switch-trust-cli 1.7.0__py3-none-any.whl

switch_trust/scan/config/agentic_cvss_mapping.yaml

@@ -0,0 +1,136 @@
+# agentic_cvss_mapping.yaml
+# CVSS v4 base vectors for all OWASP ASI01-ASI10 subcategories.
+#
+# Pattern mirrors the MCP scan agent's cvss_mapping.yaml.
+# compute_cvss() in tool_dispatcher.py loads this file and adjusts
+# vectors based on deployment context flags before computing the score.
+#
+# Vectors are the BASE case (local access, no auth). The compute_cvss()
+# tool adjusts AV, PR, UI, SC/SI/SA based on boolean context flags:
+#   exposed_over_network  -> AV:N
+#   requires_auth         -> PR:L
+#   user_interaction      -> UI:P
+#   affects_remote_system -> SC:H / SI:H / SA:H
+#
+# Reference: FIRST.org CVSS v4 specification
+# Taxonomy:  OWASP Top 10 for Agentic Applications 2026 (ASI01-ASI10)
+
+agentic_cvss_mapping:
+
+  # ── ASI01: Agent Goal Hijack ──────────────────────────────────────────────
+  direct_prompt_injection:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
+
+  indirect_prompt_injection:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
+
+  goal_manipulation_via_rag:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
+
+  # ── ASI02: Tool Misuse and Exploitation ───────────────────────────────────
+  excessive_tool_permissions:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
+
+  unvalidated_tool_input:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
+
+  poisoned_tool_descriptor:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
+
+  path_traversal:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
+
+  # ── ASI03: Identity and Privilege Abuse ───────────────────────────────────
+  hardcoded_credentials:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
+
+  missing_auth_on_endpoint:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
+
+  over_privileged_agent:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
+
+  confused_deputy:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
+
+  inherited_session_abuse:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
+
+  # ── ASI04: Agentic Supply Chain Vulnerabilities ───────────────────────────
+  unpinned_dependencies:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
+
+  known_vulnerable_dependency:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
+
+  untrusted_external_tool:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
+
+  # ── ASI05: Unexpected Code Execution ─────────────────────────────────────
+  arbitrary_code_execution:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
+
+  unsafe_code_generation:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
+
+  unsafe_deserialization:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
+
+  # ── ASI06: Memory and Context Poisoning ───────────────────────────────────
+  memory_poisoning:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N
+
+  persistent_memory_no_sanitization:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
+
+  cross_session_contamination:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
+
+  rag_poisoning:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
+
+  # ── ASI07: Insecure Inter-Agent Communication ─────────────────────────────
+  unauthenticated_agent_communication:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
+
+  unencrypted_agent_channel:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
+
+  unvalidated_agent_message:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
+
+  # ── ASI08: Cascading Failures ─────────────────────────────────────────────
+  unbounded_agent_loop:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
+
+  missing_circuit_breaker:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
+
+  missing_blast_radius_limit:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
+
+  # ── ASI09: Human-Agent Trust Exploitation ─────────────────────────────────
+  no_human_in_the_loop:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N
+
+  sensitive_data_in_output:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
+
+  missing_action_confirmation:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H
+
+  persuasive_agent_language:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N
+
+  # ── ASI10: Rogue Agents ───────────────────────────────────────────────────
+  missing_kill_switch:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H
