mcp 2026.10.0

MCP Connection Risk Pack mcp 2026.10.0 — first release.

• Nine rules (MCP-001 to MCP-009) in four report groups: Capability, Exposure, Impact, Defense.
• Requires Security Knowledge OS >= 0.2.0 (pip install "security-knowledge-os>=0.2.0").
• Signed with Ed25519, publisher kagioneko, key ID kagioneko-2026-01; skos pack verify should report trust=signed.
• Licence: Apache-2.0.

sha256  4b4ba90aa414f76de34723baa1cd34a5f5e523c22fef479625290bc22ee81b2b  mcp-2026.10.0.zip

skos pack verify  mcp-2026.10.0.zip
skos pack install mcp-2026.10.0.zip
skos scan mcp .mcp.json --out mcp-assessments --assess

A screening aid for risky configurations, not a safety guarantee.

capgraph 2026.10.0

Capability Graph Pack capgraph 2026.10.0 — first release.

• Looks at a whole agent (every MCP server in a client config plus the client's built-in tools) and flags combinations of capabilities that are harmless one by one but dangerous together: CAPGRAPH-001 to CAPGRAPH-004.
• Requires Security Knowledge OS >= 0.3.0 (pip install "security-knowledge-os>=0.3.0"), which generates the input with skos scan mcp --client ....
• Signed with Ed25519, publisher kagioneko, key ID kagioneko-2026-01; skos pack verify should report trust=signed.
• Licence: Apache-2.0.

sha256  4f9ee587d08acf9d1d1366cf3dae639cb4987858e23826f157540e3fdbd3cdd2  capgraph-2026.10.0.zip

skos pack verify  capgraph-2026.10.0.zip
skos pack install capgraph-2026.10.0.zip
skos scan mcp .mcp.json --client claude-code --out mcp-assessments --assess

A screening aid, not a safety guarantee: finding no dangerous combination does not prove there is none.