coding-agent-audit 0.9.0__tar.gz → 0.10.0__tar.gz

{coding_agent_audit-0.9.0/src/coding_agent_audit.egg-info → coding_agent_audit-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.9.0
+Version: 0.10.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -134,6 +134,16 @@ second look rather than proof of compromise:
   `authorized_keys`, use netcat in reverse-shell mode, etc.
 - MCP server definitions that run an unpinned package (`npx -y pkg` with
   no version pin)
+- MCP server definitions explicitly pinned to a package version with a
+  disclosed, fixed RCE CVE (added in v0.10.0): `mcp-remote` below v0.1.16
+  (**CVE-2025-6514**, CVSS 9.6 — a malicious remote server's OAuth
+  `authorization_endpoint` response is passed unsanitized to the OS,
+  arbitrary command execution on just opening the client) and
+  `mcp-server-git` below v2025.12.18 (**CVE-2025-68143/68144/68145** —
+  Anthropic's own reference git MCP server, chainable via indirect prompt
+  injection into full RCE). Only an explicit old pin is flagged — an
+  unpinned install picks up the current, patched release and is already
+  covered by the generic unpinned-package finding above
 - Auto-approved permission rules that are unscoped wildcards (e.g.
   `Bash(*)`)
 - The "lethal trifecta" pattern: an untrusted-content-fetching tool

{coding_agent_audit-0.9.0 → coding_agent_audit-0.10.0}/README.md

@@ -113,6 +113,16 @@ second look rather than proof of compromise:
   `authorized_keys`, use netcat in reverse-shell mode, etc.
 - MCP server definitions that run an unpinned package (`npx -y pkg` with
   no version pin)
+- MCP server definitions explicitly pinned to a package version with a
+  disclosed, fixed RCE CVE (added in v0.10.0): `mcp-remote` below v0.1.16
+  (**CVE-2025-6514**, CVSS 9.6 — a malicious remote server's OAuth
+  `authorization_endpoint` response is passed unsanitized to the OS,
+  arbitrary command execution on just opening the client) and
+  `mcp-server-git` below v2025.12.18 (**CVE-2025-68143/68144/68145** —
+  Anthropic's own reference git MCP server, chainable via indirect prompt
+  injection into full RCE). Only an explicit old pin is flagged — an
+  unpinned install picks up the current, patched release and is already
+  covered by the generic unpinned-package finding above
 - Auto-approved permission rules that are unscoped wildcards (e.g.
   `Bash(*)`)
 - The "lethal trifecta" pattern: an untrusted-content-fetching tool

{coding_agent_audit-0.9.0 → coding_agent_audit-0.10.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.9.0"
+version = "0.10.0"
 description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server."
 readme = "README.md"
 requires-python = ">=3.9"

{coding_agent_audit-0.9.0 → coding_agent_audit-0.10.0}/src/agentaudit/__init__.py

@@ -3,4 +3,4 @@ for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
 servers).
 """
 
-__version__ = "0.9.0"
+__version__ = "0.10.0"

{coding_agent_audit-0.9.0 → coding_agent_audit-0.10.0}/src/agentaudit/configscan.py

@@ -154,6 +154,95 @@ def scan_hooks(config: dict, source_path: str) -> list[Finding]:
     return findings
 