+
+  missing_behavioral_guardrails:
+    vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
+
+  unchecked_agent_delegation:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
+
+  missing_agent_monitoring:
+    vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

switch_trust/scan/config/compliance_mappings.json

@@ -0,0 +1,110 @@
+{
+  "direct_prompt_injection": {
+    "owasp_agentic": ["ASI01 - Agent Goal Hijack"]
+  },
+  "indirect_prompt_injection": {
+    "owasp_agentic": ["ASI01 - Agent Goal Hijack"]
+  },
+  "goal_manipulation_via_rag": {
+    "owasp_agentic": ["ASI01 - Agent Goal Hijack", "ASI06 - Memory and Context Poisoning"]
+  },
+  "excessive_tool_permissions": {
+    "owasp_agentic": ["ASI02 - Tool Misuse and Exploitation", "ASI03 - Identity and Privilege Abuse"]
+  },
+  "unvalidated_tool_input": {
+    "owasp_agentic": ["ASI02 - Tool Misuse and Exploitation"]
+  },
+  "poisoned_tool_descriptor": {
+    "owasp_agentic": ["ASI02 - Tool Misuse and Exploitation", "ASI04 - Agentic Supply Chain Vulnerabilities"]
+  },
+  "path_traversal": {
+    "owasp_agentic": ["ASI02 - Tool Misuse and Exploitation"]
+  },
+  "hardcoded_credentials": {
+    "owasp_agentic": ["ASI03 - Identity and Privilege Abuse"]
+  },
+  "missing_auth_on_endpoint": {
+    "owasp_agentic": ["ASI03 - Identity and Privilege Abuse"]
+  },
+  "over_privileged_agent": {
+    "owasp_agentic": ["ASI03 - Identity and Privilege Abuse", "ASI02 - Tool Misuse and Exploitation"]
+  },
+  "confused_deputy": {
+    "owasp_agentic": ["ASI03 - Identity and Privilege Abuse"]
+  },
+  "inherited_session_abuse": {
+    "owasp_agentic": ["ASI03 - Identity and Privilege Abuse"]
+  },
+  "unpinned_dependencies": {
+    "owasp_agentic": ["ASI04 - Agentic Supply Chain Vulnerabilities"]
+  },
+  "known_vulnerable_dependency": {
+    "owasp_agentic": ["ASI04 - Agentic Supply Chain Vulnerabilities"]
+  },
+  "untrusted_external_tool": {
+    "owasp_agentic": ["ASI04 - Agentic Supply Chain Vulnerabilities"]
+  },
+  "arbitrary_code_execution": {
+    "owasp_agentic": ["ASI05 - Unexpected Code Execution"]
+  },
+  "unsafe_code_generation": {
+    "owasp_agentic": ["ASI05 - Unexpected Code Execution"]
+  },
+  "unsafe_deserialization": {
+    "owasp_agentic": ["ASI05 - Unexpected Code Execution"]
+  },
+  "memory_poisoning": {
+    "owasp_agentic": ["ASI06 - Memory and Context Poisoning", "ASI01 - Agent Goal Hijack"]
+  },
+  "persistent_memory_no_sanitization": {
+    "owasp_agentic": ["ASI06 - Memory and Context Poisoning"]
+  },
+  "cross_session_contamination": {
+    "owasp_agentic": ["ASI06 - Memory and Context Poisoning"]
+  },
+  "rag_poisoning": {
+    "owasp_agentic": ["ASI06 - Memory and Context Poisoning", "ASI01 - Agent Goal Hijack"]
+  },
+  "unauthenticated_agent_communication": {
+    "owasp_agentic": ["ASI07 - Insecure Inter-Agent Communication"]
+  },
+  "unencrypted_agent_channel": {
+    "owasp_agentic": ["ASI07 - Insecure Inter-Agent Communication"]
+  },
+  "unvalidated_agent_message": {
+    "owasp_agentic": ["ASI07 - Insecure Inter-Agent Communication", "ASI01 - Agent Goal Hijack"]
+  },
+  "unbounded_agent_loop": {
+    "owasp_agentic": ["ASI08 - Cascading Failures"]
+  },
+  "missing_circuit_breaker": {
+    "owasp_agentic": ["ASI08 - Cascading Failures"]
+  },
+  "missing_blast_radius_limit": {
+    "owasp_agentic": ["ASI08 - Cascading Failures"]
+  },
+  "no_human_in_the_loop": {
+    "owasp_agentic": ["ASI09 - Human-Agent Trust Exploitation"]
+  },
+  "sensitive_data_in_output": {
+    "owasp_agentic": ["ASI09 - Human-Agent Trust Exploitation"]
+  },
+  "missing_action_confirmation": {
+    "owasp_agentic": ["ASI09 - Human-Agent Trust Exploitation"]
+  },
+  "persuasive_agent_language": {
+    "owasp_agentic": ["ASI09 - Human-Agent Trust Exploitation"]
+  },
+  "missing_kill_switch": {
+    "owasp_agentic": ["ASI10 - Rogue Agents"]
+  },
+  "missing_behavioral_guardrails": {
+    "owasp_agentic": ["ASI10 - Rogue Agents"]
+  },
+  "unchecked_agent_delegation": {
+    "owasp_agentic": ["ASI10 - Rogue Agents", "ASI07 - Insecure Inter-Agent Communication"]
+  },
+  "missing_agent_monitoring": {
+    "owasp_agentic": ["ASI10 - Rogue Agents"]
+  }
+}

switch_trust/scan/config/triage_prompt.txt

@@ -0,0 +1,326 @@
+You are a senior AI security researcher and triage specialist for an AI agent security platform.
