coding-agent-audit 0.9.0__tar.gz → 0.11.0__tar.gz

{coding_agent_audit-0.9.0/src/coding_agent_audit.egg-info → coding_agent_audit-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.9.0
+Version: 0.11.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -134,6 +134,16 @@ second look rather than proof of compromise:
   `authorized_keys`, use netcat in reverse-shell mode, etc.
 - MCP server definitions that run an unpinned package (`npx -y pkg` with
   no version pin)
+- MCP server definitions explicitly pinned to a package version with a
+  disclosed, fixed RCE CVE (added in v0.10.0): `mcp-remote` below v0.1.16
+  (**CVE-2025-6514**, CVSS 9.6 — a malicious remote server's OAuth
+  `authorization_endpoint` response is passed unsanitized to the OS,
+  arbitrary command execution on just opening the client) and
+  `mcp-server-git` below v2025.12.18 (**CVE-2025-68143/68144/68145** —
+  Anthropic's own reference git MCP server, chainable via indirect prompt
+  injection into full RCE). Only an explicit old pin is flagged — an
+  unpinned install picks up the current, patched release and is already
+  covered by the generic unpinned-package finding above
 - Auto-approved permission rules that are unscoped wildcards (e.g.
   `Bash(*)`)
 - The "lethal trifecta" pattern: an untrusted-content-fetching tool
@@ -173,6 +183,16 @@ next `npm install` / `pip install` ("slopsquatting"). Network errors are
 treated as inconclusive, not as a finding, so a flaky connection can't
 produce a false positive.
 
+**MCP phantom-package scan** (`scan_mcp_phantom_packages`, also opt-in via
+`--check-deps`) — the same registry-lookup idea, applied to the MCP server
+commands themselves: any `npx`/`uvx`/`pipx run` invocation in a scanned
+config is checked against npm/PyPI. This is the "MCPhantom" pattern flagged
+by Glow Labs in November 2026: a coding agent fills in a plausible but
+nonexistent MCP server package name from training data (or copies one from
+a long-archived tutorial whose package was since renamed/unpublished), and
+nothing stops an attacker from registering that exact name and having it
+run as the MCP server next time the config loads.
+
 New incidents can be added to `iocs.py` as data, without touching the
 check logic.
 

{coding_agent_audit-0.9.0 → coding_agent_audit-0.11.0}/README.md

@@ -113,6 +113,16 @@ second look rather than proof of compromise:
   `authorized_keys`, use netcat in reverse-shell mode, etc.
 - MCP server definitions that run an unpinned package (`npx -y pkg` with
   no version pin)
+- MCP server definitions explicitly pinned to a package version with a
+  disclosed, fixed RCE CVE (added in v0.10.0): `mcp-remote` below v0.1.16
+  (**CVE-2025-6514**, CVSS 9.6 — a malicious remote server's OAuth
+  `authorization_endpoint` response is passed unsanitized to the OS,
+  arbitrary command execution on just opening the client) and
+  `mcp-server-git` below v2025.12.18 (**CVE-2025-68143/68144/68145** —
+  Anthropic's own reference git MCP server, chainable via indirect prompt
+  injection into full RCE). Only an explicit old pin is flagged — an
+  unpinned install picks up the current, patched release and is already
+  covered by the generic unpinned-package finding above
 - Auto-approved permission rules that are unscoped wildcards (e.g.
   `Bash(*)`)
 - The "lethal trifecta" pattern: an untrusted-content-fetching tool
@@ -152,6 +162,16 @@ next `npm install` / `pip install` ("slopsquatting"). Network errors are
 treated as inconclusive, not as a finding, so a flaky connection can't
 produce a false positive.
 
