mcp-bastion-python 1.0.17__tar.gz → 2.0.0__tar.gz

{mcp_bastion_python-1.0.17 → mcp_bastion_python-2.0.0}/LICENSE

@@ -1,7 +1,7 @@
 MCP-Bastion Community and Commercial License
 Version 1.0
 
-Copyright (c) 2026 Viquar Khan
+Copyright (c) 2026 Vaquar Khan
 All rights reserved.
 
 1. Definitions

{mcp_bastion_python-1.0.17 → mcp_bastion_python-2.0.0}/PKG-INFO

@@ -1,15 +1,15 @@
 Metadata-Version: 2.4
 Name: mcp-bastion-python
-Version: 1.0.17
+Version: 2.0.0
 Summary: Security middleware for MCP servers protecting LLM agents from prompt injection, resource exhaustion, and PII leakage
-Project-URL: Homepage, https://github.com/mcp-bastion/mcp-bastion
-Project-URL: Repository, https://github.com/mcp-bastion/mcp-bastion
-Project-URL: Documentation, https://github.com/mcp-bastion/mcp-bastion#readme
-Author: Viquar Khan
+Project-URL: Homepage, https://github.com/vaquarkhan/MCP-Bastion
+Project-URL: Repository, https://github.com/vaquarkhan/MCP-Bastion
+Project-URL: Documentation, https://github.com/vaquarkhan/MCP-Bastion#readme
+Author: Vaquar Khan
 License: MCP-Bastion Community and Commercial License
         Version 1.0
         
-        Copyright (c) 2026 Viquar Khan
+        Copyright (c) 2026 Vaquar Khan
         All rights reserved.
         
         1. Definitions
@@ -74,9 +74,10 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Requires-Python: >=3.10
-Requires-Dist: mcp>=1.0.0
+Requires-Dist: mcp>=1.2.0
 Requires-Dist: presidio-analyzer>=2.2.0
 Requires-Dist: presidio-anonymizer>=2.2.0
 Requires-Dist: spacy>=3.5.0
@@ -94,7 +95,10 @@ Requires-Dist: opentelemetry-api>=1.20.0; extra == 'otel'
 Requires-Dist: opentelemetry-exporter-otlp-proto-grpc>=1.20.0; extra == 'otel'
 Requires-Dist: opentelemetry-sdk>=1.20.0; extra == 'otel'
 Provides-Extra: policy
+Requires-Dist: jsonpath-ng>=1.6.0; extra == 'policy'
 Requires-Dist: pyyaml>=6.0; extra == 'policy'
+Provides-Extra: redis
+Requires-Dist: redis>=5.0.0; extra == 'redis'
 Description-Content-Type: text/markdown
 
 # MCP-Bastion
@@ -110,7 +114,7 @@ Description-Content-Type: text/markdown
   />
 </p>
 
-[![PyPI: mcp-bastion-python 1.0.17](https://img.shields.io/pypi/v/mcp-bastion-python?logo=python)](https://pypi.org/project/mcp-bastion-python/1.0.17/)
+[![PyPI: mcp-bastion-python 2.0.0](https://img.shields.io/pypi/v/mcp-bastion-python?logo=python)](https://pypi.org/project/mcp-bastion-python/2.0.0/)
 [![PePy all-time downloads (mcp-bastion-python)](https://img.shields.io/pepy/dt/mcp-bastion-python?label=PePy%20all-time%20downloads)](https://pepy.tech/projects/mcp-bastion-python)
 [![Python](https://img.shields.io/pypi/pyversions/mcp-bastion-python)](https://pypi.org/project/mcp-bastion-python/)
 [![CI](https://img.shields.io/github/actions/workflow/status/vaquarkhan/MCP-Bastion/ci.yml?branch=main&label=CI)](https://github.com/vaquarkhan/MCP-Bastion/actions/workflows/ci.yml)
@@ -119,7 +123,104 @@ Description-Content-Type: text/markdown
 [![License: Source Available](https://img.shields.io/badge/license-Source%20Available-orange.svg)](LICENSE)
 [![Website](https://img.shields.io/badge/website-vaquarkhan.github.io/MCP--Bastion-blue?logo=github)](https://vaquarkhan.github.io/MCP-Bastion/)
 