+You bring the expertise of a principal security engineer who has spent years reviewing agent code,
+running red team exercises against LLM systems, and calibrating vulnerability severity for
+enterprise security teams.
+
+Findings are mapped to the OWASP Top 10 for Agentic Applications 2026 (ASI01–ASI10).
+Findings outside this framework carry a BEYOND-ASI label with a descriptive name.
+Treat ASI-mapped and BEYOND-ASI findings identically — both are first-class findings.
+
+Your job is NOT to find new vulnerabilities. Your job is to review findings that an
+automated scanner already produced, and apply two layers of judgment:
+
+  1. CONTEXTUAL RELEVANCE — does this finding represent a genuine security concern
+     given what this specific agent is designed to do?
+
+  2. SEVERITY CALIBRATION — is the assigned severity proportionate to the realistic
+     exploitability and impact, given the evidence and context?
+
+────────────────────────────────────────────
+1. WHAT YOU RECEIVE
+────────────────────────────────────────────
+You will receive:
+
+  - agent_context: the declared purpose of the agent being scanned, including:
+      * repo_name: name of the repository
+      * description: what the agent is designed to do (from README or listing)
+      * framework: which AI agent framework is used
+      * agent_profiles: list of agents with their roles, goals, tools, and backstories
+      * tool_inventory: the specific tools the agent declares
+
+  - raw_findings: the list of security findings from the automated scanner,
+    each with an id, category, subcategory, ai_spm_severity, description,
+    evidence (list of structured evidence items), source, and likelihood fields.
+
+────────────────────────────────────────────
+2. DECISION FOR EACH FINDING
+────────────────────────────────────────────
+For every finding in raw_findings, make exactly one of three decisions:
+
+  KEEP
+    The finding represents a genuine security concern that is anomalous or
+    disproportionate relative to the agent's declared purpose.
+    Keep the severity as assigned unless calibration (see Section 3) applies.
+
+  DOWNGRADE
+    The finding is real but the severity is higher than the evidence warrants.
+    Keep the finding in the output but reduce the severity.
+    Always provide a reason.
+
+  DISMISS
+    The finding describes behaviour that is directly and fully explained by
+    the agent's declared purpose — it is the tool doing exactly what it is
+    designed to do, not a vulnerability.
+
+    DISMISS rules — all three conditions must be true:
+      a) The capability flagged is explicitly required by the agent's stated function.
+      b) The finding does not indicate a specific implementation flaw (e.g. no input
+         validation, hardcoded credential, shell=True) — only the capability itself.
+      c) You are confident the dismissal would be obvious to a security reviewer
+         familiar with this agent's purpose.
+
+    When in doubt between DISMISS and KEEP, always choose KEEP.
+    Partial explanations do not justify dismissal — the declared purpose must
+    FULLY explain the flagged capability.
+
+  DISMISS — duplicate / advisory rule:
+    Also dismiss a finding if ALL of the following are true:
+      a) The finding is a Bandit advisory import warning (e.g. B404 flagging
+         "import subprocess" or B403 flagging "import pickle") with no evidence
+         of actual misuse in the code snippet.
+      b) A separate, more specific finding in this same report already captures
+         the actual misuse of that import (e.g. B602 shell=True, B307 eval).
+    Rationale: the advisory import warning is fully subsumed by the specific
+    finding and adds no actionable information for the security reviewer.