+**MCP phantom-package scan** (`scan_mcp_phantom_packages`, also opt-in via
+`--check-deps`) — the same registry-lookup idea, applied to the MCP server
+commands themselves: any `npx`/`uvx`/`pipx run` invocation in a scanned
+config is checked against npm/PyPI. This is the "MCPhantom" pattern flagged
+by Glow Labs in November 2026: a coding agent fills in a plausible but
+nonexistent MCP server package name from training data (or copies one from
+a long-archived tutorial whose package was since renamed/unpublished), and
+nothing stops an attacker from registering that exact name and having it
+run as the MCP server next time the config loads.
+
 New incidents can be added to `iocs.py` as data, without touching the
 check logic.
 

{coding_agent_audit-0.9.0 → coding_agent_audit-0.11.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.9.0"
+version = "0.11.0"
 description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server."
 readme = "README.md"
 requires-python = ">=3.9"

{coding_agent_audit-0.9.0 → coding_agent_audit-0.11.0}/src/agentaudit/__init__.py

@@ -3,4 +3,4 @@ for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
 servers).
 """
 
-__version__ = "0.9.0"
+__version__ = "0.11.0"

{coding_agent_audit-0.9.0 → coding_agent_audit-0.11.0}/src/agentaudit/cli.py

@@ -7,7 +7,12 @@ from pathlib import Path
 
 from . import __version__
 from .checks import run_all_ioc_checks
-from .configscan import default_config_paths, scan_paths, scan_tool_descriptions
+from .configscan import (
+    default_config_paths,
+    scan_paths,
+    scan_paths_for_phantom_mcp_packages,
+    scan_tool_descriptions,
+)
 from .findings import Finding, worst_severity
 from .phantomdeps import check_phantom_dependencies
 
@@ -65,10 +70,12 @@ def build_parser() -> argparse.ArgumentParser:
         "--check-deps",
         action="store_true",
         help=(
-            "with --project, also check package.json/requirements.txt/"
-            "pyproject.toml dependencies against npm/PyPI and flag any "
-            "that don't exist (possible AI-hallucinated/slopsquattable "
-            "package name). Makes read-only network requests."
+            "check package names against npm/PyPI and flag any that don't "
+            "exist (possible AI-hallucinated/slopsquattable or 'MCPhantom' "
+            "package name): with --project, also covers package.json/"
+            "requirements.txt/pyproject.toml; always covers npx/uvx/pipx "
+            "MCP server commands in the scanned config files. Makes "
+            "read-only network requests."
         ),
     )
     parser.add_argument(
@@ -95,17 +102,19 @@ def main(argv: list[str] | None = None) -> int:
     parser = build_parser()
     args = parser.parse_args(argv)
 
+    config_paths = default_config_paths(Path.home(), args.project)
+
     findings: list[Finding] = []
     if not args.skip_ioc:
         project_dirs = [args.project] if args.project is not None else []
         findings += run_all_ioc_checks(project_dirs=project_dirs)
     if not args.skip_config:
-        home = Path.home()
-        paths = default_config_paths(home, args.project)
-        findings += scan_paths(paths)
+        findings += scan_paths(config_paths)
 
-    if args.check_deps and args.project is not None:
-        findings += check_phantom_dependencies(args.project)
+    if args.check_deps:
+        if args.project is not None:
+            findings += check_phantom_dependencies(args.project)
+        findings += scan_paths_for_phantom_mcp_packages(config_paths)
 
     if args.tools_json is not None:
         try:

{coding_agent_audit-0.9.0 → coding_agent_audit-0.11.0}/src/agentaudit/configscan.py

@@ -14,6 +14,7 @@ import re
 from pathlib import Path
 from typing import Iterable
 
+from . import phantomdeps
 from .findings import Finding
 
 # Commands/strings that show up in real exfiltration or persistence attempts.
@@ -154,6 +155,95 @@ def scan_hooks(config: dict, source_path: str) -> list[Finding]:
     return findings
 
