securityagent-core 4.18.0__tar.gz

securityagent_core-4.18.0/LICENSE

@@ -0,0 +1,8 @@
+Copyright (c) 2026 SecureMind (securemind.live)
+
+All rights reserved.
+
+This software is proprietary. Unauthorized copying, distribution, modification,
+or use of this software, via any medium, is strictly prohibited.
+
+For licensing inquiries, contact: founders@securemind.live

securityagent_core-4.18.0/MANIFEST.in

@@ -0,0 +1,4 @@
+include LICENSE
+include README.md
+include pyproject.toml
+recursive-include src *.py

securityagent_core-4.18.0/PKG-INFO

@@ -0,0 +1,121 @@
+Metadata-Version: 2.4
+Name: securityagent-core
+Version: 4.18.0
+Summary: Local-first DLP engine and security layer for AI coding agents. Secures Copilot, Claude Code, Cursor, Windsurf, and any MCP-compatible agent.
+Author-email: SecureMind <founders@securemind.live>
+License: Proprietary
+Project-URL: Homepage, https://securemind.live
+Project-URL: Documentation, https://secure-mind-live.github.io/agnostic-security-site/
+Project-URL: Repository, https://github.com/secure-mind-live/securityagent-core
+Project-URL: Issues, https://github.com/secure-mind-live/securityagent-core/issues
+Keywords: security,dlp,ai-agents,llm,copilot,claude-code,cursor,mcp,pii,credentials
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: watchdog
+Requires-Dist: psutil
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pypdf
+Requires-Dist: openpyxl
+Requires-Dist: python-docx
+Requires-Dist: pyyaml
+Provides-Extra: ml
+Requires-Dist: sentence-transformers; extra == "ml"
+Requires-Dist: scikit-learn; extra == "ml"
+Requires-Dist: joblib; extra == "ml"
+Requires-Dist: numpy; extra == "ml"
+Provides-Extra: cloud
+Requires-Dist: boto3; extra == "cloud"
+Requires-Dist: PyJWT; extra == "cloud"
+Requires-Dist: cryptography; extra == "cloud"
+Provides-Extra: llm
+Requires-Dist: ollama; extra == "llm"
+Provides-Extra: ocr
+Requires-Dist: PyMuPDF; extra == "ocr"
+Requires-Dist: pytesseract; extra == "ocr"
+Requires-Dist: Pillow; extra == "ocr"
+Provides-Extra: dev
+Requires-Dist: pytest; extra == "dev"
+Requires-Dist: moto; extra == "dev"
+Provides-Extra: all
+Requires-Dist: securityagent-core[cloud,llm,ml,ocr]; extra == "all"
+Dynamic: license-file
+
+# securityagent-core
+
+Shared DLP engine, security skills, and policy enforcement for AI coding agents. Used by [SecurityAgent](https://github.com/kaushikdharamshi/SecurityAgent) and [AgnosticSecurity](https://github.com/kaushikdharamshi/AgnosticSecurity).
+
+## What's inside
+
+| Package | What it does |
+|---|---|
+| `endpoint_agent/` | DLP engine — file blocking (60+ path patterns), confidence-scored content scanning (PII, credentials, semantic disclosure detection) with structural validators (Luhn, SSA rules, entropy) and context-aware scoring, **data flow taint tracking** (tags sensitive data at ingress, detects at egress via hash/n-gram/substring matching), **tool call argument scanning** (MCP/function call DLP + taint registry), behavioral monitoring (8-signal anomaly scoring), honeypot traps, credential scanning. LLM intent analysis with llama3.1:8b default + fallback chain. Notebook-aware `.ipynb` extraction. PDF extraction via 3-tier pipeline (PyMuPDF → Tesseract OCR → pypdf fallback) with encrypted PDF detection |
+| `skills/` | Agent-agnostic MCP skills — `secure_read`, `secure_exec`, `analyze_prompt`, `scan_output`, `check_policy`, `get_session_policy`, `audit_log` |
+| `policy/` | Policy engine — per-session least privilege, behavioral chain detection (11 attack patterns), audit trail with agent attribution. Obsidian vault integration via `memory_bridge.py` for cross-session policy context |
+| `obsidianMemory/` | Obsidian vault — daily session logs, second-brain knowledge base, used by `memory_bridge.py` for persistent threat/policy tracking |
+| `plugin.py` | Standalone CLI entry point + `validate_exec()`, `validate_prompt()`, `validate_output()` pure functions |
+
+## Install
+
+```bash
+pip install git+https://github.com/kaushikdharamshi/securityagent-core.git
+
+# With optional dependencies
+pip install "securityagent-core[cloud] @ git+https://github.com/kaushikdharamshi/securityagent-core.git"
+pip install "securityagent-core[llm] @ git+https://github.com/kaushikdharamshi/securityagent-core.git"
+```
+
+## Usage
+
+### Python SDK
+
+```python
+from skills.adapters.python_sdk import SecurityAgentSDK
+
+sdk = SecurityAgentSDK(agent_id="my-agent", agent_type="langchain")
+
+# DLP-gated file read
+result = sdk.secure_read("/path/to/file")
+
+# Command validation
+result = sdk.secure_exec("ls -la")
+
+# Prompt intent analysis
+result = sdk.analyze_prompt("Get me all customer SSNs")
+```
+
+### MCP Server
+
+```bash
+python -m skills.adapters.mcp_server  # after pip install
+```
+
+Any MCP-compatible client (Claude Code, Copilot, custom agents) can connect via stdio JSON-RPC.
+
+### CLI
+
+```bash
+python -m plugin ~/.env                                    # File read gate
+python -m plugin --exec "cat ~/.env"                       # Exec validation
+python -m plugin --prompt "Get all passwords"              # Prompt analysis
+python -m plugin --skill secure_read --params '{"path":"~/.env"}'  # Skills layer
+python -m plugin --mcp-server                              # MCP server
+```
+
+### Claude Code Integration
+
+See [`integrations/claude_code/`](integrations/claude_code/) for PreToolUse hook configuration.
+
+## Tests
+
+```bash
+pip install -e ".[dev]"
+pytest
+```

