coding-agent-audit 0.5.0__tar.gz → 0.6.1__tar.gz

{coding_agent_audit-0.5.0/src/coding_agent_audit.egg-info → coding_agent_audit-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.5.0
+Version: 0.6.1
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -23,6 +23,8 @@ Dynamic: license-file
 
 <!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
 
+[![M8ven Score](https://m8ven.ai/badge/mcp/stackscribe-ai-coding-agent-audit-1xiuww?v=c2c77be885b345ce5ac975e42a68268d)](https://m8ven.ai/mcp/stackscribe-ai-coding-agent-audit-1xiuww?s=readme)
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -104,6 +106,12 @@ Cursor Marketplace Claude Code trojan:
   persistence task name
 - On Windows: the known SYSTEM scheduled task name, and the Startup-folder
   script dropped as a fallback when that task can't be created
+- A GitHub Copilot VS Code extension older than 1.1.29 (the version that
+  fixed the address-bar-spoofing half of **EMBRACE**, Forever Security's
+  Oct 2026 disclosure of embedded-browser flaws in Cursor, Copilot, Codex,
+  VS Code and Claude Desktop), plus a presence check that flags Codex/VS
+  Code (still unpatched at disclosure time) or Claude Desktop (patch status
+  unconfirmed) if installed, with mitigation guidance
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -221,7 +229,7 @@ scan for free; this just packages it for sharing.
 
 If your agent runtime supports the open `SKILL.md` standard (Claude Code,
 Cursor, and others), a packaged version of this scan is live on the
-[Agensi skill marketplace](https://www.agensi.io/skills/coding-agent-security-audit)
+[Agensi skill marketplace](https://www.agensi.io/r/STACKSCRIBEAI?to=/skills/coding-agent-security-audit)
 as "coding agent security audit" (free) — source in
 [`agensi-skill/`](agensi-skill/). It's a zero-dependency, single-file port of
 the same checks below, meant to be loaded by an agent directly rather than
@@ -247,6 +255,7 @@ pytest
 - doublepulsar.com: ["Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
 - dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
 - Phorion: ["Official Claude Code Extension Compromise: Security Advisory"](https://phorion.io/blog/offical-claude-code-vsx-compromise/) — confirms the same backdoor reached the Cursor Marketplace and documents the Windows/Linux persistence mechanisms added in v0.2.0 of this tool.
+- Help Net Security: ["Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop"](https://www.helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities/) and The Register: ["Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched"](https://www.theregister.com/security/2026/10/29/researchers_find_bugs_in_5_ai_developer_tools_with_openai_and_microsoft_flaws_still_unpatched/5306508) — Forever Security's EMBRACE disclosure, added in v0.6.0 of this tool.
 
 ## Need this for your team?
 

{coding_agent_audit-0.5.0 → coding_agent_audit-0.6.1}/README.md

@@ -2,6 +2,8 @@
 
 <!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
 
+[![M8ven Score](https://m8ven.ai/badge/mcp/stackscribe-ai-coding-agent-audit-1xiuww?v=c2c77be885b345ce5ac975e42a68268d)](https://m8ven.ai/mcp/stackscribe-ai-coding-agent-audit-1xiuww?s=readme)
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -83,6 +85,12 @@ Cursor Marketplace Claude Code trojan:
   persistence task name
 - On Windows: the known SYSTEM scheduled task name, and the Startup-folder
   script dropped as a fallback when that task can't be created
+- A GitHub Copilot VS Code extension older than 1.1.29 (the version that
+  fixed the address-bar-spoofing half of **EMBRACE**, Forever Security's
+  Oct 2026 disclosure of embedded-browser flaws in Cursor, Copilot, Codex,
+  VS Code and Claude Desktop), plus a presence check that flags Codex/VS
+  Code (still unpatched at disclosure time) or Claude Desktop (patch status
+  unconfirmed) if installed, with mitigation guidance
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -200,7 +208,7 @@ scan for free; this just packages it for sharing.
 