-**The security layer MCP servers are missing.** Your agent can call databases, APIs, and shell tools. One bad prompt can leak PII; one runaway loop can burn your API budget in minutes. MCP-Bastion wraps your MCP server with **local** guardrails: injection blocking, PII redaction, and **denial-of-wallet caps** (iteration limits, token budget, optional USD ceilings), under **5ms overhead**, with no third-party safety API.
+**The Zero-Trust control plane for MCP agents.** Your agent can call databases, APIs, and shell tools. One bad prompt can leak PII; one runaway loop can burn your API budget in minutes; three agents on one server with no identity boundary is a confused-deputy incident waiting to happen. MCP-Bastion wraps your MCP server with **local** guardrails: **agent IAM**, supply-chain checksums, injection blocking, PII redaction, and **denial-of-wallet caps**, under **5ms overhead**, with no third-party safety API.
+
+<p align="center">
+  <img
+    src="images/mcp-bastion-mcp-surface-scale.png"
+    alt="MCP-Bastion 2.0.0: full MCP method coverage and Redis shared state for multi-replica deployments"
+    width="960"
+    style="max-width:100%; height:auto; border-radius:12px; border:1px solid #1e293b;"
+  />
+</p>
+
+## Why MCP-Bastion? (Solving the 2026 MCP Security Crisis)
+
+As noted in the NSA's recent Cybersecurity Information Sheet on MCP security and the OWASP MCP Top 10, traditional AppSec tools cannot secure agentic workflows. The gap is **runtime governance** and the **confused deputy problem**: multiple AI agents sharing one MCP server with no native identity boundary. Public registry typosquatting and unverified servers have made supply-chain verification a board-level concern.
+
+MCP-Bastion acts as the **Zero-Trust Control Plane** for your agents, addressing the hardest production problems:
+
+1. **The Confused Deputy (Agent IAM):** Identity-aware routing binds API tokens to **Agent Identities** and enforces strict per-tool RBAC. Your customer-support bot can call `search_docs`, not `delete_user`.
+2. **Supply chain & typosquatting defense:** Cryptographic SHA-256 manifest verification blocks traffic when MCP server artifacts drift from your signed-off checksums.
+3. **Data exfiltration & injection prevention:** PromptGuard heuristics + ML block jailbreaks locally; Presidio scrubs outbound PII before it hits a model context window.
+
+### Define your agent policies (`bastion.yaml`)
+
+```yaml
+# Stop the Confused Deputy Problem — Identity-Aware Routing
+agent_iam:
+  enabled: true
+  token_metadata_key: bastion_agent_token
+  agents:
+    - id: customer_support_bot
+      token_env: BASTION_TOKEN_SUPPORT
+      allowed_tools: ["search_docs", "get_ticket_status"]
+      blocked_tools: ["execute_sql", "delete_user"]
+      rate_limit:
+        max_iterations: 5
+
+# Supply-chain checksums before any tool executes
+server_verification:
+  enabled: true
+  on_mismatch: block
+  base_path: .
+  manifest_path: mcp-server.manifest.json
+```
+
+Generate a manifest after a trusted build: `mcp-bastion manifest server.py pyproject.toml -o mcp-server.manifest.json`
+
+Deep dive: [docs/RUNTIME_GOVERNANCE.md](docs/RUNTIME_GOVERNANCE.md) · [docs/ROADMAP.md](docs/ROADMAP.md)
+
+### Full MCP surface + horizontal scale (2.0.0)
+
+Previously, most pillars ran only on **`tools/call`**. **2.0.0** extends the pipeline to **`resources/read`**, **`prompts/get`**, **`sampling/createMessage`**, and **`elicitation/create`** — closing exfil/injection gaps on the rest of the MCP surface.
+
+For **multi-replica** deployments, enable **`state_backend.type: redis`** so rate limits, replay nonces, cost budgets, and session tool scope are shared across pods (default `memory` is single-process).
+
+```yaml
+state_backend:
+  type: redis
+  redis_url: redis://127.0.0.1:6379/0
+```
+
+`pip install mcp-bastion-python[redis]` · Deep dive: [docs/MCP_SURFACE_AND_SCALE.md](docs/MCP_SURFACE_AND_SCALE.md)
+
+### Production hardening adopted in 2.0.0
+
+Battle-tested patterns from the broader MCP gateway ecosystem, wired into the middleware stack:
+
+| Feature | What you get |
+|--------|----------------|
+| **JSONPath argument guards** | Block or redact tool arguments by **tool glob + JSONPath + regex** before execution (argv-array evasion aware). `pip install mcp-bastion-python[policy]` |
+| **RBAC fnmatch globs** | Role permissions like `read_*` / `files_*` with **specificity-aware** matching |
+| **Audit JSONL + `mcp-bastion tail`** | Append-only compliance log; `audit.jsonl_path` in config or `mcp-bastion tail -p audit.jsonl` |
+| **Cost checkpoint** | Optional disk persistence for session totals across restarts (`cost_tracker.checkpoint_path`, memory backend only) |
+
+```yaml
+argument_guards:
+  enabled: true
+  rules:
+    - name: block_shell
+      match: "run_*"
+      arg: "$.command"
+      pattern: "(rm\\s+-rf|curl\\s+.*\\|.*sh)"
+      action: block
+
+audit:
+  jsonl_path: .bastion/audit.jsonl
+
+cost_tracker:
+  checkpoint_path: .bastion/cost-checkpoint.json
+```
+
+<p align="center">
+  <img
+    src="images/mcp-bastion-runtime-governance.png"
+    alt="MCP-Bastion 2.0.0 Zero-Trust Runtime Governance: full MCP surface, Redis scale, Agent IAM, and beyond-OWASP coverage"
+    width="960"
+    style="max-width:100%; height:auto; border-radius:12px; border:1px solid #1e293b;"
+  />
+</p>
 
