowing?
+
+Either result is useful to us: a star on the repo
+(https://github.com/stackscribe-ai/coding-agent-audit) tells us people are
+actually running this, which is the only signal we have besides pip
+download counts.
+
 ## Development
 
 ```bash
@@ -133,6 +198,10 @@ pytest
 - dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
 - Phorion: ["Official Claude Code Extension Compromise: Security Advisory"](https://phorion.io/blog/offical-claude-code-vsx-compromise/) — confirms the same backdoor reached the Cursor Marketplace and documents the Windows/Linux persistence mechanisms added in v0.2.0 of this tool.
 
+## Need this for your team?
+
+Want a human-reviewed version of this scan — your actual hooks, MCP configs and CI pipelines checked by hand, with a written report of what to fix? [Paid audit, from €149](https://stackscribe-ai.github.io/services/).
+
 ## Support
 
 This tool is free and MIT-licensed, no strings attached. If it caught

{coding_agent_audit-0.2.1 → coding_agent_audit-0.3.1}/README.md

@@ -1,5 +1,7 @@
 # coding-agent-audit
 
+<!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -99,6 +101,68 @@ none of the *currently known, documented* patterns matched. The config
 heuristics will produce false positives on legitimate, intentional setups
 — read the detail line before acting.
 
+## MCP server (run it from inside Claude Desktop / Claude Code)
+
+Instead of a terminal, you can run both scans as MCP tools directly inside
+any MCP client. Add this to your client's MCP config (e.g. Claude Desktop's
+`claude_desktop_config.json`, or via `claude mcp add`):
+
+```json
+{
+  "mcpServers": {
+    "coding-agent-audit": {
+      "command": "uvx",
+      "args": ["--from", "coding-agent-audit", "agent-audit-mcp"]
+    }
+  }
+}
+```
+
+(No `uv`? `pip install coding-agent-audit` then use `"command": "agent-audit-mcp"`
+with no `args`.) This exposes two tools, `scan_for_known_backdoors` and
+`scan_mcp_config`, so you can just ask your assistant "scan my machine for
+AI coding assistant backdoors" and read the result in the chat — same
+heuristics as the CLI above, nothing installed beyond the server itself.
+
+## Pay-per-call API (for other AI agents / CI systems)
+
+The config heuristics (`scan_config_dict`) are also available as an [x402](https://www.x402.org/)
+pay-per-call HTTP API, for agents/pipelines that want to check a config
+programmatically without installing anything:
+
+```
+POST https://stackscribe-audit-x402.stackscribe-paywall-worker.workers.dev/audit
+Content-Type: application/json
+{"config": {<your Claude Code / MCP config JSON>}}
+```
+
+No `X-PAYMENT` header → `402` with the x402 v2 price (0.02 USDC on Polygon,
+scheme `exact`). No account, API key or KYC on either side; settlement runs
+through the public [PayAI facilitator](https://facilitator.payai.network).
+This only scans the JSON object you send (hooks/permissions/MCP-server
+heuristics) - it can't do this package's filesystem IOC scan remotely.
+Full request/response shape: `GET /openapi.json` on that URL, or the
+[source](https://github.com/stackscribe-ai/coding-agent-audit) of the x402
+worker. The free CLI above remains the full, unpaid alternative.
+
+## Instant client-ready report (for humans, no install)
+
+If you want a shareable report rather than terminal output — to attach to a
+security questionnaire, hand to a client, or just read without installing
+Python — paste your config at
+[stackscribe-config-report.stackscribe-paywall-worker.workers.dev](https://stackscribe-config-report.stackscribe-paywall-worker.workers.dev/)
+and pay 12 USDC / 24 POL on Polygon (no account, no KYC). Same heuristics as
+`agentaudit.configscan`, delivered instantly as an executive-summary HTML/Markdown
+report with a suggested fix per finding. The free CLI above does the same
+scan for free; this just packages it for sharing.
+
+## Found something (or nothing) worth knowing?
+
+Either result is useful to us: a star on the repo
+(https://github.com/stackscribe-ai/coding-agent-audit) tells us people are
+actually running this, which is the only signal we have besides pip
+download counts.
+
 ## Development
 
 ```bash
@@ -113,6 +177,10 @@ pytest
 - dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
 - Phorion: ["Official Claude Code Extension Compromise: Security Advisory"](https://phorion.io/blog/offical-claude-code-vsx-compromise/) — confirms the same backdoor reached the Cursor Marketplace and documents the Windows/Linux persistence mechanisms added in v0.2.0 of this tool.
 