 If your agent runtime supports the open `SKILL.md` standard (Claude Code,
 Cursor, and others), a packaged version of this scan is live on the
-[Agensi skill marketplace](https://www.agensi.io/skills/coding-agent-security-audit)
+[Agensi skill marketplace](https://www.agensi.io/r/STACKSCRIBEAI?to=/skills/coding-agent-security-audit)
 as "coding agent security audit" (free) — source in
 [`agensi-skill/`](agensi-skill/). It's a zero-dependency, single-file port of
 the same checks below, meant to be loaded by an agent directly rather than
@@ -226,6 +234,7 @@ pytest
 - doublepulsar.com: ["Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
 - dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
 - Phorion: ["Official Claude Code Extension Compromise: Security Advisory"](https://phorion.io/blog/offical-claude-code-vsx-compromise/) — confirms the same backdoor reached the Cursor Marketplace and documents the Windows/Linux persistence mechanisms added in v0.2.0 of this tool.
+- Help Net Security: ["Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop"](https://www.helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities/) and The Register: ["Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched"](https://www.theregister.com/security/2026/10/29/researchers_find_bugs_in_5_ai_developer_tools_with_openai_and_microsoft_flaws_still_unpatched/5306508) — Forever Security's EMBRACE disclosure, added in v0.6.0 of this tool.
 
 ## Need this for your team?
 

{coding_agent_audit-0.5.0 → coding_agent_audit-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.5.0"
+version = "0.6.1"
 description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server."
 readme = "README.md"
 requires-python = ">=3.9"

{coding_agent_audit-0.5.0 → coding_agent_audit-0.6.1}/src/agentaudit/__init__.py

@@ -3,4 +3,4 @@ for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
 servers).
 """
 
-__version__ = "0.5.0"
+__version__ = "0.6.1"

{coding_agent_audit-0.5.0 → coding_agent_audit-0.6.1}/src/agentaudit/checks.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import hashlib
 import os
 import platform
+import re
 import subprocess
 from pathlib import Path
 from typing import Iterable, Optional
@@ -17,6 +18,7 @@ from .findings import Finding
 from .iocs import INCIDENTS
 
 _IOC = INCIDENTS["openvsx-claude-code-2026-10"]
+_EMBRACE = INCIDENTS["embrace-embedded-browser-2026-10"]
 
 
 def check_ssh_authorized_keys(home: Path) -> list[Finding]:
@@ -290,6 +292,114 @@ def live_process_lines() -> list[str]:
     return result.stdout.splitlines()
 
