Metadata-Version: 2.5
Name: correctover-runtime-guard
Version: 2.1.2
Summary: Real-time RCE/SSRF/credential leak interception for AI agents — MCP Server mode with diagnose_error, fault patterns, repair suggestions. Pro license required for full features.
Project-URL: Homepage, https://correctover.com
Project-URL: Repository, https://github.com/Correctover/runtime-guard
Project-URL: Issues, https://github.com/Correctover/runtime-guard/issues
Project-URL: Pricing, https://correctover.com/checkout
Author-email: Correctover <wangguigui@correctover.com>
License: Proprietary Commercial License
Keywords: ai-agent,correctover,credential-leak,guardrail,interception,mcp,rce,real-time,runtime-guard,security,ssrf
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: Other/Proprietary License
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: >=3.11
Requires-Dist: click>=8.0
Requires-Dist: fastmcp>=2.0
Provides-Extra: dev
Requires-Dist: pytest>=7.0; extra == 'dev'
Description-Content-Type: text/markdown

# 🛡️ correctover-runtime-guard

**Real-time RCE/SSRF/Env Leak interception — P50 ≈ 2011µs (local measurement, 2026-08-22).**

[![PyPI version](https://img.shields.io/pypi/v/correctover-runtime-guard.svg)](https://pypi.org/project/correctover-runtime-guard/)
[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
[![License: Proprietary Commercial](https://img.shields.io/badge/license-Proprietary--Commercial-blue.svg)](https://correctover.com/checkout)

## Quick Start

```bash
pip install correctover-runtime-guard
correctover-runtime-guard start
```

## What It Does

Runtime guardrail for AI Agent tool calls — intercepts before execution:

- **RCE interception** (CWE-78) — command injection in tool arguments
- **SSRF blocking** (CWE-918) — metadata endpoint access, internal port scanning
- **Env leak prevention** (CWE-200) — `AWS_SECRET_ACCESS_KEY`, `OPENAI_API_KEY` exfiltration
- **MCP Server mode** — `diagnose_error` / `get_fault_pattern` / `get_repair_suggestion`

### Performance

Local measurement on a single host (2026-08-22). Indicative only, not a vendor benchmark.

| Metric | Value |
|--------|-------|
| P50 latency | ≈2011µs |
| P99 latency | not benchmarked |
| Overhead | not benchmarked |
| Detection rate | qualitative — real-time RCE/SSRF/Env-leak blocking |

### Evidence

Backed by CCS fault taxonomy v2.5 (verified 2026-08-22):

- **5 verified PoCs** · **3 CVEs referenced**
  - CVE-2026-42271 → LiteLLM (CVSS 8.8, verified)
  - CVE-2026-25536 → MCP TypeScript SDK race condition (CVSS 7.1, verified)
  - CVE-2026-12957 → AWS Language Servers (CVSS 7.8, verified via NVD 2026-08-22)

## Free Tier

50 interceptions/day — no credit card required.

Enterprise: ¥1,999/month — [correctover.com/checkout](https://correctover.com/checkout)

```bash
export CORRECTOVER_LICENSE_KEY=your-key-here
```

## Related Correctover Tools

| Tool | Install | Description |
|------|---------|-------------|
| **Security Scanner** | `npx correctover-scan` | MCP config security audit（checks 数未核实） |
| **Self-Healing Test** | `pip install correctover-test` | Agent self-healing test suite（3 scenarios × 3 frameworks） |
| **Vulnerability Scan** | `pip install correctover-security-audit` | 32 detection rules (CCS v2.5) |
| **Compliance Check** | `pip install correctover-compliance-check` | OAuth 2.1 + CCS v1.0 (18 checks) |
| **Runtime Guard** | `pip install correctover-runtime-guard` | RCE/SSRF interception (P50 ≈ 2011µs local measurement) |
| **MCP Server** | `npm install correctover-mcp-server` | Compatibility package（已退役，转发至 correctover-mcp-gateway） |

**Website**: [correctover.com](https://correctover.com) · **GitHub**: [github.com/Correctover](https://github.com/Correctover)