securityagent_core-4.18.0/README.md

@@ -0,0 +1,71 @@
+# securityagent-core
+
+Shared DLP engine, security skills, and policy enforcement for AI coding agents. Used by [SecurityAgent](https://github.com/kaushikdharamshi/SecurityAgent) and [AgnosticSecurity](https://github.com/kaushikdharamshi/AgnosticSecurity).
+
+## What's inside
+
+| Package | What it does |
+|---|---|
+| `endpoint_agent/` | DLP engine — file blocking (60+ path patterns), confidence-scored content scanning (PII, credentials, semantic disclosure detection) with structural validators (Luhn, SSA rules, entropy) and context-aware scoring, **data flow taint tracking** (tags sensitive data at ingress, detects at egress via hash/n-gram/substring matching), **tool call argument scanning** (MCP/function call DLP + taint registry), behavioral monitoring (8-signal anomaly scoring), honeypot traps, credential scanning. LLM intent analysis with llama3.1:8b default + fallback chain. Notebook-aware `.ipynb` extraction. PDF extraction via 3-tier pipeline (PyMuPDF → Tesseract OCR → pypdf fallback) with encrypted PDF detection |
+| `skills/` | Agent-agnostic MCP skills — `secure_read`, `secure_exec`, `analyze_prompt`, `scan_output`, `check_policy`, `get_session_policy`, `audit_log` |
+| `policy/` | Policy engine — per-session least privilege, behavioral chain detection (11 attack patterns), audit trail with agent attribution. Obsidian vault integration via `memory_bridge.py` for cross-session policy context |
+| `obsidianMemory/` | Obsidian vault — daily session logs, second-brain knowledge base, used by `memory_bridge.py` for persistent threat/policy tracking |
+| `plugin.py` | Standalone CLI entry point + `validate_exec()`, `validate_prompt()`, `validate_output()` pure functions |
+
+## Install
+
+```bash
+pip install git+https://github.com/kaushikdharamshi/securityagent-core.git
+
+# With optional dependencies
+pip install "securityagent-core[cloud] @ git+https://github.com/kaushikdharamshi/securityagent-core.git"
+pip install "securityagent-core[llm] @ git+https://github.com/kaushikdharamshi/securityagent-core.git"
+```
+
+## Usage
+
+### Python SDK
+
+```python
+from skills.adapters.python_sdk import SecurityAgentSDK
+
+sdk = SecurityAgentSDK(agent_id="my-agent", agent_type="langchain")
+
+# DLP-gated file read
+result = sdk.secure_read("/path/to/file")
+
+# Command validation
+result = sdk.secure_exec("ls -la")
+
+# Prompt intent analysis
+result = sdk.analyze_prompt("Get me all customer SSNs")
+```
+
+### MCP Server
+
+```bash
+python -m skills.adapters.mcp_server  # after pip install
+```
+
+Any MCP-compatible client (Claude Code, Copilot, custom agents) can connect via stdio JSON-RPC.
+
+### CLI
+
+```bash
+python -m plugin ~/.env                                    # File read gate
+python -m plugin --exec "cat ~/.env"                       # Exec validation
+python -m plugin --prompt "Get all passwords"              # Prompt analysis
+python -m plugin --skill secure_read --params '{"path":"~/.env"}'  # Skills layer
+python -m plugin --mcp-server                              # MCP server
+```
+
+### Claude Code Integration
+
+See [`integrations/claude_code/`](integrations/claude_code/) for PreToolUse hook configuration.
+
+## Tests
+
+```bash
+pip install -e ".[dev]"
+pytest
+```

