Metadata-Version: 2.5
Name: correctover-security-audit
Version: 1.4.1
Summary: AI Agent Security Audit Agent — powered by CCS fault taxonomy v2.5. One command to audit any MCP implementation or AI Agent framework.
Project-URL: Homepage, https://correctover.com
Project-URL: Repository, https://github.com/Correctover/security-audit
Project-URL: Issues, https://github.com/Correctover/security-audit/issues
Author-email: Correctover <wangguigui@correctover.com>
License: Apache-2.0
Keywords: ai-agent,audit,ccs,compliance,correctover,mcp,security,vulnerability-scanner
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: >=3.11
Requires-Dist: click>=8.0
Description-Content-Type: text/markdown

# 🔒 correctover-security-audit

**AI Agent Vulnerability Scanner — powered by CCS fault taxonomy v2.5.**

[![PyPI version](https://img.shields.io/pypi/v/correctover-security-audit.svg)](https://pypi.org/project/correctover-security-audit/)
[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-green.svg)](https://opensource.org/licenses/Apache-2.0)

## Quick Start

```bash
pip install correctover-security-audit
correctover-security-audit quick
```

## What It Does

Scans MCP configurations, Agent code, and framework implementations for:

- **Command Injection** (CWE-78)
- **SSRF** (CWE-918)
- **Credential Exposure** (CWE-200)
- **Path Traversal** (CWE-22)
- **SQL/NoSQL Injection** (CWE-89)
- **Fail-Open Bypass** (CWE-636)

### Database

Values are the actual contents of the bundled CCS taxonomy v2.5 (verified 2026-08-22):

| Metric | Value |
|--------|-------|
| Detection rules | 32 |
| Fault types (CCS v2.5) | 32 |
| High-confidence rules | 14 |
| ZDI bounty cases | 52 |
| Verified PoCs | 8 |
| CVEs referenced | 4 |

### CVE Attribution (verified 2026-08-22)

| CVE | Real target | CVSS | Status |
|-----|-------------|------|--------|
| CVE-2026-42271 | LiteLLM | 8.8 | verified |
| CVE-2026-25536 | MCP TypeScript SDK race condition | 7.1 | verified |
| CVE-2026-12957 | AWS Language Servers | 7.8 (v4.0: 8.5) | verified (NVD 2026-08-22) |
| CVE-2026-55646 | vLLM DoS | 6.5 | verified (NVD 2026-08-22) |
| CVE-2026-56274 | Flowise AI MCP Server | — | PoC with CVE assigned |

## Free Tier

50 scans/day — no credit card required.

Unlock unlimited: [correctover.com/checkout](https://correctover.com/checkout)

```bash
export CORRECTOVER_LICENSE_KEY=your-key-here
```

## Related Correctover Tools

| Tool | Install | Description |
|------|---------|-------------|
| **Security Scanner** | `npx correctover-scan` | MCP config security audit（checks 数未核实） |
| **Self-Healing Test** | `pip install correctover-test` | Agent self-healing test suite（3 scenarios × 3 frameworks） |
| **Vulnerability Scan** | `pip install correctover-security-audit` | 32 detection rules (CCS v2.5) |
| **Compliance Check** | `pip install correctover-compliance-check` | OAuth 2.1 + CCS v1.0 (18 checks) |
| **Runtime Guard** | `pip install correctover-runtime-guard` | RCE/SSRF interception (P50 ≈ 2011µs local measurement) |
| **MCP Server** | `npm install correctover-mcp-server` | Compatibility package（已退役，转发至 correctover-mcp-gateway） |

**Website**: [correctover.com](https://correctover.com) · **GitHub**: [github.com/Correctover](https://github.com/Correctover)
