pharosone-security-scanner 0.1.0__py3-none-any.whl

pharosone_security_scanner-0.1.0.dist-info/METADATA

@@ -0,0 +1,259 @@
+Metadata-Version: 2.4
+Name: pharosone-security-scanner
+Version: 0.1.0
+Summary: PharosOne Security Scanner — a behavioral vulnerability scanner (red-team) for AI agents
+Project-URL: Homepage, https://pharosone.ai
+Project-URL: Documentation, https://pharosone.ai
+Author-email: PharosOne <dmitry@pharosone.ai>
+Maintainer-email: PharosOne <dmitry@pharosone.ai>
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Keywords: ai-agents,ai-security,aiuc-1,inspect-ai,llm,prompt-injection,red-team,vulnerability-scanner
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Requires-Python: >=3.12
+Requires-Dist: anthropic>=0.40
+Requires-Dist: fastapi>=0.110
+Requires-Dist: httpx>=0.27
+Requires-Dist: inspect-ai>=0.3.240
+Requires-Dist: jinja2>=3.1
+Requires-Dist: openai>=1.0
+Requires-Dist: pydantic>=2.7
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: typer>=0.12
+Requires-Dist: uvicorn>=0.29
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+<div align="center">
+
+# PharosOne Security Scanner
+
+**Point it at your AI agent. It wires itself in, red-teams it, and hands you an audit-ready report.**
+
+[**Website**](https://pharosone.ai) · [Architecture](docs/architecture.md) · [Experiments](benchmarks/variation_strategies/README.md) · [Design specs](docs/design/)
+
+![License](https://img.shields.io/badge/license-Apache--2.0-blue)
+![Python](https://img.shields.io/badge/python-3.12%2B-blue)
+![Probes](https://img.shields.io/badge/attack%20probes-118-green)
+![Standard](https://img.shields.io/badge/maps%20to-AIUC--1-8A2BE2)
+
+</div>
+
+> [!TIP]
+> The fastest way in is the **`pharosone` skill**. Run it in Claude Code, point it at your agent's
+> repository, and it does the wiring for you — investigate → wrap → scan → report. Jump to
+> [Quick start](#-quick-start).
+
+---
+
+## Overview
+
+Traditional scanners check configuration and code. An AI agent's most dangerous failures are
+**behavioral** — it can be talked into leaking its system prompt, calling a dangerous tool with
+attacker-controlled arguments, trusting an instruction smuggled inside a document it ingested, or
+laundering a record's status past a decision gate. None of that shows up in a static scan; it only
+appears when you *drive the agent and watch what it does*.
+
+PharosOne Security Scanner runs a versioned, **agent-agnostic** corpus of attack **probes** (YAML),
+mutates and repeats each one against your agent, decides success with a deterministic oracle backed
+by an LLM judge, and maps the evidence onto the **AIUC‑1** control standard through an
+ATLAS / OWASP‑Agentic / CWE crosswalk — producing an audit-ready report with attack success rates,
+confidence intervals, and surfaced blind spots.
+
+> **Authorized testing only.** This is an offensive-security tool. Use it exclusively against agents
+> you own or have explicit written permission to test. See [Responsible use](#responsible-use).
+
+---
+
+## 🚀 Quick start
+
+You don't hand-write test harnesses. The **`pharosone` skill** onboards a real agent for you as a
+guided conversation.
+
+**1. Add the skill**
+
+```bash
+npx skills add pharosone/pharosone
+```
+
+That installs the `pharosone` skill (and its sub-skills) into Claude Code — nothing to clone or set
+up by hand.
+
+**2. Point it at your agent, in Claude Code**
+
+Ask Claude to red-team your agent and give it the path to the agent's repository — for example:
+
+```
+Use the pharosone skill to red-team the agent in ../my-support-agent
+```
+
+The skill then, as a guided flow:
+