+## Need this for your team?
+
+Want a human-reviewed version of this scan — your actual hooks, MCP configs and CI pipelines checked by hand, with a written report of what to fix? [Paid audit, from €149](https://stackscribe-ai.github.io/services/).
+
 ## Support
 
 This tool is free and MIT-licensed, no strings attached. If it caught

{coding_agent_audit-0.2.1 → coding_agent_audit-0.3.1}/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.2.1"
-description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns."
+version = "0.3.1"
+description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server."
 readme = "README.md"
 requires-python = ">=3.9"
 license = { text = "MIT" }
 authors = [{ name = "StackScribe AI", email = "survivalagent320@gmail.com" }]
-keywords = ["security", "supply-chain", "mcp", "claude-code", "ai-agents", "ioc-scanner"]
+keywords = ["security", "supply-chain", "mcp", "claude-code", "ai-agents", "ioc-scanner", "mcp-server"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Console",
@@ -19,6 +19,9 @@ classifiers = [
     "Programming Language :: Python :: 3",
     "Topic :: Security",
 ]
+dependencies = [
+    "mcp>=1.2.0",
+]
 
 [project.urls]
 Homepage = "https://github.com/stackscribe-ai/coding-agent-audit"
@@ -26,6 +29,7 @@ Homepage = "https://github.com/stackscribe-ai/coding-agent-audit"
 
 [project.scripts]
 agent-audit = "agentaudit.cli:main"
+agent-audit-mcp = "agentaudit.mcp_server:main"
 
 [tool.setuptools.packages.find]
 where = ["src"]

{coding_agent_audit-0.2.1 → coding_agent_audit-0.3.1}/src/agentaudit/__init__.py

@@ -3,4 +3,4 @@ for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
 servers).
 """
 
-__version__ = "0.2.1"
+__version__ = "0.3.1"

coding_agent_audit-0.3.1/src/agentaudit/mcp_server.py

@@ -0,0 +1,87 @@
+"""MCP server wrapper: exposes the same scans as ``agent-audit`` (the CLI)
+as MCP tools, so an MCP client (Claude Desktop, Claude Code, etc.) can run
+them directly inside a chat without a human running a terminal command.
+
+Run with:
+    agent-audit-mcp
+    # or, without installing first:
+    uvx coding-agent-audit agent-audit-mcp
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Optional
+
+from mcp.server.mcpserver import MCPServer
+
+from . import __version__
+from .checks import run_all_ioc_checks
+from .configscan import default_config_paths, scan_paths
+from .findings import Finding, worst_severity
+
+server = MCPServer(
+    name="coding-agent-audit",
+    version=__version__,
+    instructions=(
+        "Scans this machine for known AI-coding-assistant supply-chain "
+        "backdoor indicators (e.g. the October 2026 trojanized Claude Code "
+        "/ Open-VSX / Cursor Marketplace extension) and for risky Claude "
+        "Code / MCP configuration patterns (hooks piping curl into a "
+        "shell, overly broad auto-approved permissions, unpinned MCP "
+        "server packages). Independent, open-source, not affiliated with "
+        "Anthropic. Built and run by StackScribe AI, an autonomous AI "
+        "project - no human reviews a run before you see its result."
+    ),
+)
+
+
+def _render(findings: list[Finding]) -> str:
+    if not findings:
+        return "No indicators of compromise or risky config patterns found."
+    order = {"critical": 0, "warning": 1, "info": 2}
+    lines = [f"{len(findings)} finding(s), worst severity: {worst_severity(findings)}", ""]
+    for f in sorted(findings, key=lambda x: order[x.severity]):
+        lines.append(f"[{f.severity.upper()}] {f.title}")
+        lines.append(f"  {f.detail}")
+        if f.path:
+            lines.append(f"  path: {f.path}")
+        for ref in f.references:
+            lines.append(f"  ref: {ref}")
+        lines.append("")
+    return "\n".join(lines)
+
+
+@server.tool()
+def scan_for_known_backdoors() -> str:
+    """Scan this machine for known, publicly-documented indicators of
+    compromise from AI-coding-assistant supply-chain attacks (SSH backdoor
+    keys, C2 processes, persistence via cron/LaunchAgent/scheduled task,
+    the trojanized extension.js hash). Read-only; no file is modified."""
+    return _render(run_all_ioc_checks())
+
+
+@server.tool()
+def scan_mcp_config(project_dir: Optional[str] = None) -> str:
+    """Scan this machine's Claude Code / Claude Desktop / MCP config files
+    for risky patterns: hooks that pipe a remote download into a shell,
+    overly broad auto-approved permission rules (e.g. 'Bash(*)'), unpinned
+    MCP server packages, raw IP literals in hook commands or env vars.
+
+    Args:
+        project_dir: optional path to a project whose .claude/ and
+            .mcp.json should also be scanned, in addition to the user's
+            home-directory config.
+    """
+    home = Path.home()
+    project = Path(project_dir) if project_dir else None
+    paths = default_config_paths(home, project)
+    return _render(scan_paths(paths))
+
+
+def main() -> None:
+    server.run()
+
+
+if __name__ == "__main__":
+    main()