 
+# Packages with a known, disclosed RCE/command-injection CVE in an old
+# version range that still shows up pinned in copy-pasted configs/tutorials
+# written before the fix shipped. `fixed_version` is the first version where
+# the chain is fully closed; anything strictly older is still exploitable.
+_KNOWN_VULNERABLE_PACKAGES = [
+    (
+        "mcp-remote",
+        (0, 1, 16),
+        ("CVE-2025-6514",),
+        "OS command injection (CVSS 9.6): a malicious/compromised remote MCP "
+        "server can return an `authorization_endpoint` URL during the OAuth "
+        "handshake that mcp-remote passes unsanitized to the OS, achieving "
+        "full remote code execution with no further user interaction beyond "
+        "opening the client. Affects v0.0.5-v0.1.15.",
+    ),
+    (
+        "mcp-server-git",
+        (2025, 12, 18),
+        ("CVE-2025-68143", "CVE-2025-68144", "CVE-2025-68145"),
+        "Chained path-validation bypass, unrestricted git_init, and argument "
+        "injection in Anthropic's reference git MCP server, usable via "
+        "indirect prompt injection (e.g. a planted README) to reach RCE "
+        "together with a filesystem MCP server. Fully fixed in v2025.12.18.",
+    ),
+]
+
+
+def _parse_leading_version(text: str) -> tuple[int, ...] | None:
+    match = re.match(r"^(\d+(?:\.\d+)*)", text)
+    if not match:
+        return None
+    return tuple(int(part) for part in match.group(1).split("."))
+
+
+def _version_lt(a: tuple[int, ...], b: tuple[int, ...]) -> bool:
+    n = max(len(a), len(b))
+    a_padded = a + (0,) * (n - len(a))
+    b_padded = b + (0,) * (n - len(b))
+    return a_padded < b_padded
+
+
+def scan_known_cve_packages(config: dict, source_path: str) -> list[Finding]:
+    """Flag MCP server commands pinned to a package version with a
+    disclosed, fixed RCE/command-injection CVE (see
+    ``_KNOWN_VULNERABLE_PACKAGES``). Unpinned installs are not flagged here -
+    they pick up the current (patched) release and are already covered by
+    the generic 'unpinned package' info finding in `scan_mcp_servers`.
+    """
+    servers = config.get("mcpServers") or config.get("mcp_servers")
+    if not isinstance(servers, dict):
+        return []
+    findings: list[Finding] = []
+    for server_name, server_cfg in servers.items():
+        if not isinstance(server_cfg, dict):
+            continue
+        command = server_cfg.get("command", "")
+        args = server_cfg.get("args") or []
+        full_cmdline = " ".join([command, *[str(a) for a in args]])
+
+        for pkg_name, fixed_version, cve_ids, description in _KNOWN_VULNERABLE_PACKAGES:
+            pin_match = re.search(
+                rf"\b{re.escape(pkg_name)}(?:@|==)([0-9][0-9.]*)", full_cmdline
+            )
+            if not pin_match:
+                continue
+            pinned_version = _parse_leading_version(pin_match.group(1))
+            if pinned_version is None or not _version_lt(pinned_version, fixed_version):
+                continue
+            findings.append(
+                Finding(
+                    check_id="mcp-known-cve-package",
+                    severity="critical",
+                    title=(
+                        f"MCP server '{server_name}' pins {pkg_name}@"
+                        f"{pin_match.group(1)}, vulnerable to {', '.join(cve_ids)}"
+                    ),
+                    detail=(
+                        f"{description} The config explicitly pins a version "
+                        f"older than the fixed {'.'.join(map(str, fixed_version))}, "
+                        f"so upgrading `{pkg_name}` globally will not help "
+                        f"until this pin is also updated."
+                    ),
+                    path=source_path,
+                    references=list(cve_ids),
+                )
+            )
+    return findings
+
+
 def scan_mcp_servers(config: dict, source_path: str) -> list[Finding]:
     servers = config.get("mcpServers") or config.get("mcp_servers")
     if not isinstance(servers, dict):
@@ -198,6 +288,83 @@ def scan_mcp_servers(config: dict, source_path: str) -> list[Finding]:
     return findings
 