 
+_EXTENSION_VERSION_RE = re.compile(r"^(.+)-(\d+(?:\.\d+)*)$")
+
+
+def _parse_extension_version(dirname: str) -> Optional[tuple[int, ...]]:
+    match = _EXTENSION_VERSION_RE.match(dirname)
+    if not match:
+        return None
+    try:
+        return tuple(int(part) for part in match.group(2).split("."))
+    except ValueError:
+        return None
+
+
+def check_embrace_copilot_version(scan_dirs: Iterable[Path]) -> list[Finding]:
+    """Flag a GitHub Copilot VS Code extension older than the version that
+    fixed the EMBRACE address-bar-spoofing flaw in its embedded browser."""
+    patched = _EMBRACE["copilot_patched_version"]
+    findings: list[Finding] = []
+    for base in scan_dirs:
+        if not base.is_dir():
+            continue
+        for entry in sorted(base.iterdir()):
+            if not entry.is_dir():
+                continue
+            name = entry.name.lower()
+            # The base "GitHub Copilot" extension only; copilot-chat ships
+            # its own, differently-numbered releases not covered by the fix
+            # version above.
+            if not name.startswith("github.copilot-") or name.startswith(
+                "github.copilot-chat-"
+            ):
+                continue
+            version = _parse_extension_version(entry.name)
+            if version is None or version >= patched:
+                continue
+            findings.append(
+                Finding(
+                    check_id="embrace-copilot-version",
+                    severity="warning",
+                    title=(
+                        "GitHub Copilot extension predates the EMBRACE "
+                        "address-bar-spoofing fix"
+                    ),
+                    detail=(
+                        f"'{entry}' is version {'.'.join(map(str, version))}, "
+                        f"older than {'.'.join(map(str, patched))} (released "
+                        f"2026-10-13), which fixed an address-bar-spoofing "
+                        f"flaw in Copilot's embedded browser (part of the "
+                        f"EMBRACE disclosure). Update the extension."
+                    ),
+                    path=str(entry),
+                    references=_EMBRACE["references"],
+                )
+            )
+    return findings
+
+
+def check_embrace_unpatched_tools(home: Path) -> list[Finding]:
+    """Flag the presence of AI coding tools named in the EMBRACE embedded-
+    browser disclosure, calling out the ones reported unpatched at
+    disclosure time."""
+    detected: list[str] = []
+    if (home / ".vscode").is_dir() or (home / ".vscode-server").is_dir():
+        detected.append("VS Code")
+    if (home / ".codex").is_dir():
+        detected.append("OpenAI Codex")
+    claude_desktop_dirs = [
+        home / "Library" / "Application Support" / "Claude",
+        home / ".config" / "Claude",
+        home / "AppData" / "Roaming" / "Claude",
+    ]
+    if any(p.is_dir() for p in claude_desktop_dirs):
+        detected.append("Claude Desktop")
+    if not detected:
+        return []
+
+    unpatched = [d for d in detected if d in _EMBRACE["unpatched_products"]]
+    unconfirmed = [d for d in detected if d not in _EMBRACE["unpatched_products"]]
+
+    parts = []
+    if unpatched:
+        parts.append(
+            f"{', '.join(unpatched)} detected on this machine and was still "
+            f"unpatched as of the EMBRACE disclosure referenced below."
+        )
+    if unconfirmed:
+        parts.append(
+            f"{', '.join(unconfirmed)} also detected; the researchers did "
+            f"not confirm a patch status for it at disclosure time."
+        )
+    parts.append(
+        "Until a fix ships: don't open links or HTML the assistant "
+        "generates from untrusted/external content inside the tool's "
+        "built-in browser or preview pane - a malicious page there can "
+        "read SSH keys, .env files and other local secrets, per the "
+        "EMBRACE write-up."
+    )
+    return [
+        Finding(
+            check_id="embrace-unpatched-tool-present",
+            severity="warning" if unpatched else "info",
+            title="AI coding tool named in the EMBRACE embedded-browser disclosure detected",
+            detail=" ".join(parts),
+            references=_EMBRACE["references"],
+        )
+    ]
+
+
 def run_all_ioc_checks(home: Optional[Path] = None) -> list[Finding]:
     """Run every IOC check against the real local machine."""
     home = home or Path.home()
@@ -300,6 +410,8 @@ def run_all_ioc_checks(home: Optional[Path] = None) -> list[Finding]:
     findings += check_marker_files(home)
     findings += check_tmp_tunnel_keys(tmp_dir)
     findings += check_extension_hashes(default_extension_scan_dirs(home))
+    findings += check_embrace_copilot_version(default_extension_scan_dirs(home))
+    findings += check_embrace_unpatched_tools(home)
     findings += check_c2_network_indicators(live_process_lines())
     findings += check_linux_cron_persistence(live_crontab_text())
     if platform.system() == "Darwin":

{coding_agent_audit-0.5.0 → coding_agent_audit-0.6.1}/src/agentaudit/iocs.py

@@ -50,5 +50,30 @@ INCIDENTS = {
         "windows_startup_relpath": (
             "Microsoft/Windows/Start Menu/Programs/Startup/sysmon.cmd"
         ),
-    }
+    },
+    "embrace-embedded-browser-2026-10": {
+        "name": "EMBRACE embedded-browser flaws in AI coding assistants (Forever Security, Oct 2026)",
+        "description": (
+            "Forever Security's EMBRACE research (published 2026-10-29) found "
+            "that five AI coding tools grant their embedded preview/agent "
+            "browser the same filesystem trust as the IDE itself: code "
+            "execution in Cursor, address-bar spoofing in GitHub Copilot, "
+            "and arbitrary local-file read (SSH keys, .env files, npm "
+            "tokens) in OpenAI Codex, VS Code and Claude Desktop, triggered "
+            "by a single HTML page opened in the tool's internal browser. "
+            "Cursor was fixed 2026-10-01 and GitHub Copilot in extension "
+            "version 1.1.29 (2026-10-13); Codex and VS Code were still "
+            "unpatched as of 2026-11-02, and Claude Desktop's status was "
+            "not confirmed by the researchers."
+        ),
+        "references": [
+            "https://www.helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities/",
+            "https://www.theregister.com/security/2026/10/29/researchers_find_bugs_in_5_ai_developer_tools_with_openai_and_microsoft_flaws_still_unpatched/5306508",
+            "https://hackread.com/embrace-flaws-ai-coding-tools-code-execution-theft/",
+        ],
+        # GitHub Copilot extension version that ships the address-bar-spoofing fix.
+        "copilot_patched_version": (1, 1, 29),
+        # As of the references above; re-check before treating as current.
+        "unpatched_products": ["OpenAI Codex", "VS Code"],
+    },
 }