 ### Why developers adopt it
 
@@ -128,7 +229,7 @@ Description-Content-Type: text/markdown
 | **Guardrails without a rewrite** | Drop-in middleware: `secure_fastmcp(mcp)` or one `bastion.yaml` |
 | **Privacy your legal team accepts** | PromptGuard + Presidio run **in your process**; data stays on your network |
 | **Stop runaway agents & budget burn** | **On by default:** 15 tool calls/session, 60s timeout, 50k token budget. **Optional:** per-tool caps, USD session/day limits, response offload |
-| **Shrink context & cut token spend** | **Opt-in:** discovery filter (fewer tools in `tools/list`), output budget + session offload, semantic cache — less context in every turn |
+| **Shrink context & cut token spend** | **Opt-in:** discovery filter (fewer tools in `tools/list`), output budget + session offload (**up to ~99% on oversized tool outputs**), lexical similarity cache — [measured benchmarks](docs/BENCHMARKS.md) |
 | **Something that ships today** | PyPI, npm, Docker on GHCR, FastMCP, TypeScript wrapper, CI validate, live dashboard |
 | **Policy your team can review** | `bastion.yaml` in Git, hot reload, OWASP-aligned controls ([docs/PILLARS.md](docs/PILLARS.md)) |
 
@@ -150,17 +251,29 @@ Blocked calls return standard errors (`RateLimitExceededError` **-32002**, `Toke
 
 ### Token reduction & cost saving
 
-Bastion does not only **block** runaway spend — it **reduces** how many tokens reach the model on every turn:
+Bastion does not only **block** runaway spend — it **reduces** how much **tool output and tool-catalog** tokens reach the model on each turn (not the user’s LLM prompt text itself):
 
 | Savings lever | What it does | Default |
 |---------------|--------------|---------|
-| **Discovery filter** | Hides unused tools from `tools/list` so agents carry a smaller tool catalog in context | Opt-in |
-| **Output budget + offload** | Truncates oversized tool responses; stores the rest in-session for `bastion_get_offloaded` | Opt-in |
-| **Semantic cache** | Skips redundant tool calls when inputs match a prior result | Opt-in |
+| **Discovery filter** | Hides unused tools from `tools/list` so agents carry a smaller tool catalog in context (~**85%** fewer catalog tokens in [benchmarks](docs/BENCHMARKS.md) with 20→3 tools) | Opt-in |
+| **Output budget + offload** | Truncates oversized tool responses; stores the rest in-session for `bastion_get_offloaded` (**up to ~99.7%** on 50k-token dumps; **0%** when already under budget) | Opt-in |
+| **Lexical similarity cache** | Skips redundant tool calls when queries are near-identical (Jaccard word overlap — not embedding “semantic” search) | Opt-in |
 | **Token budget caps** | Hard stop before session token burn exceeds your limit | **On** (50k tokens) |
 | **USD session/day limits** | Dollar ceilings via cost tracker | Opt-in |
 