securityagent_core-4.18.0/pyproject.toml

@@ -0,0 +1,57 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "securityagent-core"
+version = "4.18.0"
+description = "Local-first DLP engine and security layer for AI coding agents. Secures Copilot, Claude Code, Cursor, Windsurf, and any MCP-compatible agent."
+readme = "README.md"
+license = {text = "Proprietary"}
+requires-python = ">=3.11"
+authors = [
+    {name = "SecureMind", email = "founders@securemind.live"},
+]
+keywords = ["security", "dlp", "ai-agents", "llm", "copilot", "claude-code", "cursor", "mcp", "pii", "credentials"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+]
+dependencies = [
+    "watchdog",
+    "psutil",
+    "pydantic>=2.0",
+    "pypdf",
+    "openpyxl",
+    "python-docx",
+    "pyyaml",
+]
+
+[project.urls]
+Homepage = "https://securemind.live"
+Documentation = "https://secure-mind-live.github.io/agnostic-security-site/"
+Repository = "https://github.com/secure-mind-live/securityagent-core"
+Issues = "https://github.com/secure-mind-live/securityagent-core/issues"
+
+[project.scripts]
+secagent = "endpoint_agent.cli:main"
+
+[project.optional-dependencies]
+ml = ["sentence-transformers", "scikit-learn", "joblib", "numpy"]
+cloud = ["boto3", "PyJWT", "cryptography"]
+llm = ["ollama"]
+ocr = ["PyMuPDF", "pytesseract", "Pillow"]
+dev = ["pytest", "moto"]
+all = ["securityagent-core[ml,cloud,llm,ocr]"]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+pythonpath = ["src"]
+testpaths = ["tests", "src/endpoint_agent/tests"]

securityagent_core-4.18.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

securityagent_core-4.18.0/src/endpoint_agent/__init__.py

@@ -0,0 +1,3 @@
+"""Local endpoint security agent for detecting malicious AI agents."""
+
+__version__ = "2.1.0"