+- **Investigates** the agent — its topology (in-process / local HTTP / remote), tool inventory, and
+  untrusted input channels.
+- **Asks a few scoping questions** — which standard(s) to certify against, how deep/expensive to go,
+  and which models run the target and the attacker. It **never asks for a secret key** — only the
+  **environment-variable name** that holds it.
+- **Wraps the agent** in a bridge adapter (see below), builds a run profile, validates everything,
+  and **launches the scan with live progress**, ending in a JSON + Markdown report.
+
+---
+
+## How it wraps your agent
+
+The scanner only catches "did a thing it shouldn't" when the agent's actions are **observable** and
+its untrusted inputs are **injectable**. So the skill generates a **bridge adapter** that cuts the
+agent at its **narrowest reachable waist** — above the messy layers (auth / transport /
+serialization), below the agent's reasoning — where:
+
+- every **tool call is observable** (the scanner sees exactly what the agent decided to do),
+- every **untrusted channel is injectable** (message, retrieved document, tool result, memory, a
+  record field, an image, …), and
+- real **side effects are neutralized** — writes and outbound actions are recorded, never executed.
+
+You never rewrite the agent; you adapt only its I/O. The adapter exposes `external()`, declares which
+`channels()` it can route poison into, and maps the agent's concrete tools to canonical capabilities.
+See the worked example in [`harness/example-agent/`](harness/example-agent/) and the framework-agent
+template in [`examples/bridge_real_agent.py`](examples/bridge_real_agent.py).
+
+---
+
+## ✨ Architecture & why it's different
+
+A run is a fixed pipeline; the CLI and the web UI both drive the same `run_corpus`:
+
+```
+corpus → selection → variation → compile → eval (target) → oracle → judge → aggregate → coverage → report
+```
+
+**What sets it apart:**
+
+- **Judge-only success.** The semantic invariant lives in the **oracle** and an **LLM judge**, never
+  in the prompt text. A deterministic oracle stamps a provisional per-trial hit; a post-eval batch
+  judge then adjudicates *all* of a probe's trials and sets the verdict. This is what makes heavily
+  mutated / obfuscated attack rewrites safe to use without breaking scoring.
+- **Blind spots are never silent passes.** Selection is an *execution* parameter, not a report
+  filter. A probe whose required capability, channel, or context the target doesn't declare is
+  **skipped and surfaced** — never re-routed onto another surface and never counted as "robust".
+- **Statistical, not anecdotal.** Every probe is repeated and reported as an attack success rate with
+  a Wilson confidence interval, not a single lucky jailbreak.
+- **Standard-mapped output.** Findings resolve to **AIUC‑1** controls; controls that aren't
+  behaviorally testable are marked `not_testable`, never "failed".
+- **Data decoupled from code.** Attacks, the standard, and the crosswalk are versioned data — extend
+  along one axis at a time (drop a probe YAML, add a standard, add a target adapter).
+
+Deep dives:
+
+- 📐 **Architecture** — [`docs/architecture.md`](docs/architecture.md) (principles, the variation
+  subsystem, scoring, standards mapping, with diagrams).
+- 🧪 **Experiments** — [`benchmarks/variation_strategies/README.md`](benchmarks/variation_strategies/README.md)
+  (empirical comparison of attack-variation policies and LLM-judge calibration).
+- 📄 **Design specs** — [`docs/design/`](docs/design/).
+
+---
+
+## Corpus & standards
+
+- **118 attack probes** (`corpus/probes/*.yaml`) — prompt injection & extraction, indirect injection