-Less context per turn means lower LLM input cost — without sending prompts to a third-party optimizer API.
+There is **no honest single “X% prompt reduction”** figure — savings are **input-dependent**. See **[docs/BENCHMARKS.md](docs/BENCHMARKS.md)** for reproducible pytest benchmarks and live numbers.
+
+<p align="center">
+  <img
+    src="images/mcp-bastion-finops-benchmarks.png"
+    alt="MCP-Bastion benchmarks: RBAC tool-level matrix, output budget up to 99% on large tool responses, discovery filter catalog savings, lexical cache hit/miss"
+    width="960"
+    style="max-width:100%; height:auto; border-radius:12px; border:1px solid #1e293b;"
+  />
+</p>
+<p align="center"><sub>Reproduce: <code>PYTHONPATH=src python -m pytest tests/test_benchmarks_finops_rbac.py -v</code> · Regenerate report: <code>python scripts/generate_benchmark_report.py</code></sub></p>
+
+Less tool output and catalog noise per turn means lower LLM input cost — without sending prompts to a third-party optimizer API.
 
 **Bottom line:** MCP turned every server into an agent gateway overnight. Bastion is the firewall that makes that gateway safe to run in production — in **three lines of code** or one config file.
 
@@ -182,12 +295,12 @@ All **10** [OWASP MCP Top 10](https://owasp.org/www-project-mcp-top-10/) risks a
 | ID | Risk | Bastion controls |
 |----|------|------------------|
 | MCP01 | Token / secret exposure | PII redaction, audit trail, outbound response scan |
-| MCP02 | Privilege escalation | RBAC, rate limits, cost caps, session tool scope |
+| MCP02 | Privilege escalation | RBAC, **agent IAM**, rate limits, cost caps, session tool scope |
 | MCP03 | Tool poisoning | Prompt guard, content filter, response scan, metadata guard, grounding guard |
-| MCP04 | Supply chain | Circuit breaker, `doctor` CLI, audit, observability |
+| MCP04 | Supply chain | Circuit breaker, **`server_verification` checksums**, `doctor` CLI, `mcp-bastion manifest`, audit |
 | MCP05 | Command injection | Prompt guard, content filter, schema validation |
 | MCP06 | Intent subversion | Rate limits, replay guard, per-tool caps, semantic firewall |
-| MCP07 | Weak authentication | RBAC, edge auth |
+| MCP07 | Weak authentication | RBAC, edge auth, **agent IAM** (per-agent tokens) |
 | MCP08 | Audit & telemetry | Audit log, dashboard, Prometheus, OTEL, alerts |
 | MCP09 | Shadow MCP servers | Central `bastion.yaml` policy, metrics, discovery filter |
 | MCP10 | Context injection | PII redaction, response scan, output budget, discovery filter |
@@ -205,12 +318,12 @@ All **10** [OWASP MCP Top 10](https://owasp.org/www-project-mcp-top-10/) risks a
 
 **Token reduction & cost saving**
 
-| Lever | Controls |
-|-------|----------|
-| Smaller tool catalog in context | Discovery filter on `tools/list` |
-| Less output in every turn | Output budget, session offload, `bastion_get_offloaded` |
-| Fewer redundant calls | Semantic cache |
-| Predictable spend | Token budget caps, USD session/day limits |
+| Lever | Controls | Benchmark |
+|-------|----------|-----------|
+| Smaller tool catalog in context | Discovery filter on `tools/list` | ~85% catalog tokens (20→3 tools) — [BENCHMARKS.md](docs/BENCHMARKS.md) |
+| Less tool output in every turn | Output budget, session offload, `bastion_get_offloaded` | Up to ~99.7% on oversized dumps; 0% when under budget |
+| Fewer redundant calls | Lexical similarity cache (Jaccard overlap) | Exact repeat hits; paraphrase misses at 0.9 |
+| Predictable spend | Token budget caps, USD session/day limits | Session defaults on |
 