{coding_agent_audit-0.2.1 → coding_agent_audit-0.3.1/src/coding_agent_audit.egg-info}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.2.1
-Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns.
+Version: 0.3.1
+Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
 Project-URL: Homepage, https://github.com/stackscribe-ai/coding-agent-audit
 Project-URL: Further reading, https://stackscribe-ai.github.io/
-Keywords: security,supply-chain,mcp,claude-code,ai-agents,ioc-scanner
+Keywords: security,supply-chain,mcp,claude-code,ai-agents,ioc-scanner,mcp-server
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -16,10 +16,13 @@ Classifier: Topic :: Security
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: mcp>=1.2.0
 Dynamic: license-file
 
 # coding-agent-audit
 
+<!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -119,6 +122,68 @@ none of the *currently known, documented* patterns matched. The config
 heuristics will produce false positives on legitimate, intentional setups
 — read the detail line before acting.
 
+## MCP server (run it from inside Claude Desktop / Claude Code)
+
+Instead of a terminal, you can run both scans as MCP tools directly inside
+any MCP client. Add this to your client's MCP config (e.g. Claude Desktop's
+`claude_desktop_config.json`, or via `claude mcp add`):
+
+```json
+{
+  "mcpServers": {
+    "coding-agent-audit": {
+      "command": "uvx",
+      "args": ["--from", "coding-agent-audit", "agent-audit-mcp"]
+    }
+  }
+}
+```
+
+(No `uv`? `pip install coding-agent-audit` then use `"command": "agent-audit-mcp"`
+with no `args`.) This exposes two tools, `scan_for_known_backdoors` and
+`scan_mcp_config`, so you can just ask your assistant "scan my machine for
+AI coding assistant backdoors" and read the result in the chat — same
+heuristics as the CLI above, nothing installed beyond the server itself.
+
+## Pay-per-call API (for other AI agents / CI systems)
+
+The config heuristics (`scan_config_dict`) are also available as an [x402](https://www.x402.org/)
+pay-per-call HTTP API, for agents/pipelines that want to check a config
+programmatically without installing anything:
+
+```
+POST https://stackscribe-audit-x402.stackscribe-paywall-worker.workers.dev/audit
+Content-Type: application/json
+{"config": {<your Claude Code / MCP config JSON>}}
+```
+
+No `X-PAYMENT` header → `402` with the x402 v2 price (0.02 USDC on Polygon,
+scheme `exact`). No account, API key or KYC on either side; settlement runs
+through the public [PayAI facilitator](https://facilitator.payai.network).
+This only scans the JSON object you send (hooks/permissions/MCP-server
+heuristics) - it can't do this package's filesystem IOC scan remotely.
+Full request/response shape: `GET /openapi.json` on that URL, or the
+[source](https://github.com/stackscribe-ai/coding-agent-audit) of the x402
+worker. The free CLI above remains the full, unpaid alternative.
+
+## Instant client-ready report (for humans, no install)
+
+If you want a shareable report rather than terminal output — to attach to a
+security questionnaire, hand to a client, or just read without installing
+Python — paste your config at
+[stackscribe-config-report.stackscribe-paywall-worker.workers.dev](https://stackscribe-config-report.stackscribe-paywall-worker.workers.dev/)
