Skip to content

Trustabl rules v0.7.0

Choose a tag to compare

View all tags
@ericksondelacruz ericksondelacruz released this 16 Oct 07:33
v0.7.0
f57df3f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

42 new rules, 298 → 340. Pack schema 18 → 23. Nothing was removed.

Requires engine v0.1.14 or later. These packs use predicates added across schemas 19–23, all of which first ship in v0.1.14. Older binaries load them leniently: they skip every rule whose predicate they lack and warn about it (META-005), so a v0.1.13 scanner runs only part of this set.

What is new, by pack

Pack New Rules
Agent config (new pack) 5 AGCFG-004 AGCFG-005 AGCFG-006 AGCFG-007 MCPCFG-002
LangChain / LangGraph 7 LC-026 LC-027 LC-113 LC-114 LC-115 LC-116 LC-117
Google ADK 5 ADK-020 ADK-021 ADK-022 ADK-023 ADK-113
Claude Agent SDK 4 CSDK-023 CSDK-024 CSDK-025 CSDK-114
AutoGen 3 AG2-020 AG2-021 AG2-022
CrewAI 3 CREW-014 CREW-015 CREW-111
OpenAI Agents SDK 3 OAI-032 OAI-033 OAI-120
Vercel AI 3 VAI-019 VAI-020 VAI-021
Observability 3 OBS-006 OBS-007 OBS-008
MCP 2 MCP-031 MCP-032
Pydantic AI 2 PYD-015 PYD-108
Raw LLM SDK (new pack) 2 RAW-001 RAW-002

Pre-trust agent config

A new agent_config/ pack, loaded for every repo regardless of SDK, flags project files that make a coding agent run repo-controlled code before the user has decided to trust the repo:

  • AGCFG-004 (critical) project settings auto-enable the repo's own MCP servers
  • AGCFG-005 (critical) project hooks execute repo-controlled commands
  • AGCFG-006 (critical) a workspace env file overrides the sandbox, proxy, endpoint or trust settings
  • AGCFG-007 (high) editor settings turn on agent auto-approve
  • MCPCFG-002 (high) project MCP config launches a local command

The scanner now looks inside .gemini/, .vscode/, .cursor/ and .codex/. Env files are read for key names only; no value is stored, logged or printed.

HTTPS-only fetches

Fourteen rules, one for each existing SSRF rule: CSDK-024/025, OAI-032/033, MCP-031/032, ADK-022/023, LC-026/027, CREW-015, PYD-015, AG2-022, VAI-021. Each fires only where its SSRF sibling credits a host allow-list but the URL scheme is neither pinned to a literal https:// nor checked. An allow-listed host reached over plain HTTP can still be intercepted.

Run deadlines and spend caps

A run with no deadline can hang a worker indefinitely. Wall-clock timeout checks on the run call: OAI-120, PYD-108, ADK-113, AG2-021. Limits declared on the agent: CREW-111 (max_execution_time), LC-113 (AgentExecutor max_execution_time) and VAI-020 (abortSignal or timeout). CSDK-114 flags a TypeScript query() main agent with no maxBudgetUsd. All of these are low severity.

LangGraph state

  • LC-114 a StateGraph compiled with no checkpointer. Silent when the repo ships a langgraph.json, because LangGraph Platform supplies one.
  • LC-115 a node function that performs a side effect with no interrupt() gate.
  • LC-116 (high) a graph using MemorySaver / InMemorySaver that is run from a FastAPI, Flask, Celery or Dramatiq entrypoint, where state is lost on restart and not shared across workers.
  • LC-117 (high) a LangChain v1 create_agent with a Python REPL or shell tool but no middleware or no checkpointer, so there is no interrupt-and-resume point for human approval. It checks only that these pieces are present, not that the middleware actually requires approval.

Side-effect bounds, batch 2

ADK-020/021, AG2-020, CREW-014, CSDK-023 and VAI-019 extend v0.6.0's side-effect bounds check (a side-effecting tool that lets the model choose the recipient or amount with no visible bound) to the remaining SDKs. CrewAI, AutoGen and Claude TS have no tool-level approval gate to credit, and each rule's explanation says so.

Observability

OBS-006–OBS-008 cover agents that are already instrumented and check whether they use agent-reliability-otel-labels. They form a ladder, so at most one fires per repo: the library is not installed, it is installed but no run is ever started, or a run is started but its spans are never labelled.

Raw LLM SDK

A new raw_llm_sdk/ pack. RAW-001 (Anthropic) and RAW-002 (OpenAI) flag a hand-written tool loop that builds tool output into a dynamic system prompt. This is a narrow heuristic within a single function, not full taint tracking.

Changed

  • The 14 SSRF rules now credit a visible host allow-list, so a tool that checks its host against a fixed set no longer fires them. The new HTTPS-only rules above take over in that case.
  • PYD-103's fix text gained a caveat about allowed_domains.

Schema

18 → 23, five steps, each adding predicates:

  • 19: run-call wall-clock timeout, langgraph_node, LangGraph Platform config, raw-SDK tool loops
  • 20: has_unpinned_scheme_url_call
  • 21: repo_otel_labels_installed / _initialized / _implemented
  • 22: agent_checkpointer_in_memory, agent_server_reachable
  • 23: the five project-config predicates behind agent_config/

Id changes

None. Every id in v0.6.0 keeps its meaning.

Assets 2
Loading