{coding_agent_audit-0.5.0 → coding_agent_audit-0.6.1}/src/agentaudit/mcp_server.py

@@ -14,6 +14,7 @@ from pathlib import Path
 from typing import Optional
 
 from mcp.server.mcpserver import MCPServer
+from mcp.types import ToolAnnotations
 
 from . import __version__
 from .checks import run_all_ioc_checks
@@ -53,7 +54,22 @@ def _render(findings: list[Finding]) -> str:
     return "\n".join(lines)
 
 
-@server.tool()
+_LOCAL_READ_ONLY = ToolAnnotations(
+    readOnlyHint=True,
+    destructiveHint=False,
+    idempotentHint=True,
+    openWorldHint=False,
+)
+
+_NETWORK_READ_ONLY = ToolAnnotations(
+    readOnlyHint=True,
+    destructiveHint=False,
+    idempotentHint=True,
+    openWorldHint=True,
+)
+
+
+@server.tool(annotations=_LOCAL_READ_ONLY)
 def scan_for_known_backdoors() -> str:
     """Scan this machine for known, publicly-documented indicators of
     compromise from AI-coding-assistant supply-chain attacks (SSH backdoor
@@ -62,7 +78,7 @@ def scan_for_known_backdoors() -> str:
     return _render(run_all_ioc_checks())
 
 
-@server.tool()
+@server.tool(annotations=_LOCAL_READ_ONLY)
 def scan_mcp_config(project_dir: Optional[str] = None) -> str:
     """Scan this machine's Claude Code / Claude Desktop / MCP config files
     for risky patterns: hooks that pipe a remote download into a shell,
@@ -80,7 +96,7 @@ def scan_mcp_config(project_dir: Optional[str] = None) -> str:
     return _render(scan_paths(paths))
 
 
-@server.tool()
+@server.tool(annotations=_NETWORK_READ_ONLY)
 def scan_phantom_dependencies(project_dir: str) -> str:
     """Check a project's package.json / requirements.txt / pyproject.toml
     dependencies against the npm/PyPI registries and flag any package name

{coding_agent_audit-0.5.0 → coding_agent_audit-0.6.1/src/coding_agent_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.5.0
+Version: 0.6.1
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -23,6 +23,8 @@ Dynamic: license-file
 
 <!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
 
+[![M8ven Score](https://m8ven.ai/badge/mcp/stackscribe-ai-coding-agent-audit-1xiuww?v=c2c77be885b345ce5ac975e42a68268d)](https://m8ven.ai/mcp/stackscribe-ai-coding-agent-audit-1xiuww?s=readme)
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -104,6 +106,12 @@ Cursor Marketplace Claude Code trojan:
   persistence task name
 - On Windows: the known SYSTEM scheduled task name, and the Startup-folder
   script dropped as a fallback when that task can't be created
+- A GitHub Copilot VS Code extension older than 1.1.29 (the version that
+  fixed the address-bar-spoofing half of **EMBRACE**, Forever Security's
+  Oct 2026 disclosure of embedded-browser flaws in Cursor, Copilot, Codex,
+  VS Code and Claude Desktop), plus a presence check that flags Codex/VS
+  Code (still unpatched at disclosure time) or Claude Desktop (patch status
+  unconfirmed) if installed, with mitigation guidance
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:
@@ -221,7 +229,7 @@ scan for free; this just packages it for sharing.
 