 
+_MCP_RUNNER_RE = re.compile(r"\b(npx|uvx|pipx\s+run)\b", re.IGNORECASE)
+
+
+def _extract_mcp_package_spec(full_cmdline: str) -> tuple[str, str] | None:
+    """Return ``(ecosystem, package_name)`` for the package a `npx`/`uvx`/
+    `pipx run` MCP server command would fetch, or ``None`` if no such
+    runner (or no package argument after it) is found."""
+    match = _MCP_RUNNER_RE.search(full_cmdline)
+    if not match:
+        return None
+    ecosystem = "npm" if match.group(1).lower() == "npx" else "pypi"
+    for token in full_cmdline[match.end():].split():
+        if token.startswith("-"):
+            continue
+        if token.startswith("@"):
+            # scoped npm package, optionally pinned: @scope/name[@version]
+            scoped, _, _version = token[1:].partition("@")
+            return ecosystem, f"@{scoped}"
+        name, _, _version = token.partition("@")
+        name = name.split("==", 1)[0]
+        return ecosystem, name
+    return None
+
+
+def scan_mcp_phantom_packages(config: dict, source_path: str) -> list[Finding]:
+    """Flag MCP servers launched via `npx`/`uvx`/`pipx run` that point at a
+    package name which doesn't exist on the registry - the "MCPhantom"
+    pattern (Glow Labs research, Nov 2026): coding agents fill in a
+    plausible-sounding MCP server name from training data, or copy one
+    from a long-archived tutorial/repo whose package was since renamed or
+    unpublished. Either way, nothing stops an attacker from registering
+    that exact name and having it run with the user's own permissions on
+    the very next launch. Makes read-only registry lookups; network
+    errors are treated as "unknown", never as "phantom" (see phantomdeps).
+    """
+    servers = config.get("mcpServers") or config.get("mcp_servers")
+    if not isinstance(servers, dict):
+        return []
+    findings: list[Finding] = []
+    for server_name, server_cfg in servers.items():
+        if not isinstance(server_cfg, dict):
+            continue
+        command = server_cfg.get("command", "")
+        args = server_cfg.get("args") or []
+        full_cmdline = " ".join([command, *[str(a) for a in args]])
+        spec = _extract_mcp_package_spec(full_cmdline)
+        if spec is None:
+            continue
+        ecosystem, name = spec
+        if ecosystem == "npm":
+            if not phantomdeps._is_plausible_npm_name(name):
+                continue
+            exists = phantomdeps.check_npm_package_exists(name)
+        else:
+            exists = phantomdeps.check_pypi_package_exists(name)
+        if exists is not False:
+            continue
+        findings.append(
+            Finding(
+                check_id="mcp-phantom-package",
+                severity="critical",
+                title=f"MCP server '{server_name}' launches a package that doesn't exist ('{name}')",
+                detail=(
+                    f"Command '{full_cmdline}' fetches '{name}' from "
+                    f"{'npm' if ecosystem == 'npm' else 'PyPI'} on every launch, but no "
+                    f"package by that name currently exists there (the "
+                    f"'MCPhantom' pattern: a hallucinated or long-deprecated "
+                    f"MCP server name). Anyone can register it and have "
+                    f"their code run as this MCP server, with no update or "
+                    f"confirmation step in between."
+                ),
+                path=source_path,
+            )
+        )
+    return findings
+
+
 def scan_permissions(config: dict, source_path: str) -> list[Finding]:
     permissions = config.get("permissions")
     if not isinstance(permissions, dict):
@@ -293,6 +460,7 @@ def scan_config_dict(config: dict, source_path: str) -> list[Finding]:
     findings: list[Finding] = []
     findings += scan_hooks(config, source_path)
     findings += scan_mcp_servers(config, source_path)
+    findings += scan_known_cve_packages(config, source_path)
     findings += scan_permissions(config, source_path)
     findings += scan_lethal_trifecta(config, source_path)
     return findings
@@ -339,3 +507,20 @@ def scan_paths(paths: Iterable[Path]) -> list[Finding]:
         if isinstance(config, dict):
             findings += scan_config_dict(config, str(path))
     return findings
+
+
+def scan_paths_for_phantom_mcp_packages(paths: Iterable[Path]) -> list[Finding]:
+    """Like `scan_paths`, but only runs `scan_mcp_phantom_packages` (the
+    network-dependent check), for callers that opt in with `--check-deps`.
+    """
+    findings: list[Finding] = []
+    for path in paths:
+        if not path.is_file():
+            continue
+        try:
+            config = json.loads(path.read_text())
+        except (OSError, json.JSONDecodeError):
+            continue
+        if isinstance(config, dict):
+            findings += scan_mcp_phantom_packages(config, str(path))
+    return findings