securityagent_core-4.18.0/src/endpoint_agent/__main__.py

@@ -0,0 +1,105 @@
+"""
+CLI entry point for the endpoint security agent.
+
+Usage:
+    python -m endpoint_agent watch [--watch-dirs DIR ...]
+    python -m endpoint_agent scan [DIR ...]
+    python -m endpoint_agent status
+"""
+
+import argparse
+import logging
+import sys
+
+from endpoint_agent.config.settings import DEFAULT_WATCH_DIRS
+from endpoint_agent.engine import SecurityEngine
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        prog="endpoint_agent",
+        description="Local endpoint security agent - detects malicious AI agents and exposed credentials",
+    )
+    parser.add_argument(
+        "--verbose",
+        "-v",
+        action="store_true",
+        help="Enable debug logging",
+    )
+
+    subparsers = parser.add_subparsers(dest="command", help="Available commands")
+
+    # watch subcommand
+    watch_parser = subparsers.add_parser("watch", help="Start real-time monitoring")
+    watch_parser.add_argument(
+        "--watch-dirs",
+        nargs="+",
+        default=None,
+        help="Directories to monitor (default: home + cwd)",
+    )
+    watch_parser.add_argument(
+        "--log-file",
+        default=None,
+        help="Path for audit log (default: ~/.securityagent/audit.log)",
+    )
+    watch_parser.add_argument(
+        "--alert-webhook",
+        default=None,
+        help="Webhook URL for remote alert notifications",
+    )
+
+    # scan subcommand
+    scan_parser = subparsers.add_parser(
+        "scan", help="One-shot credential and threat scan"
+    )
+    scan_parser.add_argument(
+        "directories",
+        nargs="*",
+        default=["."],
+        help="Directories to scan (default: current directory)",
+    )
+    scan_parser.add_argument(
+        "--log-file",
+        default=None,
+        help="Path for audit log",
+    )
+
+    # status subcommand
+    subparsers.add_parser("status", help="Show current security status")
+
+    args = parser.parse_args()
+
+    # Configure logging
+    log_level = logging.DEBUG if args.verbose else logging.WARNING
+    logging.basicConfig(
+        level=log_level,
+        format="%(asctime)s [%(name)s] %(levelname)s: %(message)s",
+    )
+
+    if args.command is None:
+        parser.print_help()
+        sys.exit(1)
+
+    if args.command == "watch":
+        watch_dirs = args.watch_dirs or DEFAULT_WATCH_DIRS
+        engine = SecurityEngine(
+            watch_dirs=watch_dirs,
+            log_file=args.log_file,
+            webhook_url=args.alert_webhook,
+        )
+        engine.run_watch()
+
+    elif args.command == "scan":
+        engine = SecurityEngine(
+            watch_dirs=args.directories,
+            log_file=getattr(args, "log_file", None),
+        )
+        engine.run_scan(args.directories)
+
+    elif args.command == "status":
+        engine = SecurityEngine(watch_dirs=DEFAULT_WATCH_DIRS)
+        engine.run_status()
+
+
+if __name__ == "__main__":
+    main()

securityagent_core-4.18.0/src/endpoint_agent/alerting/alert_manager.py

@@ -0,0 +1,71 @@
+"""
+Central alert dispatcher.
+
+All monitors and scanners call alert_callback(severity, event_type, details)
+which routes through this manager to registered handlers.
+"""
+
+import logging
+import time
+from dataclasses import dataclass, field
+from typing import Any, Callable, Dict, List
+
+from endpoint_agent.config.settings import ALERT_DEDUP_WINDOW_SECONDS
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class SecurityAlert:
+    """Represents a single security alert."""
+
+    timestamp: float
+    severity: str
+    event_type: str
+    details: Dict[str, Any]
+    alert_id: str = ""
+
+    def __post_init__(self):
+        if not self.alert_id:
+            self.alert_id = f"{self.event_type}-{int(self.timestamp * 1000)}"
+
+
+class AlertManager:
+    """Central alert dispatcher. Routes alerts to registered handlers."""
+
+    def __init__(self):
+        self._handlers: List[Callable[[SecurityAlert], None]] = []
+        self._alert_history: List[SecurityAlert] = []
+        self._recent_keys: Dict[str, float] = {}
+
+    def register_handler(self, handler: Callable[[SecurityAlert], None]):
+        """Register an alert handler (console, log file, webhook, etc.)."""
+        self._handlers.append(handler)
+
+    def alert(self, severity: str, event_type: str, details: Dict[str, Any]):
+        """Create and dispatch an alert. This is the callback passed to all monitors."""
+        dedup_key = f"{event_type}:{details.get('path', '')}:{details.get('pid', '')}"
+        now = time.time()
+
+        if dedup_key in self._recent_keys:
+            if now - self._recent_keys[dedup_key] < ALERT_DEDUP_WINDOW_SECONDS:
+                return
+        self._recent_keys[dedup_key] = now
+
+        alert_obj = SecurityAlert(
+            timestamp=now,
+            severity=severity,
+            event_type=event_type,
+            details=details,
+        )
+        self._alert_history.append(alert_obj)
+
+        for handler in self._handlers:
+            try:
+                handler(alert_obj)
+            except Exception:
+                logger.exception("Alert handler failed for %s", event_type)
+
+    def get_history(self) -> List[SecurityAlert]:
+        """Return all alerts dispatched so far."""
+        return list(self._alert_history)