 
+# Packages with a known, disclosed RCE/command-injection CVE in an old
+# version range that still shows up pinned in copy-pasted configs/tutorials
+# written before the fix shipped. `fixed_version` is the first version where
+# the chain is fully closed; anything strictly older is still exploitable.
+_KNOWN_VULNERABLE_PACKAGES = [
+    (
+        "mcp-remote",
+        (0, 1, 16),
+        ("CVE-2025-6514",),
+        "OS command injection (CVSS 9.6): a malicious/compromised remote MCP "
+        "server can return an `authorization_endpoint` URL during the OAuth "
+        "handshake that mcp-remote passes unsanitized to the OS, achieving "
+        "full remote code execution with no further user interaction beyond "
+        "opening the client. Affects v0.0.5-v0.1.15.",
+    ),
+    (
+        "mcp-server-git",
+        (2025, 12, 18),
+        ("CVE-2025-68143", "CVE-2025-68144", "CVE-2025-68145"),
+        "Chained path-validation bypass, unrestricted git_init, and argument "
+        "injection in Anthropic's reference git MCP server, usable via "
+        "indirect prompt injection (e.g. a planted README) to reach RCE "
+        "together with a filesystem MCP server. Fully fixed in v2025.12.18.",
+    ),
+]
+
+
+def _parse_leading_version(text: str) -> tuple[int, ...] | None:
+    match = re.match(r"^(\d+(?:\.\d+)*)", text)
+    if not match:
+        return None
+    return tuple(int(part) for part in match.group(1).split("."))
+
+
+def _version_lt(a: tuple[int, ...], b: tuple[int, ...]) -> bool:
+    n = max(len(a), len(b))
+    a_padded = a + (0,) * (n - len(a))
+    b_padded = b + (0,) * (n - len(b))
+    return a_padded < b_padded
+
+
+def scan_known_cve_packages(config: dict, source_path: str) -> list[Finding]:
+    """Flag MCP server commands pinned to a package version with a
+    disclosed, fixed RCE/command-injection CVE (see
+    ``_KNOWN_VULNERABLE_PACKAGES``). Unpinned installs are not flagged here -
+    they pick up the current (patched) release and are already covered by
+    the generic 'unpinned package' info finding in `scan_mcp_servers`.
+    """
+    servers = config.get("mcpServers") or config.get("mcp_servers")
+    if not isinstance(servers, dict):
+        return []
+    findings: list[Finding] = []
+    for server_name, server_cfg in servers.items():
+        if not isinstance(server_cfg, dict):
+            continue
+        command = server_cfg.get("command", "")
+        args = server_cfg.get("args") or []
+        full_cmdline = " ".join([command, *[str(a) for a in args]])
+
+        for pkg_name, fixed_version, cve_ids, description in _KNOWN_VULNERABLE_PACKAGES:
+            pin_match = re.search(
+                rf"\b{re.escape(pkg_name)}(?:@|==)([0-9][0-9.]*)", full_cmdline
+            )
+            if not pin_match:
+                continue
+            pinned_version = _parse_leading_version(pin_match.group(1))
+            if pinned_version is None or not _version_lt(pinned_version, fixed_version):
+                continue
+            findings.append(
+                Finding(
+                    check_id="mcp-known-cve-package",
+                    severity="critical",
+                    title=(
+                        f"MCP server '{server_name}' pins {pkg_name}@"
+                        f"{pin_match.group(1)}, vulnerable to {', '.join(cve_ids)}"
+                    ),
+                    detail=(
+                        f"{description} The config explicitly pins a version "
+                        f"older than the fixed {'.'.join(map(str, fixed_version))}, "
+                        f"so upgrading `{pkg_name}` globally will not help "
+                        f"until this pin is also updated."
+                    ),
+                    path=source_path,
+                    references=list(cve_ids),
+                )
+            )
+    return findings
+
+
 def scan_mcp_servers(config: dict, source_path: str) -> list[Finding]:
     servers = config.get("mcpServers") or config.get("mcp_servers")
     if not isinstance(servers, dict):
@@ -293,6 +382,7 @@ def scan_config_dict(config: dict, source_path: str) -> list[Finding]:
     findings: list[Finding] = []
     findings += scan_hooks(config, source_path)
     findings += scan_mcp_servers(config, source_path)
+    findings += scan_known_cve_packages(config, source_path)
     findings += scan_permissions(config, source_path)
     findings += scan_lethal_trifecta(config, source_path)
     return findings