{coding_agent_audit-0.9.0 → coding_agent_audit-0.11.0}/src/agentaudit/mcp_server.py

@@ -18,7 +18,7 @@ from mcp.types import ToolAnnotations
 
 from . import __version__
 from .checks import run_all_ioc_checks
-from .configscan import default_config_paths, scan_paths
+from .configscan import default_config_paths, scan_paths, scan_paths_for_phantom_mcp_packages
 from .findings import Finding, worst_severity
 from .phantomdeps import check_phantom_dependencies
 
@@ -113,6 +113,30 @@ def scan_phantom_dependencies(project_dir: str) -> str:
     return _render(check_phantom_dependencies(Path(project_dir)))
 
 
+@server.tool(annotations=_NETWORK_READ_ONLY)
+def scan_mcp_phantom_packages(project_dir: Optional[str] = None) -> str:
+    """Check the `npx`/`uvx`/`pipx run` commands in this machine's (and
+    optionally a project's) MCP server config against the npm/PyPI
+    registries, and flag any package name that doesn't actually exist
+    there - the "MCPhantom" pattern (Glow Labs, Nov 2026): a coding agent
+    fills in a plausible-sounding MCP server name from training data, or
+    copies one from a long-archived tutorial whose package was since
+    renamed or unpublished. An attacker can register that exact name and
+    have it run as the MCP server, with the user's own permissions, the
+    next time the config is loaded. Read-only HTTP lookups only; this
+    never connects to or executes the MCP server itself.
+
+    Args:
+        project_dir: optional path to a project whose .claude/ and
+            .mcp.json should also be scanned, in addition to the user's
+            home-directory config.
+    """
+    home = Path.home()
+    project = Path(project_dir) if project_dir else None
+    paths = default_config_paths(home, project)
+    return _render(scan_paths_for_phantom_mcp_packages(paths))
+
+
 @server.tool(annotations=_LOCAL_READ_ONLY)
 def scan_tool_descriptions(tools: list[dict]) -> str:
     """Scan a list of MCP tool definitions (the 'tools/list' response an

{coding_agent_audit-0.9.0 → coding_agent_audit-0.11.0/src/coding_agent_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.9.0
+Version: 0.11.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -134,6 +134,16 @@ second look rather than proof of compromise:
   `authorized_keys`, use netcat in reverse-shell mode, etc.
 - MCP server definitions that run an unpinned package (`npx -y pkg` with
   no version pin)
+- MCP server definitions explicitly pinned to a package version with a
+  disclosed, fixed RCE CVE (added in v0.10.0): `mcp-remote` below v0.1.16
+  (**CVE-2025-6514**, CVSS 9.6 — a malicious remote server's OAuth
+  `authorization_endpoint` response is passed unsanitized to the OS,
+  arbitrary command execution on just opening the client) and
+  `mcp-server-git` below v2025.12.18 (**CVE-2025-68143/68144/68145** —
+  Anthropic's own reference git MCP server, chainable via indirect prompt
+  injection into full RCE). Only an explicit old pin is flagged — an
+  unpinned install picks up the current, patched release and is already
+  covered by the generic unpinned-package finding above
 - Auto-approved permission rules that are unscoped wildcards (e.g.
   `Bash(*)`)
 - The "lethal trifecta" pattern: an untrusted-content-fetching tool
@@ -173,6 +183,16 @@ next `npm install` / `pip install` ("slopsquatting"). Network errors are
 treated as inconclusive, not as a finding, so a flaky connection can't
 produce a false positive.
 