securityagent_core-4.18.0/src/endpoint_agent/alerting/console_handler.py

@@ -0,0 +1,27 @@
+"""Console alert handler with ANSI color-coded output."""
+
+import os
+import sys
+import time
+
+# Enable ANSI escape codes on Windows 10+
+if os.name == "nt":
+    os.system("")
+
+COLORS = {
+    "CRITICAL": "\033[91m",  # Red
+    "WARNING": "\033[93m",  # Yellow
+    "INFO": "\033[94m",  # Blue
+    "RESET": "\033[0m",
+}
+
+
+def console_alert_handler(alert):
+    """Print alerts to the terminal with color coding."""
+    color = COLORS.get(alert.severity, "")
+    reset = COLORS["RESET"]
+    ts = time.strftime("%Y-%m-%d %H:%M:%S", time.localtime(alert.timestamp))
+    print(
+        f"{color}[{alert.severity}]{reset} {ts} | {alert.event_type} | {alert.details}",
+        file=sys.stderr,
+    )

securityagent_core-4.18.0/src/endpoint_agent/alerting/log_handler.py

@@ -0,0 +1,34 @@
+"""JSON-lines audit log handler for persistent alert storage."""
+
+import json
+import logging
+import os
+import time
+
+from endpoint_agent.config.settings import DEFAULT_LOG_FILE
+
+logger = logging.getLogger(__name__)
+
+
+def create_log_handler(log_file=None):
+    """Factory: returns a handler function that writes alerts to a JSON log file."""
+    log_path = log_file or DEFAULT_LOG_FILE
+    os.makedirs(os.path.dirname(log_path), exist_ok=True)
+
+    def log_alert_handler(alert):
+        entry = {
+            "timestamp": time.strftime(
+                "%Y-%m-%dT%H:%M:%SZ", time.gmtime(alert.timestamp)
+            ),
+            "severity": alert.severity,
+            "event_type": alert.event_type,
+            "details": alert.details,
+            "alert_id": alert.alert_id,
+        }
+        try:
+            with open(log_path, "a") as f:
+                f.write(json.dumps(entry) + "\n")
+        except OSError:
+            logger.error("Failed to write audit log to %s", log_path)
+
+    return log_alert_handler

securityagent_core-4.18.0/src/endpoint_agent/alerting/webhook_handler.py

@@ -0,0 +1,68 @@
+"""
+Webhook and AWS SNS alert handlers for cloud-side notification.
+
+These are optional handlers - enabled via CLI flags or environment variables.
+"""
+
+import json
+import logging
+from urllib.error import URLError
+from urllib.request import Request, urlopen
+
+logger = logging.getLogger(__name__)
+
+
+def create_webhook_handler(webhook_url: str):
+    """Factory: returns a handler that POSTs alerts to a webhook URL."""
+
+    def webhook_alert_handler(alert):
+        payload = json.dumps(
+            {
+                "severity": alert.severity,
+                "event_type": alert.event_type,
+                "details": alert.details,
+                "alert_id": alert.alert_id,
+            }
+        ).encode("utf-8")
+
+        req = Request(
+            webhook_url,
+            data=payload,
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        try:
+            with urlopen(req, timeout=5) as resp:
+                logger.debug("Webhook response: %d", resp.status)
+        except (URLError, OSError):
+            logger.warning("Failed to send webhook alert to %s", webhook_url)
+
+    return webhook_alert_handler
+
+
+def create_sns_handler(topic_arn: str, region: str = "us-east-1"):
+    """Factory: returns a handler that publishes alerts to an AWS SNS topic."""
+
+    def sns_alert_handler(alert):
+        try:
+            import boto3
+
+            client = boto3.client("sns", region_name=region)
+            client.publish(
+                TopicArn=topic_arn,
+                Subject=f"[{alert.severity}] {alert.event_type}"[:100],
+                Message=json.dumps(
+                    {
+                        "source": "endpoint_agent",
+                        "severity": alert.severity,
+                        "event_type": alert.event_type,
+                        "details": alert.details,
+                        "alert_id": alert.alert_id,
+                    },
+                    indent=2,
+                ),
+            )
+        except Exception:
+            logger.warning("Failed to publish SNS alert to %s", topic_arn)
+
+    return sns_alert_handler