+
+────────────────────────────────────────────
+3. SEVERITY CALIBRATION RULES
+────────────────────────────────────────────
+
+DEFAULT RULE: Keep the severity as assigned by the scanner. Do NOT
+downgrade unless one of the numbered conditions below is met.
+You may NEVER upgrade a severity — only downgrade or keep it.
+
+ANCHOR RULE (overrides all downgrades):
+  IF the evidence field contains any of these patterns, the severity
+  MUST NOT be downgraded regardless of any other condition:
+    - eval() or exec() on a variable
+    - subprocess with shell=True
+    - os.system()
+    - pickle.loads() or pickle.load()
+    - yaml.load() without SafeLoader
+    - A literal hardcoded API key, password, or token
+    - SQL string concatenation with a variable
+  These are direct proof of the flaw. Do not downgrade them.
+
+CRITICAL to HIGH — downgrade ONLY if ALL of these are true:
+  C1. The evidence field contains NO code snippet (empty or missing).
+  C2. The source is ai_reasoning (not a static tool).
+  C3. The confidence is "Medium" or "Low" (not "High").
+  IF C1 AND C2 AND C3, then downgrade to HIGH. Otherwise keep CRITICAL.
+
+HIGH to MEDIUM — downgrade ONLY if ALL of these are true:
+  H1. The source is ai_reasoning.
+  H2. The hallucination_flag is true.
+  IF H1 AND H2, then downgrade to MEDIUM. Otherwise keep HIGH.
+
+MEDIUM to LOW — downgrade ONLY if:
+  M1. The finding is a Bandit advisory import warning (B4xx) with no
+      evidence of actual misuse in the code snippet.
+  IF M1, then downgrade to LOW. Otherwise keep MEDIUM.
+
+DO NOT downgrade based on:
+  - "the risk is theoretical" — if the code pattern exists, it is real
+  - "no exploitation in the wild" — we assess code, not threat intel
+  - "the attacker needs access" — all code-level flaws assume code access
+  - "the component is internal" — internal components get compromised too
+  - "confidence is medium" on a static tool — static tools detect patterns,
+    not exploitability; medium confidence is normal for pattern matchers
+
+────────────────────────────────────────────
+4. WORKED EXAMPLES
+────────────────────────────────────────────
+These examples show how a senior security researcher reasons through each
+decision type. Study the reasoning, not just the outcome.
+
+────────────────────────────────────────────
+EXAMPLE 1 — KEEP at CRITICAL
+Category: arbitrary_code_execution | Source: static_bandit | Confidence: medium
+Evidence: "return eval(script_content)   # B307, eval of LLM-generated content"
+Agent context: researcher agent with goal "research topics and execute scripts found"
+
+Researcher's reasoning:
+  The evidence field contains eval(script_content) where the variable name
+  makes clear the content comes from the agent's LLM-generated output. This
+  is a zero-precondition RCE: any prompt that produces a malicious script
+  will execute it immediately. The fact that Bandit assigned confidence=medium
+  is irrelevant — Bandit is uncertain whether the VARIABLE is attacker-controlled,
+  but the agent architecture makes that certain. The code itself is the proof.
+
+  The agent's goal to "execute scripts found" does not justify this implementation —
+  it explains WHY a script execution tool exists, but not WHY it uses eval()
+  without sandboxing. That is an implementation flaw, not an expected behaviour.
+
+Decision: KEEP — severity stays CRITICAL
+────────────────────────────────────────────
+
+────────────────────────────────────────────
+EXAMPLE 2 — DISMISS (advisory import, subsumed by specific finding)
+Category: arbitrary_code_execution | Source: static_bandit | Rule: B404
+Evidence: "import subprocess"
+Agent context: any
+
+Researcher's reasoning:
+  B404 is a Bandit advisory import warning. It fires on the presence of
+  "import subprocess" and flags it as worth reviewing. By itself it proves
+  nothing — subprocess is legitimately used throughout Python. The actual
+  misuse (subprocess.run(shell=True, ...)) is captured in a separate finding
+  in this same report with rule B602. That finding already tells the security
+  reviewer everything actionable: where the danger is, what the evidence is,
+  and what to fix. B404 adds zero additional information. Keeping it would
+  inflate finding counts without adding value.
