@polygraphso/litmus 0.32.0
·
12 commits
to main
since this release
Ships litmus-v15: the C-02 egress baseline now includes public package-registry infrastructure (pypi.org, files.pythonhosted.org, registry.npmjs.org), so a framework's default startup update-check — chiefly FastMCP pinging pypi.org for a newer version — is no longer scored as the server's egress overreach. The cloud instance-metadata endpoint stays flagged (a real credential-theft target).
Fixes the dominant C-02 false-positive class for FastMCP-based servers. See #110 (analysis) and #111 (fix).