+**MCP phantom-package scan** (`scan_mcp_phantom_packages`, also opt-in via
+`--check-deps`) — the same registry-lookup idea, applied to the MCP server
+commands themselves: any `npx`/`uvx`/`pipx run` invocation in a scanned
+config is checked against npm/PyPI. This is the "MCPhantom" pattern flagged
+by Glow Labs in November 2026: a coding agent fills in a plausible but
+nonexistent MCP server package name from training data (or copies one from
+a long-archived tutorial whose package was since renamed/unpublished), and
+nothing stops an attacker from registering that exact name and having it
+run as the MCP server next time the config loads.
+
 New incidents can be added to `iocs.py` as data, without touching the
 check logic.
 

{coding_agent_audit-0.9.0 → coding_agent_audit-0.11.0}/tests/test_configscan.py

@@ -1,12 +1,16 @@
 from pathlib import Path
+from unittest.mock import patch
 
 from agentaudit.configscan import (
     default_config_paths,
     scan_config_dict,
     scan_hooks,
+    scan_known_cve_packages,
     scan_lethal_trifecta,
+    scan_mcp_phantom_packages,
     scan_mcp_servers,
     scan_paths,
+    scan_paths_for_phantom_mcp_packages,
     scan_permissions,
     scan_tool_descriptions,
 )
@@ -96,6 +100,154 @@ def test_scan_mcp_servers_not_a_dict():
     assert scan_mcp_servers({"mcpServers": "nope"}, "src") == []
 
