Metadata-Version: 2.4
Name: agentic-guard-mcp
Version: 0.0.1
Summary: Static security analysis for MCP servers and AI-agent workspace configurations. Taint-graph based detection of tool-description injection, capability overreach, and exfiltration paths.
Project-URL: Homepage, https://github.com/sanjaybk7/agentic-guard-mcp
Project-URL: Repository, https://github.com/sanjaybk7/agentic-guard-mcp
Author: Sanjay Krishnegowda
License: Apache-2.0
License-File: LICENSE
Keywords: ai-agents,llm-security,mcp,model-context-protocol,prompt-injection,security,static-analysis,taint-analysis
Classifier: Development Status :: 2 - Pre-Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.9
Description-Content-Type: text/markdown

# agentic-guard-mcp

**Static security analysis for MCP servers and AI-agent workspace configurations.**

Part of the [agentic-guard](https://github.com/sanjaybk7/agentic-guard) family — extending its taint-graph model (the LLM as an adversarially-controlled edge) from agent pipelines to the Model Context Protocol ecosystem.

> **Status: v0.1 in active development.** This package currently reserves the name and ships a CLI stub. Follow this repo for the first release.

## What it will do

`agentic-guard-mcp` audits the *agent-facing surface* of an MCP server or developer workspace and reports reachable attack paths — not just suspicious patterns:

- **Tool-description injection linting** — detects imperative instructions to the model, hidden Unicode/encoding tricks, cross-tool manipulation, and out-of-scope references embedded in MCP tool descriptions and parameter docs.
- **Capability analysis** — flags mismatches between a tool's declared purpose and what its schema and code can actually reach (filesystem, network, shell).
- **Exfiltration-path detection** — models sensitive sources (files, env vars, credentials) and sinks (network calls, outbound tool parameters) and reports reachable source→sink paths through the agent.
- **Workspace composition analysis** — evaluates `.cursor/mcp.json`, rules files (`.cursorrules`, `copilot-instructions.md`, `AGENTS.md`), and auto-run settings *together*, because a finding's severity depends on what the configured agent can actually do.
- **Definition drift / rug-pull checks** — hashes tool definitions and flags changes between versions.
- **SARIF output** — integrates with GitHub code scanning and CI.

## Why

Existing scanners treat rules files and manifests in isolation with signature matching. Real incidents are compositional: benign-looking content becomes an exploit only in the context of a specific agent's permissions and tool access. That is a reachability problem, and reachability is what taint analysis is for.

## Install (stub)

```bash
pip install agentic-guard-mcp
agentic-guard-mcp --version
```

## Roadmap

- v0.1 — description-injection linter + capability-mismatch checks
- v0.2 — workspace composition analysis, SARIF output, GitHub Action
- v0.3 — ecosystem scan results, benchmark corpus release

## License

Apache-2.0

## Author

Sanjay Krishnegowda
