v0.2.0: one-command demo and readable sample output

• agent-access-review demo reviews the bundled examples right after pip install; no clone needed.
• Committed sample-output/ so the report can be read without running anything; CI checks it stays current.
• Reproducible output: set SOURCE_DATE_EPOCH for byte-identical evidence and OSCAL (deterministic OSCAL UUIDs, LF line endings on every OS).
• Sources inside a scanned folder are recorded relative to it, so evidence hashes don't depend on the install path.
• OpenSSF Scorecard workflow, contributing guide and issue forms.

Install

pip install "git+https://github.com/Mihirajmera/agent-access-review@v0.2.0"
agent-access-review demo

v0.1.0: first release

First release of agent-access-review: user access reviews for AI agents and MCP servers.

What it does

• Reads MCP configs (Claude Desktop, Cursor, VS Code) and governed agents.yaml manifests
• Tests every agent against 12 controls, including owner and approval, least privilege, sandboxed execution, hardcoded secrets, dormant access, and exfiltration paths (sensitive data + untrusted input + egress with no human gate)
• Writes a reviewer packet with sign-off, a Keep / Modify / Revoke decision sheet, SHA-256-hashed evidence and OSCAL 1.1.2 assessment results
• Maps to NIST 800-53, SOC 2, NIST AI RMF and the OWASP Top 10 for LLM Applications

Install

pip install "git+https://github.com/Mihirajmera/agent-access-review@v0.1.0"
agent-access-review scan path/to/configs --fail-on high

Supply chain

Dependencies pinned exactly, GitHub Actions pinned to commit SHAs, CodeQL scanning, Dependabot, and private vulnerability reporting (see SECURITY.md).

This is an ongoing project. Issues and suggestions for the capability catalog are welcome.