v1.3.0 - MCP permission/secrets misconfig ruleset
sentinel-scan mcp: permission/secrets misconfig heuristics
Extends the zero-network, zero-dependency `sentinel-scan mcp` static scanner with four additional heuristic classes, all dual-tagged against OWASP LLM Top 10 and OWASP MCP Top 10 (beta):
- unpinned_remote_source (LLM03 / MCP04): flags `mcpServers` entries that launch a package via npx/uvx/pip/etc with no pinned version, or that use a plaintext `http://` remote transport
- hardcoded_credential (LLM02 / MCP03): flags literal API keys/tokens/passwords embedded in a server's `env` block or CLI args instead of an `${ENV_VAR}` placeholder
- overbroad_tool_scope (LLM06 / MCP06): flags wildcard/blanket scope or permission strings (`"*"`, `"all"`, `"admin"`) instead of an enumerated least-privilege list
- missing_provenance (LLM03 / MCP04): flags a remote-sourced server entry with no signature/checksum/publisher field to verify what's actually being launched
Also included since v1.1.0:
- `missing_hitl_confirmation` and `hidden_unicode_instructions` heuristics
- OWASP MCP Top 10 (beta) dual-tagging alongside the existing LLM Top 10 tags on every finding
- 40-fixture benchmark corpus (`fixtures/benchmark/`) with per-technique severity labels for cross-scanner comparison
This is a static config lint against the manifest text/schema only - it does not execute the MCP server or call an LLM. Full technique table and heuristic-by-heuristic docs: see README.md.
```bash
pip install git+https://github.com/Ventrova/sentinel-scan-cli
sentinel-scan mcp --demo
```
Note: the PyPI and npm packages are still a few releases behind `master` (missing the `mcp` subcommand entirely on the npm side) - install from GitHub for the latest.