+  over ingestion channels, tool-misuse and authorization gaps, state/status laundering, output
+  exfiltration, a coding/deploy threat pack (unreviewed/unauthorized deploy, supply-chain backdoors,
+  CI-gate tampering), and cross-session memory campaigns.
+- **AIUC‑1** control standard (`frameworks/aiuc-1.yaml`) mapped via a research-derived crosswalk
+  (`crosswalks/aiuc-1/`) over ATLAS / OWASP Agentic / CWE coordinates.
+
+Attack techniques are adapted from published open-source research (see [`NOTICE`](NOTICE)); upstream
+payload datasets are **not** redistributed.
+
+---
+
+## Running it directly (CLI)
+
+The skill is the recommended path, but the scanner is a normal CLI too (`probe-engine`). Install from
+source:
+
+```bash
+git clone git@github.com:pharosone/pharosone.git
+cd pharosone
+uv sync --extra dev
+```
+
+**Validate** the corpus, framework, and crosswalk:
+
+```bash
+uv run probe-engine validate \
+  --corpus corpus/probes --framework frameworks/aiuc-1.yaml \
+  --crosswalk crosswalks/aiuc-1/crosswalk.yaml
+```
+
+**Run** against a target and write reports to `reports/out/`:
+
+```bash
+uv run probe-engine run --profile configs/profiles/finance-support-agent.yaml \
+  --corpus corpus/probes --framework frameworks/aiuc-1.yaml \
+  --crosswalk crosswalks/aiuc-1/crosswalk.yaml --out reports/out
+```
+
+**Serve** the web UI (live run progress):
+
+```bash
+uv run probe-engine serve            # http://127.0.0.1:8000
+```
+
+See [`configs/profiles/`](configs/profiles/) and [`examples/industries/`](examples/industries/) for
+example run profiles.
+
+---
+
+## Requirements — models & keys
+
+Real red-teaming needs **LLM access on both sides**:
+
+- **Target side** — the agent under test runs on its own model (the `bridge` tier reaches your real
+  agent; the `model` tier runs a synthetic agent on a real LLM).
+- **Attacker side** — an LLM generates the mutated/adaptive attacks and acts as the semantic judge
+  that decides success.
+
+Keys are read from the **environment only** and stay in memory for the run — never written to disk or
+logs; the skill asks for env-var **names**, never key values.
+
+A deterministic **`mock` tier** needs no model and no key — it drives the whole pipeline offline and
+is what the test suite (783 tests) and CI use. It's great for trying the pipeline, corpus
+development, and demos, but it does **not** exercise a real agent; use `model`/`bridge` for actual
+scanning.
+
+---
+
+## Responsible use
+
+> [!WARNING]
+> This is a **dual-use offensive-security tool**. Run it **only** against AI agents you own or are
+> explicitly authorized in writing to test. You are responsible for compliance with applicable laws
+> and with the terms of any model provider or platform you exercise during a run. Reports from runs
+> configured with `protected_snippets` or the coding/deploy pack are **sensitive** — when those
+> oracles fire, the agent's own leaked text or malicious code is retained in the evidence *by design*
+> (it is the proof). See [`SECURITY.md`](SECURITY.md); report tool vulnerabilities to
+> **security@pharosone.ai** (not a public issue).
+
+---
+
+## Contributing
+
+New probes, standards, target adapters, and crosswalk entries all extend cleanly along a single axis.
+See [`CONTRIBUTING.md`](CONTRIBUTING.md) and [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md). Questions:
+**dmitry@pharosone.ai**.
+
+## License
+
+**Apache License 2.0** — see [`LICENSE`](LICENSE). Third-party attributions in [`NOTICE`](NOTICE).
+
+---
+
+<sub>PharosOne Security Scanner · [pharosone.ai](https://pharosone.ai)</sub>