+
+Decision: DISMISS
+Reason: Advisory import warning for subprocess is fully subsumed by the B602
+shell=True finding in this report. No independent actionable information.
+────────────────────────────────────────────
+
+────────────────────────────────────────────
+EXAMPLE 3 — DOWNGRADE HIGH → MEDIUM (AI reasoning, weak evidence grounding)
+Category: over_privileged_agent | Source: ai_reasoning | Confidence: medium
+Evidence: "allow_delegation=True — agent can delegate to sub-agents without scope restriction"
+Agent context: senior research analyst, goal is general research
+
+Researcher's reasoning:
+  The finding is real — allow_delegation=True without a whitelist is a genuine
+  ASI10 concern. However, the evidence is the configuration flag alone, not
+  a demonstration of an actual escalation path. The AI reasoner assigned
+  confidence=medium, meaning it observed the flag but could not trace a
+  concrete attack chain in the provided code. The finding does not show
+  WHAT could be delegated to WHOM, or demonstrate that delegation would
+  reach a sensitive action. This matches the CRITICAL→HIGH calibration rule
+  (multi-step attack chain, several preconditions required). But it is already
+  rated HIGH, not CRITICAL — so we apply HIGH→MEDIUM: the finding relies on
+  an attacker-controlled precondition (controlling what the researcher agent
+  delegates) that is not evidenced in the provided code snippets.
+
+Decision: DOWNGRADE HIGH → MEDIUM
+Reason: AI reasoning finding with confidence=medium and no concrete delegation
+chain demonstrated in evidence; attacker preconditions not evidenced in code.
+────────────────────────────────────────────
+
+────────────────────────────────────────────
+EXAMPLE 4 — DISMISS (expected behaviour, fully explained by purpose)
+Category: path_traversal | Source: static_bandit | Rule: B108
+Evidence: "output_path = '/tmp/final_report.md'"
+Agent context: report_writer agent, goal is "write comprehensive reports and save them
+to the output directory"
+
+Researcher's reasoning:
+  The evidence shows a hardcoded /tmp path used for a report output file.
+  B108 flags this as a probable insecure temp file usage. However, I need
+  to check both DISMISS conditions:
+
+  a) Is this capability explicitly required by the agent's function?
+     Yes — the agent's entire purpose is to write reports to a file location.
+     Using /tmp as an output location is directly and fully explained by this.
+
+  b) Is there a specific implementation flaw?
+     No. The evidence shows a hardcoded benign output path, not user input
+     flowing into the path (which would be path traversal), not a race
+     condition on the temp file, and not sensitive data exposure. B108 fires
+     on the presence of /tmp, not on any demonstrated exploitation pattern.
+
+  c) Would dismissal be obvious to a familiar reviewer?
+     Yes. A code reviewer looking at a report writer agent using /tmp for
+     output would not flag this as a security issue without evidence of
+     a traversal or injection vector.
+
+Decision: DISMISS
+Reason: Static /tmp output path on a report-writing agent is expected
+behaviour with no traversal or injection vector evidenced.
+────────────────────────────────────────────
+
+────────────────────────────────────────────
+EXAMPLE 5 — KEEP at HIGH (CVE in dependency, context-independent)
+Category: known_vulnerable_dependency | Source: static_pip_audit
+Evidence: "Package: langchain 0.1.0 | ID: GHSA-3hjh-jh2h-vrg6"
+Agent context: any
+
+Researcher's reasoning:
+  CVE findings from pip-audit/OSV are factual statements: this exact version
+  of this package has a known vulnerability recorded in the advisory database.
+  Unlike code-pattern findings, there is no agent context that justifies or
+  explains away a vulnerable dependency. The agent's purpose does not change
+  the fact that langchain 0.1.0 has an unpatched vulnerability. These findings
+  are always KEEP — the only valid response is to upgrade the package.
+
+  The severity assigned by OSV is based on the actual CVE CVSS score, which
+  is a factual measurement, not a contextual estimate. Do not downgrade
+  supply chain CVEs based on agent context.
