Skip to content

2026-10-07_CLI_v1.0.1

Latest
Latest

Choose a tag to compare

View all tags
@CyberStrategy1 CyberStrategy1 released this 07 Oct 17:01
· 20 commits to main since this release
CLI_v1.0.1
9f92160
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🟠 AI SAFE² CLI v1.0.1: Green Means Green

MCP SCORING • MCP GATES • SKILL TRUST GATE • PROJECT GATE • VERIFIED PYPI RELEASE

Why It Matters · Before and After · What's New · Quick Start · Security · Validation · Release PR

Explore the repository: Start Here · Upgrade Notes · Command Map · Assessment Evidence

💡 Why should I care and use this now?

A gate that says "safe" when it is not is worse than no gate. We ran an adversarial
battery against our own tooling and found exactly that.

Can you trust a green result from this CLI? In 1.0.0 and 0.9.0, not always.
In 1.0.1, every case we found fails closed.

  • An MCP server whose tool description instructs credential theft no longer passes CI.
  • Hostile skills are rejected, not approved.
  • A project running shell=True and eval() on model output no longer clears Tier 2.
  • 1.0.1 is the first 1.0 build on PyPI. 1.0.0 shipped on GitHub only.

🔄 Before → After

Case1.0.0 / 0.9.01.0.1
MCP server with a credential-theft tool description, a self-published attestation and empty OAuth metadata87/100 "Acceptable", badge earned, passed --ci-fail-below 7029/100, badge withheld, safe2 gate mcp exits 1
Self-attested controls (.well-known/mcp-security.json)Added up to 25 pointsReported as claimed, never scored
16 hostile skills (paraphrased overrides, Unicode tags, homoglyphs, env exfiltration, persistence, trigger hijack)9 approved16 rejected
Project with shell=True and eval() on LLM outputTier 2 pass at 90/100Fails at 49/100; a CRITICAL finding caps the score
safe2 gate mcp PATH on a TypeScript server, an obfuscated server, or a vulnerable file renamed to test_server.py0 findings, passDetected, exit 1. A clean server still passes.
Poisoned tool output through wrap-stdio --block; rug-pulled catalog through wrap-proxy --pin-schemaDelivered to the clientWithheld
Control cited in finding textCould differ from the control in the JSONAlways the emitted v3.1 CP.5.MCP control
pip install ai-safe2==1.0.xFailed: 1.0.0 never reached PyPIWorks; the release workflow installs it from PyPI to confirm

🧰 What's new?

Command or capabilityChangeCode
safe2 score mcp / safe2 gate mcp URLScore cannot be bought by self-attestation or unvalidated OAuth metadata. Hostile schema content caps the score, withholds the badge and fails the gate.score/assessor.py
safe2 scan mcp / safe2 gate mcp PATHPython and TypeScript sinks previously missed, obfuscated execution, correct line attribution, no evasion by file name. Generic advisories no longer fail clean servers.scan/pattern_scanner.py
safe2 mcp wrap-stdio / wrap-proxyBlock mode withholds poisoned content; schema pinning withholds a changed catalog; audit records name the tool and method.wrap/wrapper.py
safe2 gate skillNew rules TG-013 to TG-024. All 16 hostile test skills are rejected.engines/skill_gate.py
safe2 gate (project)A CRITICAL finding caps the score.scanner/scanner.py
Release pipelineDated <date>_CLI_X.Y.Z tags publish; the upload is verified by installing from PyPI; a weekly audit flags any release missing from PyPI.publish.yml

Commands and schemas are unchanged from 1.0.0. Scores and gate results can change, so re-run gates rather than reusing 1.0.0 or 0.9.x results. DEP findings now cite MCP-4 (was MCP-3), matching the v3.1 control map.

🚀 Quick start

python -m pip install --upgrade "ai-safe2[all]==1.0.1"
safe2 --version
safe2 self-check --strict
safe2 gate mcp ./my-mcp-server
safe2 score mcp https://my-server.example/mcp
safe2 gate skill ./my-skill --strict

Safety note: safe2 score mcp sends live MCP requests to the URL you give it. Point it only at servers you are allowed to test.

Read the upgrade notes.

🛡️ Security and evidence boundaries

  • Pattern detectors are a floor. Paraphrased or novel payloads can still pass.
  • A remote score is a black-box view. It cannot see server code, internal logging or egress controls.
  • A passing gate is decision evidence, not a conformance claim or a release approval.
  • NEXUS and the MCP knowledge server are separate packages. Their fixes are in the repository but ship in their own releases.

Supported versions and reporting.

🧪 Validation and compatibility

  • Four-area adversarial battery: 126 pass, 0 fail. 62 cases that failed on 1.0.0 now pass, with no regressions.
  • Local CI mirror: 31/31 gates, including OPA 0.65.0 and 1.4.2, semgrep and gitleaks.
  • Every regression test was run red on the pre-fix code and green after.
  • The publish workflow for this tag runs the full test suite, builds, uploads and installs from PyPI before reporting success.
  • All results are self-assessed by the maintainers' tooling. They are not independent validation.

Fix PR #393 ·
Consistency PR #395 ·
Evidence and reproduce commands

🧭 What stays the same?

AI SAFE² v3.1, the 161 core controls, the 19-control CP.5.MCP profile, and every safe2 command name and output schema.

➡️ What comes next?

  • A NEXUS release carrying the Guardian, AgBOM and OPA fixes.
  • ACT tiers bound to the registered agent identity are merged and ship in the next NEXUS release (#394).

These are roadmap items, not capabilities in this release.

Upgrade, re-run your gates, and trust the green.

Get Started · Complete Guide · Report an Issue · Framework Home

Assets 2
Loading