v0.3.1 — agent-context attack-path mapper

MSCC maps how MCP servers, agent skills, and memory files chain into exposure paths — not a scanner that finds bad objects one at a time.

Highlights since 0.1.0

• Cross-surface exposure graph (mscc graph) — a poisoned skill/memory reaching a sensitive MCP server and an egress, with 0 false positives across 370 real installed skills.
• Graded exposure paths (mscc exposure) — source → sensitive → egress chains scored 0–100 by approval gating, capability breadth, source trust, and egress reach.
• Machine audit (mscc surface) — MCP configs, skills, memory across 12 agent clients; now also detects DXT extensions and warns on remote OAuth connectors it cannot statically inspect.
• Drift / rug-pull detection (mscc lock / verify), policy-as-code (mscc policy), and OWASP MCP Top 10 / ASI06 mapping (mscc frameworks).
• ~100-entry capability catalog, toxic-flow detection for skills/memory, and multi-format reports (JSON, SARIF, Markdown, HTML, PDF, SVG).

Privacy

Runs entirely on your machine. No network calls of its own, no telemetry, nothing leaves the box.

Install: pip install mscc · Audit now: uvx mscc surface

Full detail in CHANGELOG.md.