Skip to content

v0.4.0 — OWASP ASI/MCP Top 10 mapping + MCP tool-poisoning detection

Marketplace
Marketplace

Choose a tag to compare

View all tags
@akanthed akanthed released this 20 Jul 17:49
· 61 commits to main since this release
v0.4.0
1cd93d8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The first release mapped to all three OWASP AI security frameworks — the LLM Top 10 (2025), the Top 10 for Agentic Applications (2026, ASI01–ASI10), and the MCP Top 10 (2025) — plus three new rules that catch the pattern behind real-world incidents like the postmark-mcp backdoor and the WhatsApp MCP rug-pull.

Added

  • Three-framework OWASP mapping — every rule tagged with LLM Top 10, ASI (Agentic), and MCP Top 10 IDs across terminal, Markdown, HTML, JSON, and SARIF output
  • OWASP coverage matrix in secureai-scan threat-model — shows exactly which of the 30 risks across all three frameworks are covered, which fired, and which are runtime-only concerns
  • MCP007 — invisible/bidi Unicode hidden in MCP tool names or descriptions (critical, proven)
  • MCP008 — agent-directed injection phrases in tool descriptions (high, likely) — the WhatsApp MCP rug-pull / postmark-mcp pattern
  • MCP009 — cross-tool shadowing, where one tool's description redirects calls meant for another (medium, likely)
  • DEP003 — known-malicious/critically-vulnerable dependency advisories (postmark-mcp, mcp-remote CVE-2025-6514), checked offline on every scan — no flag required, covers package.json, requirements.txt, and packages launched from MCP configs

All new rules ship with both TypeScript AST and Python implementations.

Changed

  • --only-mcp now also runs MCP007–MCP009
  • --rules accepts DEP001–DEP003
Assets 2
Loading