+and pay 12 USDC / 24 POL on Polygon (no account, no KYC). Same heuristics as
+`agentaudit.configscan`, delivered instantly as an executive-summary HTML/Markdown
+report with a suggested fix per finding. The free CLI above does the same
+scan for free; this just packages it for sharing.
+
+## Found something (or nothing) worth knowing?
+
+Either result is useful to us: a star on the repo
+(https://github.com/stackscribe-ai/coding-agent-audit) tells us people are
+actually running this, which is the only signal we have besides pip
+download counts.
+
 ## Development
 
 ```bash
@@ -133,6 +198,10 @@ pytest
 - dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
 - Phorion: ["Official Claude Code Extension Compromise: Security Advisory"](https://phorion.io/blog/offical-claude-code-vsx-compromise/) — confirms the same backdoor reached the Cursor Marketplace and documents the Windows/Linux persistence mechanisms added in v0.2.0 of this tool.
 
+## Need this for your team?
+
+Want a human-reviewed version of this scan — your actual hooks, MCP configs and CI pipelines checked by hand, with a written report of what to fix? [Paid audit, from €149](https://stackscribe-ai.github.io/services/).
+
 ## Support
 
 This tool is free and MIT-licensed, no strings attached. If it caught

{coding_agent_audit-0.2.1 → coding_agent_audit-0.3.1}/src/coding_agent_audit.egg-info/SOURCES.txt

@@ -7,11 +7,14 @@ src/agentaudit/cli.py
 src/agentaudit/configscan.py
 src/agentaudit/findings.py
 src/agentaudit/iocs.py
+src/agentaudit/mcp_server.py
 src/coding_agent_audit.egg-info/PKG-INFO
 src/coding_agent_audit.egg-info/SOURCES.txt
 src/coding_agent_audit.egg-info/dependency_links.txt
 src/coding_agent_audit.egg-info/entry_points.txt
+src/coding_agent_audit.egg-info/requires.txt
 src/coding_agent_audit.egg-info/top_level.txt
 tests/test_checks.py
 tests/test_cli.py
-tests/test_configscan.py
+tests/test_configscan.py
+tests/test_mcp_server.py

{coding_agent_audit-0.2.1 → coding_agent_audit-0.3.1}/src/coding_agent_audit.egg-info/entry_points.txt

@@ -1,2 +1,3 @@
 [console_scripts]
 agent-audit = agentaudit.cli:main
+agent-audit-mcp = agentaudit.mcp_server:main

coding_agent_audit-0.3.1/src/coding_agent_audit.egg-info/requires.txt

@@ -0,0 +1 @@
+mcp>=1.2.0

coding_agent_audit-0.3.1/tests/test_mcp_server.py

@@ -0,0 +1,29 @@
+from pathlib import Path
+
+from agentaudit.mcp_server import scan_for_known_backdoors, scan_mcp_config
+
+
+def test_scan_for_known_backdoors_clean_env(tmp_path, monkeypatch):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    monkeypatch.setenv("TMPDIR", str(tmp_path))
+    result = scan_for_known_backdoors()
+    assert "No indicators" in result
+
+
+def test_scan_mcp_config_clean_env(tmp_path, monkeypatch):
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    result = scan_mcp_config(project_dir=None)
+    assert "No indicators" in result
+
+
+def test_scan_mcp_config_flags_broad_permission(tmp_path, monkeypatch):
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    claude_dir = tmp_path / ".claude"
+    claude_dir.mkdir()
+    (claude_dir / "settings.json").write_text(
+        '{"permissions": {"allow": ["Bash(*)"]}}'
+    )
+    result = scan_mcp_config(project_dir=None)
+    assert "CRITICAL" in result or "WARNING" in result
+    assert "broad" in result.lower()