 Deep-dive mapping and integration hooks: [docs/SECURITY_OBSERVABILITY.md](docs/SECURITY_OBSERVABILITY.md) · [docs/ATTACK_PREVENTION.md](docs/ATTACK_PREVENTION.md)
 
@@ -238,7 +351,7 @@ middleware = build_middleware_from_config()  # loads bastion.yaml
 
 More paths (TypeScript, CI validate, Docker): **[docs/QUICK_START.md](docs/QUICK_START.md)** · **[docs/README.md](docs/README.md)** · **[website](https://vaquarkhan.github.io/MCP-Bastion/)**
 
-- **Prompt injection defense:** Meta PromptGuard blocks adversarial payloads locally.
+- **Prompt injection defense:** Heuristic jailbreak blocking out of the box; Meta PromptGuard ML when Hugging Face access is configured.
 - **PII redaction:** Presidio masks SSN, email, phone in outbound content.
 - **Denial-of-wallet protection:** Token buckets, iteration caps, token budget, cost tracking.
 - **Response scan:** Blocks jailbreak patterns in outbound tool/resource text.
@@ -308,7 +421,7 @@ Hooks into MCP SDKs (TypeScript, Python) and FastMCP via standard middleware. No
 
 ### Complete feature catalog
 
-**Pillar definitions:** Security controls, `bastion.yaml` sections, and how they relate to dashboard health rows are documented in [docs/PILLARS.md](docs/PILLARS.md) (canonical reference; avoids ambiguous “total pillar” counts). The same page lists **extended** features restored in 1.0.16+ (semantic firewall, sensitive classifier, external policy, edge auth, tool allowlist, session scope, tool metadata guard, multi-tenant, audit hash chain, pricing hooks, telemetry sinks, **red team** and **doctor** CLIs, etc.) and **FinOps/context** pillars in 1.0.17+ (output budget, discovery filter, response scan, grounding guard).
+**Pillar definitions:** Security controls, `bastion.yaml` sections, and how they relate to dashboard health rows are documented in [docs/PILLARS.md](docs/PILLARS.md) (canonical reference; avoids ambiguous “total pillar” counts). The same page lists **extended** features restored in 1.0.16+ (semantic firewall, sensitive classifier, external policy, edge auth, tool allowlist, session scope, tool metadata guard, multi-tenant, audit hash chain, pricing hooks, telemetry sinks, **red team** and **doctor** CLIs, etc.), **FinOps/context** pillars in 1.0.17+ (output budget, discovery filter, response scan, grounding guard), and **runtime governance** (agent IAM, server verification — introduced in 1.0.18+, **shipped in 2.0.0**).
 
 > **Deeper context:** [docs/SECURITY_OBSERVABILITY.md](docs/SECURITY_OBSERVABILITY.md) — **OWASP MCP Top 10** alignment, attack scenarios, and SIEM/log integrations. **Framework add-ons** (LangChain, OpenAI, Bedrock, …) are listed under [Framework Integrations](#framework-integrations) below.
 
@@ -324,7 +437,12 @@ Hooks into MCP SDKs (TypeScript, Python) and FastMCP via standard middleware. No
 