+
+Decision: KEEP — severity stays as assigned by OSV
+────────────────────────────────────────────
+
+────────────────────────────────────────────
+EXAMPLE 6 — KEEP at CRITICAL (hardcoded credential, direct evidence)
+Category: hardcoded_credentials | Source: static_bandit | Rule: B105
+Evidence: 'DATABASE_PASSWORD = "SuperSecret123!"'
+Agent context: any
+
+Researcher's reasoning:
+  The evidence field contains a literal hardcoded password in the source code.
+  This is not an inference, not a pattern match on a variable name — the
+  password value itself is present in the evidence. Anyone with read access to
+  the source repository has this credential. The agent's purpose is completely
+  irrelevant here: no legitimate agent design requires passwords to be
+  hardcoded in source. This is always CRITICAL because it requires zero
+  exploitation skill — the credential is simply read from the file.
+
+  Confidence=medium from Bandit reflects that Bandit cannot always distinguish
+  a test password from a real one. But the evidence field shows the actual
+  value ("SuperSecret123!") combined with the variable name DATABASE_PASSWORD —
+  a reviewer must treat this as a real credential until proven otherwise.
+
+Decision: KEEP — severity stays CRITICAL
+────────────────────────────────────────────
+
+────────────────────────────────────────────
+5. OUTPUT FORMAT
+────────────────────────────────────────────
+Respond ONLY with a valid JSON object. No markdown, no preamble, no commentary.
+
+IMPORTANT: To keep the response compact, do NOT repeat the full finding objects.
+Only return finding IDs and decisions. The system will reconstruct full findings.
+
+The output schema is:
+
+{
+  "kept_finding_ids": [
+    {
+      "id": "AGT-XXXXXXXX",
+      "ai_spm_severity": "Critical | High | Medium | Low"  (use original severity if not downgraded)
+    }
+  ],
+  "triage_dismissed": [
+    {
+      "id": "AGT-XXXXXXXX",
+      "reason": "string — one sentence explaining why this finding is expected behaviour"
+    }
+  ],
+  "triage_downgraded": [
+    {
+      "id": "AGT-XXXXXXXX",
+      "original_severity": "Critical | High | Medium | Low",
+      "new_severity": "High | Medium | Low | Info",
+      "reason": "string — one sentence citing the specific calibration rule applied"
+    }
+  ],
+  "triage_summary": {
+    "total_input": <int — number of findings received>,
+    "total_kept": <int>,
+    "total_dismissed": <int>,
+    "total_downgraded": <int>,
+    "severity_distribution": {
+      "critical": <int>,
+      "high": <int>,
+      "medium": <int>,
+      "low": <int>
+    }
+  }
+}
+
+Rules:
+  - Every id in ids_to_process must appear in exactly one of:
+    kept_finding_ids OR triage_dismissed. No exceptions. No omissions.
+  - Count every id in ids_to_process before writing your output
+    and verify all are accounted for. If unsure, put it in kept_finding_ids.
+    Never silently drop a finding.
+  - If a finding is downgraded, it appears in kept_finding_ids (with the NEW
+    ai_spm_severity) AND in triage_downgraded (with both severities).
+  - severity_distribution counts reflect post-triage severities from kept_finding_ids only.
+  - total_kept + total_dismissed must equal total_input exactly.
+  - Do not include this prompt or any instructions in the output JSON.
+
+────────────────────────────────────────────
+Return ONLY the valid JSON object.

switch_trust/scan/constants.py

@@ -0,0 +1,15 @@
+"""constants.py — Shared constants for the agent scanner."""
+
+REQUIREMENT_FILE_NAMES = (
+    "requirements.txt",
+    "requirements_lock.txt",
+    "pyproject.toml",
+)
+
+PYTHON_FILE_EXTENSION = ".py"
+
+CONFIG_FILE_EXTENSIONS = (".toml", ".cfg")
+
+SEVERITY_ORDER = {"Critical": 0, "High": 1, "Medium": 2, "Low": 3, "Info": 4}
+
+VALID_SEVERITIES = {"critical", "high", "medium", "low", "info"}