Skip to content

@polygraphso/litmus 0.32.0

Choose a tag to compare

@RubenSousaDinis RubenSousaDinis released this 09 Jul 15:22
· 12 commits to main since this release
1323b18

Ships litmus-v15: the C-02 egress baseline now includes public package-registry infrastructure (pypi.org, files.pythonhosted.org, registry.npmjs.org), so a framework's default startup update-check — chiefly FastMCP pinging pypi.org for a newer version — is no longer scored as the server's egress overreach. The cloud instance-metadata endpoint stays flagged (a real credential-theft target).

Fixes the dominant C-02 false-positive class for FastMCP-based servers. See #110 (analysis) and #111 (fix).