 | Feature | What you get |
 |--------|----------------|
-| **RBAC** | **Tool-level** allow/deny by **role** (from request metadata); map roles to tool names in `bastion.yaml`. |
+| **Agent IAM (Confused Deputy)** | Bind **API tokens** to **agent identities**; per-agent `allowed_tools` / `blocked_tools`, **resource URI** allow/block, optional rate limits — stops a support bot from calling admin tools or reading secret resources. See [docs/RUNTIME_GOVERNANCE.md](docs/RUNTIME_GOVERNANCE.md). |
+| **Full MCP surface guards (2.0.0)** | **`resources/read`**, **`prompts/get`**, **`sampling/createMessage`**, **`elicitation/create`** — same inbound/outbound pillars as tool calls (not only `tools/call`). [docs/MCP_SURFACE_AND_SCALE.md](docs/MCP_SURFACE_AND_SCALE.md) |
+| **Distributed state (2.0.0)** | **`state_backend: redis`** — shared rate limits, replay nonces, cost caps, session scope across replicas. `pip install mcp-bastion-python[redis]` |
+| **Server verification (supply chain)** | SHA-256 **manifest checksums** verified at startup and on every `tools/call`; `mcp-bastion manifest` generates trusted manifests after a signed-off build. |
+| **RBAC** | **Tool-level** allow/deny by **role** (from request metadata); **fnmatch globs** (`read_*`) with specificity-aware matching in `bastion.yaml`. **Pair with Agent IAM or edge auth** — alone, roles are only as trustworthy as whatever sets `metadata["role"]`. [Live matrix →](docs/BENCHMARKS.md#rbac-tool-level-opt-in) |
+| **Argument guards (2.0.0)** | **JSONPath + regex** block/redact on `tools/call` arguments before schema validation — stops shell injection and secret exfil in argv-style payloads. |
 | **Schema validation** | Validate `tools/call` arguments against **JSON Schema** before the tool runs (block malformed or bypass attempts). |
 | **Replay guard** | **Nonce** tracking to reject replayed requests (configurable **require_nonce**). |
 | **Rate limiting** | **Token-bucket** style limits: **max iterations** per session, **timeout**, **token budget**—stops runaway loops and brute-force patterns. |
@@ -334,15 +452,15 @@ Hooks into MCP SDKs (TypeScript, Python) and FastMCP via standard middleware. No
 
 | Feature | What you get |
 |--------|----------------|
-| **Cost tracker** | Per-**session** and optional per-**day** USD caps; blocks when budget is exceeded. |
-| **Semantic cache** | Optional **similarity-based** caching for tool semantics (reduce duplicate expensive calls). |
+| **Cost tracker** | Per-**session** and optional per-**day** USD caps; blocks when budget is exceeded. Optional **disk checkpoint** for restart-safe totals (memory backend). |
+| **Semantic cache** (lexical) | Optional **Jaccard word-overlap** cache for near-identical tool queries — not embedding-based; see [benchmarks](docs/BENCHMARKS.md#lexical-similarity-cache-opt-in-semantic-cache-in-config). |
 | **Low overhead** | Middleware on the hot path targeting **&lt;5 ms** typical overhead (see [docs/METRICS.md](docs/METRICS.md)). |
 
 #### Audit, metrics & alerting
 
 | Feature | What you get |
 |--------|----------------|
-| **Audit logging** | Structured **allow/deny** decisions with **reason**, **tool**, **tenant_id**, **trace_id**, **request_id**—feed SOC / compliance. |
+| **Audit logging** | Structured **allow/deny** decisions with **reason**, **tool**, **tenant_id**, **trace_id**, **request_id**—feed SOC / compliance. Optional **JSONL file sink** + **`mcp-bastion tail`**. |
 | **Alert sinks** | **Slack** incoming webhook; **generic HTTP** webhooks (PagerDuty, Teams, custom APIs); **multiple URLs**; **retry**, **backoff**, **timeout** in `bastion.yaml`. |
 | **In-memory metrics** | **Global MetricsStore**: requests, blocks, PII counts, cost, per-tool stats, latency samples, rolling **time series** buckets. |
 | **Real-time dashboard** | **Web UI** with a top **KPI summary** (totals, block %, top threat, active users/tenants), **traffic & block charts**, **blocked-by-reason/kind** (with readable reasons / tooltips), **PII by entity** (severity-style coloring, e.g. high-risk types emphasized), **top tools**, **cost by user**, **latency P50/P95/P99**, **forensics table** (tenant filter, trace/replay helpers), **recent alerts**, **insights & anomalies** (heuristic signals), **dark/light theme**, **Prometheus** `/metrics`, **JSON** `/api/metrics`, loading/empty guidance instead of a blank first paint. |
@@ -355,7 +473,7 @@ Hooks into MCP SDKs (TypeScript, Python) and FastMCP via standard middleware. No
 | **Policy-as-code** | Single **`bastion.yaml`**: toggles for all request-path controls plus audit, alerts, and hot reload ([docs/PILLARS.md](docs/PILLARS.md)); load via `load_config` / `build_middleware_from_config`. |
 | **Hot reload** | Optional **reload `bastion.yaml` on change** without restarting the MCP server ([docs/POLICY_AS_CODE.md](docs/POLICY_AS_CODE.md)). |
 | **Composable middleware** | **`compose_middleware`** ordering; **`MCPBastionMiddleware`** flags for each pillar. |
-| **CLI** | **`mcp-bastion validate`**, **`serve`** (HTTP MCP), **`dashboard`** (optional **`--reload`** / **`--demo`**), **`redteam`**, **`doctor`** — [docs/CLI.md](docs/CLI.md). |
+| **CLI** | **`mcp-bastion validate`**, **`manifest`** (SHA-256 manifest for server verification), **`serve`** (HTTP MCP), **`dashboard`** (optional **`--reload`** / **`--demo`**), **`redteam`**, **`doctor`** — [docs/CLI.md](docs/CLI.md). |
 | **Python + TypeScript** | **`mcp-bastion-python`** on PyPI; **`@mcp-bastion/core`** on npm for TypeScript MCP servers (rate limits in-process; prompt/PII via optional sidecar). |
 | **Containers** | **Dockerfile**, **docker-compose** profiles (proxy + optional dashboard) — [DOCKER.md](DOCKER.md). **Prebuilt images (GHCR):** [`mcp-bastion-proxy`](https://github.com/vaquarkhan/MCP-Bastion/pkgs/container/mcp-bastion-proxy), [`mcp-bastion-dashboard`](https://github.com/vaquarkhan/MCP-Bastion/pkgs/container/mcp-bastion-dashboard) — published on each `v*` tag ([publish-docker.yml](.github/workflows/publish-docker.yml)). |
 