 
+def test_scan_known_cve_packages_vulnerable_mcp_remote_pin():
+    config = {
+        "mcpServers": {
+            "remote": {
+                "command": "npx",
+                "args": ["-y", "mcp-remote@0.1.9", "http://example.com/mcp"],
+            }
+        }
+    }
+    findings = scan_known_cve_packages(config, "src")
+    assert len(findings) == 1
+    assert findings[0].check_id == "mcp-known-cve-package"
+    assert findings[0].severity == "critical"
+    assert "CVE-2025-6514" in findings[0].references
+
+
+def test_scan_known_cve_packages_vulnerable_git_server_pin():
+    config = {
+        "mcpServers": {
+            "git": {
+                "command": "uvx",
+                "args": ["mcp-server-git==2025.9.1", "--repository", "/repo"],
+            }
+        }
+    }
+    findings = scan_known_cve_packages(config, "src")
+    assert len(findings) == 1
+    assert "CVE-2025-68143" in findings[0].references[0]
+
+
+def test_scan_known_cve_packages_fixed_version_ok():
+    config = {
+        "mcpServers": {
+            "remote": {"command": "npx", "args": ["-y", "mcp-remote@0.1.16", "https://example.com"]},
+            "git": {"command": "uvx", "args": ["mcp-server-git==2025.12.18", "--repository", "/repo"]},
+        }
+    }
+    assert scan_known_cve_packages(config, "src") == []
+
+
+def test_scan_known_cve_packages_unpinned_not_flagged():
+    config = {
+        "mcpServers": {"remote": {"command": "npx", "args": ["-y", "mcp-remote", "https://example.com"]}}
+    }
+    assert scan_known_cve_packages(config, "src") == []
+
+
+def test_scan_known_cve_packages_unrelated_package_ignored():
+    config = {
+        "mcpServers": {"fs": {"command": "npx", "args": ["-y", "@scope/pkg@0.0.1"]}}
+    }
+    assert scan_known_cve_packages(config, "src") == []
+
+
+def test_scan_known_cve_packages_not_a_dict():
+    assert scan_known_cve_packages({"mcpServers": "nope"}, "src") == []
+
+
+def test_scan_mcp_phantom_packages_flags_nonexistent_npm():
+    config = {
+        "mcpServers": {
+            "ghost": {"command": "npx", "args": ["-y", "mcp-server-totally-made-up-9x7z"]}
+        }
+    }
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=False):
+        findings = scan_mcp_phantom_packages(config, "src")
+    assert len(findings) == 1
+    assert findings[0].check_id == "mcp-phantom-package"
+    assert findings[0].severity == "critical"
+    assert "mcp-server-totally-made-up-9x7z" in findings[0].title
+
+
+def test_scan_mcp_phantom_packages_flags_nonexistent_pypi():
+    config = {
+        "mcpServers": {"ghost": {"command": "uvx", "args": ["mcp-server-ghost-xyz"]}}
+    }
+    with patch("agentaudit.phantomdeps.check_pypi_package_exists", return_value=False):
+        findings = scan_mcp_phantom_packages(config, "src")
+    assert len(findings) == 1
+    assert "mcp-server-ghost-xyz" in findings[0].title
+
+
+def test_scan_mcp_phantom_packages_real_package_not_flagged():
+    config = {
+        "mcpServers": {
+            "fs": {"command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem"]}
+        }
+    }
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=True):
+        findings = scan_mcp_phantom_packages(config, "src")
+    assert findings == []
+
+
+def test_scan_mcp_phantom_packages_network_unknown_not_flagged():
+    config = {"mcpServers": {"ghost": {"command": "npx", "args": ["-y", "some-pkg"]}}}
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=None):
+        findings = scan_mcp_phantom_packages(config, "src")
+    assert findings == []
+
+
+def test_scan_mcp_phantom_packages_versioned_pin_strips_version():
+    config = {
+        "mcpServers": {
+            "ghost": {"command": "npx", "args": ["-y", "mcp-server-ghost-xyz@1.2.3"]}
+        }
+    }
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=False) as mock_check:
+        findings = scan_mcp_phantom_packages(config, "src")
+    mock_check.assert_called_once_with("mcp-server-ghost-xyz")
+    assert len(findings) == 1
+
+
+def test_scan_mcp_phantom_packages_scoped_versioned_pin():
+    config = {
+        "mcpServers": {
+            "ghost": {"command": "npx", "args": ["-y", "@scope/ghost-pkg@2.0.0"]}
+        }
+    }
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=False) as mock_check:
+        findings = scan_mcp_phantom_packages(config, "src")
+    mock_check.assert_called_once_with("@scope/ghost-pkg")
+    assert len(findings) == 1
+
+
+def test_scan_mcp_phantom_packages_no_runner_not_flagged():
+    config = {"mcpServers": {"local": {"command": "/usr/local/bin/my-server"}}}
+    assert scan_mcp_phantom_packages(config, "src") == []
+
+
+def test_scan_mcp_phantom_packages_not_a_dict():
+    assert scan_mcp_phantom_packages({"mcpServers": "nope"}, "src") == []
+
+
+def test_scan_paths_for_phantom_mcp_packages(tmp_path: Path):
+    config_path = tmp_path / ".mcp.json"
+    config_path.write_text(
+        '{"mcpServers": {"ghost": {"command": "npx", "args": ["-y", "mcp-ghost-xyz"]}}}'
+    )
+    with patch("agentaudit.phantomdeps.check_npm_package_exists", return_value=False):
+        findings = scan_paths_for_phantom_mcp_packages([config_path])
+    assert len(findings) == 1
+    assert findings[0].check_id == "mcp-phantom-package"
+
+
+def test_scan_paths_for_phantom_mcp_packages_missing_file(tmp_path: Path):
+    assert scan_paths_for_phantom_mcp_packages([tmp_path / "missing.json"]) == []
+
+
 def test_scan_permissions_scoped_rule_ok():
     config = {"permissions": {"allow": ["Bash(git diff:*)", "Read(//workspace/**)"]}}
     assert scan_permissions(config, "src") == []