 If your agent runtime supports the open `SKILL.md` standard (Claude Code,
 Cursor, and others), a packaged version of this scan is live on the
-[Agensi skill marketplace](https://www.agensi.io/skills/coding-agent-security-audit)
+[Agensi skill marketplace](https://www.agensi.io/r/STACKSCRIBEAI?to=/skills/coding-agent-security-audit)
 as "coding agent security audit" (free) — source in
 [`agensi-skill/`](agensi-skill/). It's a zero-dependency, single-file port of
 the same checks below, meant to be loaded by an agent directly rather than
@@ -247,6 +255,7 @@ pytest
 - doublepulsar.com: ["Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide"](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
 - dev.to/@slabb: ["A trojanized Claude Code extension plants an SSH backdoor: the 7-point audit for your machine"](https://dev.to/slabb/a-trojanized-claude-code-extension-plants-an-ssh-backdoor-the-7-point-audit-for-your-machine-23cj)
 - Phorion: ["Official Claude Code Extension Compromise: Security Advisory"](https://phorion.io/blog/offical-claude-code-vsx-compromise/) — confirms the same backdoor reached the Cursor Marketplace and documents the Windows/Linux persistence mechanisms added in v0.2.0 of this tool.
+- Help Net Security: ["Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop"](https://www.helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities/) and The Register: ["Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched"](https://www.theregister.com/security/2026/10/29/researchers_find_bugs_in_5_ai_developer_tools_with_openai_and_microsoft_flaws_still_unpatched/5306508) — Forever Security's EMBRACE disclosure, added in v0.6.0 of this tool.
 
 ## Need this for your team?
 

{coding_agent_audit-0.5.0 → coding_agent_audit-0.6.1}/tests/test_checks.py

@@ -3,6 +3,8 @@ from pathlib import Path
 
 from agentaudit.checks import (
     check_c2_network_indicators,
+    check_embrace_copilot_version,
+    check_embrace_unpatched_tools,
     check_extension_hashes,
     check_linux_cron_persistence,
     check_macos_launch_agent,
@@ -16,6 +18,7 @@ from agentaudit.checks import (
 from agentaudit.iocs import INCIDENTS
 
 _IOC = INCIDENTS["openvsx-claude-code-2026-10"]
+_EMBRACE = INCIDENTS["embrace-embedded-browser-2026-10"]
 
 
 def test_ssh_authorized_keys_clean(tmp_path: Path):
@@ -195,3 +198,50 @@ def test_marker_files_includes_windows_variant(tmp_path: Path):
     (config_dir / "smtk").write_text("x")
     findings = check_marker_files(tmp_path)
     assert len(findings) == 1
+
+
+def test_embrace_copilot_version_clean_when_patched(tmp_path: Path):
+    ext_dir = tmp_path / ".vscode" / "extensions" / "github.copilot-1.1.29"
+    ext_dir.mkdir(parents=True)
+    findings = check_embrace_copilot_version([tmp_path / ".vscode" / "extensions"])
+    assert findings == []
+
+
+def test_embrace_copilot_version_flags_old_version(tmp_path: Path):
+    ext_dir = tmp_path / ".vscode" / "extensions" / "github.copilot-1.1.27"
+    ext_dir.mkdir(parents=True)
+    findings = check_embrace_copilot_version([tmp_path / ".vscode" / "extensions"])
+    assert len(findings) == 1
+    assert findings[0].severity == "warning"
+    assert findings[0].check_id == "embrace-copilot-version"
+
+
+def test_embrace_copilot_version_ignores_copilot_chat(tmp_path: Path):
+    ext_dir = tmp_path / ".vscode" / "extensions" / "github.copilot-chat-0.9.0"
+    ext_dir.mkdir(parents=True)
+    findings = check_embrace_copilot_version([tmp_path / ".vscode" / "extensions"])
+    assert findings == []
+
+
+def test_embrace_copilot_version_nonexistent_dir(tmp_path: Path):
+    assert check_embrace_copilot_version([tmp_path / "nope"]) == []
+
+
+def test_embrace_unpatched_tools_none_detected(tmp_path: Path):
+    assert check_embrace_unpatched_tools(tmp_path) == []
+
+
+def test_embrace_unpatched_tools_vscode_is_warning(tmp_path: Path):
+    (tmp_path / ".vscode").mkdir()
+    findings = check_embrace_unpatched_tools(tmp_path)
+    assert len(findings) == 1
+    assert findings[0].severity == "warning"
+    assert "VS Code" in findings[0].detail
+
+
+def test_embrace_unpatched_tools_claude_desktop_only_is_info(tmp_path: Path):
+    (tmp_path / ".config" / "Claude").mkdir(parents=True)
+    findings = check_embrace_unpatched_tools(tmp_path)
+    assert len(findings) == 1
+    assert findings[0].severity == "info"
+    assert "Claude Desktop" in findings[0].detail