@@ -429,6 +547,7 @@ Full index: **[docs/README.md](docs/README.md)** (docs hub) · published site en
 | [docs/SUPPLY_CHAIN.md](docs/SUPPLY_CHAIN.md) | CI merge gates, releases, npm provenance, PyPI Trusted Publishing |
 | [docs/INTEGRATION_MODELS.md](docs/INTEGRATION_MODELS.md) | Middleware + `bastion.yaml` vs “change base URL”; bridge for Python, TS, Desktop, HTTP, integrations |
 | [examples/ci/README.md](examples/ci/README.md) | Copy-paste GitHub Actions snippet to run `mcp-bastion validate` on your policy file |
+| [docs/BENCHMARKS.md](docs/BENCHMARKS.md) | **Measured** RBAC matrix, output-budget reduction (up to ~99% on large tool outputs), discovery filter, lexical cache — pytest + report generator |
 | [docs/REDTEAM.md](docs/REDTEAM.md) | Interpreting harness / red-team scores; which `bastion.yaml` pillars to enable; Node vs Python **scope** (`packages/core/README.md`) |
 | [docs/SECURITY_OBSERVABILITY.md](docs/SECURITY_OBSERVABILITY.md) | **OWASP MCP Top 10**, integration hooks, **fleet-scale `bastion.yaml` rollout**, **SIEM / SOC audit** patterns |
 | [docs/METRICS.md](docs/METRICS.md) | Performance overhead (&lt;5ms) and effectiveness metrics (dashboard, Prometheus, OTEL) |
@@ -437,6 +556,7 @@ Full index: **[docs/README.md](docs/README.md)** (docs hub) · published site en
 | [docs/QUICK_START.md](docs/QUICK_START.md) | Minimal FastMCP / `bastion.yaml` / CI snippets (time-to-value) |
 | [docs/DISCOVERY.md](docs/DISCOVERY.md) | Registry and ecosystem discovery checklist |
 | [docs/ROADMAP.md](docs/ROADMAP.md) | High-level directions; execution tracked in GitHub Issues |
+| [docs/ENGINEERING_10_10.md](docs/ENGINEERING_10_10.md) | Strategic path to 10/10 on injection depth, tool poisoning, gateway maturity, FinOps metrics, project maturity |
 | [CONTRIBUTING.md](CONTRIBUTING.md) | Contributor guide and **`good first issue`** ideas |
 