{coding_agent_audit-0.9.0 → coding_agent_audit-0.10.0/src/coding_agent_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.9.0
+Version: 0.10.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -134,6 +134,16 @@ second look rather than proof of compromise:
   `authorized_keys`, use netcat in reverse-shell mode, etc.
 - MCP server definitions that run an unpinned package (`npx -y pkg` with
   no version pin)
+- MCP server definitions explicitly pinned to a package version with a
+  disclosed, fixed RCE CVE (added in v0.10.0): `mcp-remote` below v0.1.16
+  (**CVE-2025-6514**, CVSS 9.6 — a malicious remote server's OAuth
+  `authorization_endpoint` response is passed unsanitized to the OS,
+  arbitrary command execution on just opening the client) and
+  `mcp-server-git` below v2025.12.18 (**CVE-2025-68143/68144/68145** —
+  Anthropic's own reference git MCP server, chainable via indirect prompt
+  injection into full RCE). Only an explicit old pin is flagged — an
+  unpinned install picks up the current, patched release and is already
+  covered by the generic unpinned-package finding above
 - Auto-approved permission rules that are unscoped wildcards (e.g.
   `Bash(*)`)
 - The "lethal trifecta" pattern: an untrusted-content-fetching tool

{coding_agent_audit-0.9.0 → coding_agent_audit-0.10.0}/tests/test_configscan.py

@@ -4,6 +4,7 @@ from agentaudit.configscan import (
     default_config_paths,
     scan_config_dict,
     scan_hooks,
+    scan_known_cve_packages,
     scan_lethal_trifecta,
     scan_mcp_servers,
     scan_paths,
@@ -96,6 +97,64 @@ def test_scan_mcp_servers_not_a_dict():
     assert scan_mcp_servers({"mcpServers": "nope"}, "src") == []
 
 
+def test_scan_known_cve_packages_vulnerable_mcp_remote_pin():
+    config = {
+        "mcpServers": {
+            "remote": {
+                "command": "npx",
+                "args": ["-y", "mcp-remote@0.1.9", "http://example.com/mcp"],
+            }
+        }
+    }
+    findings = scan_known_cve_packages(config, "src")
+    assert len(findings) == 1
+    assert findings[0].check_id == "mcp-known-cve-package"
+    assert findings[0].severity == "critical"
+    assert "CVE-2025-6514" in findings[0].references
+
+
+def test_scan_known_cve_packages_vulnerable_git_server_pin():
+    config = {
+        "mcpServers": {
+            "git": {
+                "command": "uvx",
+                "args": ["mcp-server-git==2025.9.1", "--repository", "/repo"],
+            }
+        }
+    }
+    findings = scan_known_cve_packages(config, "src")
+    assert len(findings) == 1
+    assert "CVE-2025-68143" in findings[0].references[0]
+
+
+def test_scan_known_cve_packages_fixed_version_ok():
+    config = {
+        "mcpServers": {
+            "remote": {"command": "npx", "args": ["-y", "mcp-remote@0.1.16", "https://example.com"]},
+            "git": {"command": "uvx", "args": ["mcp-server-git==2025.12.18", "--repository", "/repo"]},
+        }
+    }
+    assert scan_known_cve_packages(config, "src") == []
+
+
+def test_scan_known_cve_packages_unpinned_not_flagged():
+    config = {
+        "mcpServers": {"remote": {"command": "npx", "args": ["-y", "mcp-remote", "https://example.com"]}}
+    }
+    assert scan_known_cve_packages(config, "src") == []
+
+
+def test_scan_known_cve_packages_unrelated_package_ignored():
+    config = {
+        "mcpServers": {"fs": {"command": "npx", "args": ["-y", "@scope/pkg@0.0.1"]}}
+    }
+    assert scan_known_cve_packages(config, "src") == []
+
+
+def test_scan_known_cve_packages_not_a_dict():
+    assert scan_known_cve_packages({"mcpServers": "nope"}, "src") == []
+
+
 def test_scan_permissions_scoped_rule_ok():
     config = {"permissions": {"allow": ["Bash(git diff:*)", "Read(//workspace/**)"]}}
     assert scan_permissions(config, "src") == []