cycode 3.25.2.dev3__tar.gz → 3.25.2.dev4__tar.gz

{cycode-3.25.2.dev3 → cycode-3.25.2.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.25.2.dev3
+Version: 3.25.2.dev4
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.25.2.dev3 → cycode-3.25.2.dev4}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.25.2.dev3'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.25.2.dev4'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.25.2.dev3 → cycode-3.25.2.dev4}/cycode/cli/apps/ai_guardrails/scan/handlers.py

@@ -327,10 +327,14 @@ def _check_mcp_server_authorization(payload: AIHookPayload, policy: dict) -> _Pr
         return None
 
     status = statuses.status_of(server_name)
-    if not is_enforced(status):
+    treat_unreviewed = statuses.treat_unreviewed_as_unauthorized
+    if not is_enforced(status, treat_unreviewed):
         return None
 
-    logger.debug('MCP server is not authorized, %s', {'mcp_server_name': server_name, 'status': status})
+    logger.debug(
+        'MCP server is not authorized, %s',
+        {'mcp_server_name': server_name, 'status': status, 'treat_unreviewed': treat_unreviewed},
+    )
     return _PreScanFinding(
         block_reason=BlockReason.UNAUTHORIZED_MCP_SERVER,
         mode=get_effective_mode(mcp_config, action_key='server_action'),

{cycode-3.25.2.dev3 → cycode-3.25.2.dev4}/cycode/cli/apps/ai_guardrails/scan/mcp_server_status.py

@@ -14,7 +14,12 @@ from marshmallow import EXCLUDE, Schema, fields, post_load
 from cycode.cli.apps.ai_guardrails.scan.guardrail_config import DEFAULT_TTL_SECONDS
 from cycode.cli.consts import CYCODE_CONFIGURATION_DIRECTORY
 from cycode.cli.utils.path_utils import atomic_write_text, quarantine_corrupt_file
-from cycode.cyclient.models import McpServerAuthorizationStatus, McpServerStatus, McpServerStatusSchema
+from cycode.cyclient.models import (
+    McpServerAuthorizationStatus,
+    McpServerStatus,
+    McpServerStatusSchema,
+    TrueOnlyBoolean,
+)
 from cycode.logger import get_logger
 
 logger = get_logger('AI Guardrails')
@@ -34,8 +39,10 @@ def get_mcp_server_statuses_cache_path() -> Path:
     return Path.home() / CYCODE_CONFIGURATION_DIRECTORY / MCP_SERVER_STATUSES_FILE_NAME
 
 
-def is_enforced(status: McpServerAuthorizationStatus | None) -> bool:
+def is_enforced(status: McpServerAuthorizationStatus | None, treat_unreviewed: bool) -> bool:
     """``status`` is None when the platform never saw the server."""
+    if treat_unreviewed:
+        return status != McpServerAuthorizationStatus.AUTHORIZED
     return status == McpServerAuthorizationStatus.UNAUTHORIZED
 
 
@@ -45,6 +52,7 @@ class McpServerStatuses:
     fetched_at: float
     tenant_id: str | None = None
     ttl_seconds: float = DEFAULT_TTL_SECONDS
+    treat_unreviewed_as_unauthorized: bool = False
     _by_alias: dict = field(init=False, repr=False)
 
     def __post_init__(self) -> None:
@@ -70,6 +78,7 @@ class McpServerStatusesSchema(Schema):
     fetched_at = fields.Float(required=True)
     tenant_id = fields.String(allow_none=True, load_default=None)
     ttl_seconds = fields.Float(allow_none=True, load_default=None)
+    treat_unreviewed_as_unauthorized = TrueOnlyBoolean(data_key='should_treat_unreviewed_as_unauthorized')
 
     @post_load
     def build_dto(self, data: dict[str, Any], **_) -> McpServerStatuses:
@@ -78,10 +87,19 @@ class McpServerStatusesSchema(Schema):
 
 
 def save_mcp_server_statuses(
-    servers: list[McpServerStatus], tenant_id: str | None, ttl_seconds: float = DEFAULT_TTL_SECONDS
+    servers: list[McpServerStatus],
+    tenant_id: str | None,
+    ttl_seconds: float = DEFAULT_TTL_SECONDS,
+    treat_unreviewed_as_unauthorized: bool = False,
 ) -> None:
     path = get_mcp_server_statuses_cache_path()
-    statuses = McpServerStatuses(servers=servers, fetched_at=time.time(), tenant_id=tenant_id, ttl_seconds=ttl_seconds)
+    statuses = McpServerStatuses(
+        servers=servers,
+        fetched_at=time.time(),
+        tenant_id=tenant_id,
+        ttl_seconds=ttl_seconds,
+        treat_unreviewed_as_unauthorized=treat_unreviewed_as_unauthorized,
+    )
     try:
         path.parent.mkdir(parents=True, exist_ok=True)
         atomic_write_text(str(path), json.dumps(McpServerStatusesSchema().dump(statuses)))

{cycode-3.25.2.dev3 → cycode-3.25.2.dev4}/cycode/cli/apps/ai_guardrails/session_start_command.py

@@ -129,7 +129,9 @@ def _report_session_context(
         _save_report_cache(digest, tenant_id)
         if response.mcp_servers is not None:
             ttl_seconds = config.ttl_seconds if config is not None else DEFAULT_TTL_SECONDS
-            save_mcp_server_statuses(response.mcp_servers, tenant_id, ttl_seconds)
+            save_mcp_server_statuses(
+                response.mcp_servers, tenant_id, ttl_seconds, response.should_treat_unreviewed_as_unauthorized
+            )
             logger.debug('MCP server statuses cache updated')
     except Exception as e:
         logger.debug('Failed to report session context', exc_info=e)

{cycode-3.25.2.dev3 → cycode-3.25.2.dev4}/cycode/cyclient/models.py

@@ -601,6 +601,13 @@ class McpServerAuthorizationStatusField(fields.Field):
         return McpServerAuthorizationStatus.parse(None if value is missing else value)
 
 
+class TrueOnlyBoolean(fields.Boolean):
+    """Anything but a literal true reads as False, so a malformed flag never tightens enforcement."""
+
+    def deserialize(self, value: object, *_, **__) -> bool:
+        return value is True
+
+
 @dataclass
 class McpServerStatus:
     alias: str | None = None
@@ -625,6 +632,8 @@ class McpServerStatusSchema(Schema):
 class SessionContextResponse:
     # None when the response carries no (or malformed) MCP server statuses.
     mcp_servers: list[McpServerStatus] | None = None
+    # Strict mode: Unreviewed servers count as Unauthorized.
+    should_treat_unreviewed_as_unauthorized: bool = False
 
 
 class SessionContextResponseSchema(Schema):
@@ -632,6 +641,7 @@ class SessionContextResponseSchema(Schema):
         unknown = EXCLUDE
 
     mcp_servers = fields.List(fields.Nested(McpServerStatusSchema), allow_none=True, load_default=None)
+    should_treat_unreviewed_as_unauthorized = TrueOnlyBoolean()
 
     @post_load
     def build_dto(self, data: dict[str, Any], **_) -> SessionContextResponse:

{cycode-3.25.2.dev3 → cycode-3.25.2.dev4}/pyproject.toml

@@ -20,7 +20,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.25.2.dev3"
+version = "3.25.2.dev4"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"