pharosone_security_scanner-0.1.0.dist-info/RECORD

@@ -0,0 +1,72 @@
+probe_engine/__init__.py,sha256=NoyQGxggg9h5bKpP5K4NriuFtzK2b3ycTVSz_3b0aFg,53
+probe_engine/cli.py,sha256=cv3NDjBW1Ko8dR2zG76ZQqJ-Df7NS6rXVl0r27LNTsc,18134
+probe_engine/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/compile/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/compile/compiler.py,sha256=aEEjL-BD-rFqnhPv7YwPzxtDyB8BLF4wXl0K9XsHqqA,3160
+probe_engine/config/__init__.py,sha256=q51UaO6aIQb-YKVNrrmSw0vZW-TRV8Ax3_BkKErFmY0,73
+probe_engine/config/profile.py,sha256=9sebvS2ejUg0Q6GaLwbcRXeyUIsydiVsjIQlSeWo0lE,4083
+probe_engine/corpus/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/corpus/loader.py,sha256=Q3iqQm83kI0yfbr6WInzmdWIwX629qPMdWTYxSEf3Hc,1340
+probe_engine/domain/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/domain/base.py,sha256=OhxZjYLfPTultxyJDMe7rzsnouef_g4yhedG3a1yBMA,247
+probe_engine/domain/coverage.py,sha256=AUH5cQmexLLCp5JH5K1C0QUPOVk1Yk3owGMzunn2ezE,884
+probe_engine/domain/crosswalk.py,sha256=phDCrrb6DIxTzgdPwa7o0X6jlWBNe5NCBA0PyZSSrZU,1166
+probe_engine/domain/enums.py,sha256=dZpnjvcwzQ3meoOJHGb7vvpSvhVpMV3GC2tPqWCIr1A,1795
+probe_engine/domain/evidence.py,sha256=daXlSyzwYUrnKRIfNM2Y6SHPcBUzQHLqwLZ73zqNM1U,2111
+probe_engine/domain/framework.py,sha256=K2A__kaQeHmR_ygRh10pD_NEQBZRdfq7E1BVAIvz3A4,1908
+probe_engine/domain/probe.py,sha256=hdnzsftNaxhVV6zfJ5wI0G8itZajw0OozQpvUK0Vx2w,6396
+probe_engine/domain/run.py,sha256=aRmZQ4gScAE8xOptOQnihSicFFearLFEK7TIxI10hlw,11767
+probe_engine/domain/taxonomy.py,sha256=w-HccogIkKce8ltcUaPVV2z7w1DJ0L2qo3amse8IFHs,661
+probe_engine/mapping/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/mapping/coverage.py,sha256=9_T5DrSdXLrgL6vmmE4O1_Jw6iaVdyIt1Qe4FbDL-NY,3245
+probe_engine/mapping/loader.py,sha256=eXjwLTycBBww4TfV0iYoTdEYLYe3j8vsnvAyzSCfEeA,1137
+probe_engine/plan/__init__.py,sha256=g6CZ-AfiiQrf6KQ9btAqblzy4ak6wFkl8uOq5wg2QWw,792
+probe_engine/plan/allocate.py,sha256=9miH-6FbmujpmtRLVqvb_JFC0gygMX78gtg1wNJtmtE,20254
+probe_engine/plan/library_spec.py,sha256=91u3z-8V-hg9m-L2dVJGr7VS54X_R61NOnxWW5XFs5k,7486
+probe_engine/plan/models.py,sha256=g8y_v2d0mCc3jPNrIxj3r7rKiUg-DmNLVhZmAiWT0BY,4775
+probe_engine/plan/synthesize.py,sha256=wmjqYoXkM3rPstbAjTOUqfitleqjhwyf0_GdkQMuSJE,15948
+probe_engine/report/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/report/builder.py,sha256=jjdilSkemCgjLdybRCFtODoPlcneLJSfM8TCm3dQt3g,11961
+probe_engine/report/model.py,sha256=R83L1q0AWTNB6JZyEFdDGB0oMrU2kZbxgdIPLMrIIrY,6018
+probe_engine/report/render_json.py,sha256=joNEpfGq-UuuVGYS1yxxF0xHGDrsPMY4Mt7oJKe_R6o,3584
+probe_engine/report/render_markdown.py,sha256=RQDLQBlbc8FmsrOaO45gDBV7yVKv61GU2j3dHA7EZa8,13632
+probe_engine/run/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/run/checkpoint.py,sha256=uTCjz6i-HCe62W4ibEg40ip36Mxuo2IXKrEv6BjJLoY,5848
+probe_engine/run/executor.py,sha256=-PfYhjsDdKTHXQF6xSoA-1C45tXUFFzCY8wym5f0-zI,34601
+probe_engine/run/selection.py,sha256=125mmDc_P5aFAoqHwGtdzS38sOfLzF1Qg_5l8mvv0Mk,6646
+probe_engine/sandbox/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/sandbox/state.py,sha256=Bl019Nyf_EppOZBa9_pkG2OY6uLJzGlKUeqwWTiMHeQ,7962