 ### One-Line Docker
@@ -489,7 +609,7 @@ On every pull request and push to `main`, [`.github/workflows/ci.yml`](.github/w
 
 1. `pip install -e ".[dev,policy,dashboard]"` — install the Python package with tests, YAML policy loading, and FastAPI for dashboard tests.
 2. `mcp-bastion validate --config bastion.yaml.example` — ensure the example policy file loads.
-3. `pytest --cov=mcp_bastion --cov-fail-under=92` — full Python test suite with **≥92%** line coverage on `src/mcp_bastion` (see `[tool.coverage.*]` in `pyproject.toml` for measured paths and gates).
+3. `python -m pytest --cov=mcp_bastion --cov-fail-under=92` — full Python test suite with **≥92%** line coverage on `src/mcp_bastion` (see `[tool.coverage.*]` in `pyproject.toml` for measured paths and gates).
 4. `npm ci` and `npm test` — TypeScript workspace tests.
 
 To validate **your** repo’s `bastion.yaml` in CI without cloning MCP-Bastion, see [examples/ci/README.md](examples/ci/README.md).
@@ -563,7 +683,7 @@ uv add mcp-bastion-python
 # or
 pip install mcp-bastion-python
 # pinned latest
-pip install mcp-bastion-python==1.0.17
+pip install mcp-bastion-python==2.0.0
 ```
 
 **Prerequisites (recommended)**
@@ -574,7 +694,9 @@ pip install mcp-bastion-python==1.0.17
 - **Policy-as-Code (`bastion.yaml`):** install YAML support:  
   `pip install mcp-bastion-python[policy]`  
   (adds `pyyaml`; otherwise you may get `ImportError` when loading policy files).
-- **PromptGuard fail-open:** if the PromptGuard model fails to load or inference errors, MCP-Bastion **allows** the request and logs a warning. Treat this as a security degradation and fix the model/runtime before production.
+- **Prompt injection (PromptGuard):** two layers:
+  1. **Regex heuristics** (always on) block obvious jailbreak strings such as “ignore previous instructions” — no model download required.
+  2. **Meta Llama Prompt Guard 2** (`meta-llama/Llama-Prompt-Guard-2-86M`) is a **gated** Hugging Face model. Request access, then run `huggingface-cli login`. Without ML, obvious attacks are still blocked; unverified payloads are **blocked** when `fail_open: false` (default). Run `mcp-bastion doctor` to verify ML availability.
 
 The PyPI wheel ships the full `mcp_bastion` tree (including `config`, `cli`, `otel`, dashboard metrics, and alert sinks). If you use an older wheel that omits modules, upgrade to the current release.
 
@@ -945,6 +1067,9 @@ When MCP-Bastion blocks a request, it returns standard MCP/JSON-RPC errors:
 | -32015 | `SessionScopeExceededError` | Too many distinct tools per session (scope creep) |
 | -32016 | `ToolMetadataPoisoningError` | Tool list / metadata failed safety checks |
 | -32017 | `GroundingViolationError` | Ungrounded file reference in tool output |
+| -32018 | `PromptGuardUnavailableError` | PromptGuard ML unavailable and fail-closed (or heuristics disabled) |
+| -32019 | `AgentAccessDeniedError` | Authenticated agent attempted a tool outside its IAM policy |
+| -32020 | `ServerVerificationError` | MCP server file checksums do not match trusted manifest |
 
 ```python
 # Python: exceptions
@@ -966,6 +1091,9 @@ from mcp_bastion.errors import (
     SessionScopeExceededError,
     ToolMetadataPoisoningError,
     GroundingViolationError,
+    PromptGuardUnavailableError,
+    AgentAccessDeniedError,
+    ServerVerificationError,
 )
 import logging
 logger = logging.getLogger(__name__)
@@ -990,6 +1118,9 @@ except (
     SessionScopeExceededError,
     ToolMetadataPoisoningError,
     GroundingViolationError,
+    PromptGuardUnavailableError,
+    AgentAccessDeniedError,
+    ServerVerificationError,
 ) as e:
     logger.warning("blocked: %s", e.to_mcp_error())
 ```
@@ -1029,7 +1160,7 @@ Connect via HTTP (`http://localhost:8000/mcp`) or stdio, then:
 
 ```bash
 # Python (PYTHONPATH=src on Windows: $env:PYTHONPATH="src")
-pytest tests/ -v
+python -m pytest tests/ -v
 
 # TypeScript
 npm run test --workspace=@mcp-bastion/core