+probe_engine/sandbox/tools.py,sha256=xdDbUTUnZn7iMD05K_2UFCE8pdUxYuxC0oNodNz_f68,4617
+probe_engine/scoring/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/scoring/aggregate.py,sha256=9heFpeg8oRM0ft7BXZQRwrIX_9a6QtYksxfPBq6N-Dw,2625
+probe_engine/scoring/batch_judge.py,sha256=hkMlEo8aD1SiEgkZVlOyB4CxEoH8blSkIoKpqhWWI60,17271
+probe_engine/scoring/judge.py,sha256=WZp-yDhpqtYt0TciX9Y-UrB3YtrTXIWnSvWxkqInQXI,7888
+probe_engine/scoring/oracle.py,sha256=AZ6Qj0JBW-AeB8_Oy52aWQ28Py91iZD-orQXmExbyMc,18312
+probe_engine/scoring/statistics.py,sha256=az6wqgFfNMcmt3FQY_-z3D0hv9QbwAyLie631-NeRF0,1246
+probe_engine/scoring/unverified.py,sha256=4R2Y6D0A-DnUcsscGngjSGjCqMykTWxEmNbCSykIupo,3735
+probe_engine/targets/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/targets/adaptive.py,sha256=wEBFSMEFNA8DFq449Ug62FDVb7iYzYRKGAy6qADHrsQ,14444
+probe_engine/targets/agent_context.py,sha256=HZ_dYGOFS-RHOCeLGWdsvbi1fcRnkNkTkT4iZU2Q3rk,5138
+probe_engine/targets/bridge.py,sha256=BZKNwIrikgtUI1Mv2rGlyq7k1PXudM2SFOH_n-0v7-Y,13658
+probe_engine/targets/capabilities.py,sha256=I4lMrdBUZog4yh1H9qxQKoGrXimWrTTpHDetdzNQkDA,1360
+probe_engine/targets/mock.py,sha256=XRV76-c5WAr1g8moKyyyjBvXWp1DnjTD_uNDJibcNQw,11714
+probe_engine/targets/model.py,sha256=dgxPgWXXPPW1zNtbybTaMsjgbFznKJLcWDt7_dUC7BY,3009
+probe_engine/targets/registry.py,sha256=15qiC0LxYGSbDT-FowH-HXQbvViA_sM2hYzoqObOns4,4878
+probe_engine/util/__init__.py,sha256=JWLl12kbS8_awsYE7F1IAx5EwJRdNBptKEPH92bnqvE,78
+probe_engine/util/resilient_generate.py,sha256=Kmr64w5nQCn8xRq9JQetsIIiXst6kc4Ru58MCeAG7M4,6710
+probe_engine/variation/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+probe_engine/variation/batch_pregen.py,sha256=LxmkzVZc7xsbuPMj0un75c_KXYb5vsvedBwcfp_MB4A,10097
+probe_engine/variation/generate.py,sha256=o2AEac5x_RUELpBTUjWSHidNCPuqwftToVAUQmeLPgQ,7263
+probe_engine/variation/llm_paraphrase.py,sha256=YliPXTrmmAyMV_t7oi7dMAX-ZCwjhWg3RLkHM2O41J4,8880
+probe_engine/variation/mutators.py,sha256=LgEttdmNaM7L5nz28Z0ta4KnYP8crnqDLE66_NOs4jU,1808
+probe_engine/variation/obfuscate.py,sha256=VibL3KGbZgOizLiTKUWMF-_kWq9bYij7OaGrL_4saVU,11617
+probe_engine/variation/techniques.py,sha256=NMBTlOpza7zpiVgITCc0pghdM4yQgk_d9WLWWihujQ8,20577
+probe_engine/web/__init__.py,sha256=_PPqpzK4YubjsnLLQP6K1hqEoC5F6JxCVeT6fN89LkM,35
+probe_engine/web/app.py,sha256=QFyU-FNx6XaB8NiYbO20HvB0dj00TI-EzdLV0JIq_XQ,14204
+probe_engine/web/static/index.html,sha256=0vZvWOLgk7iEatvBduSwRQRYAo5FejNDk6Vk43eUg5Y,18567
+pharosone_security_scanner-0.1.0.dist-info/METADATA,sha256=gS6PHjw1ujX9c7mFu-fn1grNspkTrv4ywpI6HXtLrNY,11006
+pharosone_security_scanner-0.1.0.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+pharosone_security_scanner-0.1.0.dist-info/entry_points.txt,sha256=B3Bzt8HMzZhcixPMaFDaYxosccVoXz28dxUy0jRW1-E,54
+pharosone_security_scanner-0.1.0.dist-info/licenses/LICENSE,sha256=xDIbFAixacO0jlQeqYhkqHYNUPRicnlAxYZkYWdxI2w,11339
+pharosone_security_scanner-0.1.0.dist-info/licenses/NOTICE,sha256=6hyKxcCMW-F6oMXlgtw07YUZmAdchZmBJzBmz34Fhug,3611
+pharosone_security_scanner-0.1.0.dist-info/RECORD,,

pharosone_security_scanner-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.31.0
+Root-Is-Purelib: true
+Tag: py3-none-any

pharosone_security_scanner-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+probe-engine = probe_engine.cli:app

pharosone_security_scanner-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 PharosOne
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

pharosone_security_scanner-0.1.0.dist-info/licenses/NOTICE

@@ -0,0 +1,60 @@
+PharosOne Probe Engine — third-party attributions
+==================================================
+
+The attack corpus (corpus/probes/*.yaml) includes probes whose attack TECHNIQUES are
+adapted from third-party open-source security research. Each probe records its origin in
+its `provenance` block (source + url). This NOTICE summarizes those derivations.
+
+Important: PharosOne adapts the attack *technique and a representative payload* and
+re-expresses it in the engine's own probe format and voice (multi-channel, multi-turn,
+capability-mapped, English). It does NOT vendor or redistribute the upstream projects'
+verbatim payload datasets. Where a probe's fidelity differs from the upstream (e.g. a
+non-text modality approximated on another channel, or a content-harm payload retargeted to
+a tool-misuse oracle), the probe's `provenance.source` carries a `fidelity:` note.
+
+
+garak — LLM vulnerability scanner (NVIDIA)
+------------------------------------------
+~58 probes under id `garak-*` adapt attack techniques from garak's probe modules
+(latentinjection, web_injection, ansiescape, packagehallucination, encoding, smuggling,
+badchars, dra, goodside, suffix, glitch, adaptive_attacks, atkgen, tap, goat, fitd, dan,
+continuation, realtoxicityprompts, lmrc, donotanswer, topic, grandma, doctor, misleading,
+phrasing, snowball, divergence, leakreplay, malwaregen, exploitation, apikey,
+av_spam_scanning, fileformats, sysprompt_extraction, sata, visual_jailbreak, audio,
+agent_breaker, propile).
+
+  Project:  garak — https://github.com/NVIDIA/garak
+  License:  Apache License 2.0 — https://www.apache.org/licenses/LICENSE-2.0
+  Use:      attack techniques adapted into PharosOne probe specs; garak source/datasets
+            are not redistributed. Per-probe attribution in provenance.source/url.
+
+This product includes software developed by NVIDIA CORPORATION & AFFILIATES (garak),
+licensed under the Apache License, Version 2.0.
+
+
+Other third-party sources cited in probe provenance
+---------------------------------------------------
+  MCPTox                — tool-poisoning research — https://arxiv.org/abs/2508.14925
+  AgentDyn              — dynamic agent attack benchmark — https://arxiv.org/abs/2602.03117
+  agent_threat_bench    — agent threat scenarios (Inspect Evals, UK AI Safety Institute) —
+                          https://github.com/UKGovernmentBEIS/inspect_evals
+
+Probes marked `source: "PharosOne (original)"` are original to this project.
+
+
+Standards and taxonomies
+------------------------
+The framework (frameworks/aiuc-1.yaml) and crosswalk (crosswalks/aiuc-1/crosswalk.yaml) reference
+the following third-party standards by their published control/technique identifiers and labels.
+These are cited for interoperability; the mappings are research-derived and flagged for SME review.
+
+  AIUC-1                — AI Usage & Controls standard — https://aiuc-1.com
+                          Control wordings are quoted from the published AIUC-1 text; treated as
+                          reference. Redistribution of the full catalogue is pending owner/legal review.
+  MITRE ATLAS           — Adversarial Threat Landscape for AI Systems — https://atlas.mitre.org
+  MITRE CWE             — Common Weakness Enumeration — https://cwe.mitre.org
+  OWASP Agentic         — OWASP Agentic Security Initiative / GenAI —
+                          https://genai.owasp.org
+
+MITRE ATLAS and CWE are © The MITRE Corporation; OWASP materials are © the OWASP Foundation.
+Identifiers and labels are used under their respective terms for reference and interoperability.

probe_engine/__init__.py

@@ -0,0 +1,3 @@
+"""PharosOne Probe Engine."""
+
+__version__ = "0.1.0"