{"repo":"piyushranjan178/AI-Agent-Security-Attack-Lab","private":true,"description":"Production-ready security assessment engine for Model Context Protocol (MCP) servers — automates vulnerability detection, security analysis, evidence collection, risk assessment, and report generation.","default_branch":"main","stars":1,"forks":0,"pushed_at":"2026-09-21T01:02:55Z","languages":{"TypeScript":617347,"CSS":55840,"JavaScript":32461,"HTML":18828},"files":190,"tree":[".github/workflows/ci.yml",".github/workflows/pr-security-check.yml",".gitignore","LICENSE","README.md","docs/PROJECT_STATE.md","docs/demo/mcp-security-review-engine-demo.mp4","package-lock.json","package.json","scripts/copy-ui.mjs","src/agent/action-gate.ts","src/agent/agent-trace.ts","src/agent/controlled-agent.ts","src/agent/types.ts","src/analyzers/rules/r001-arbitrary-shell-execution.ts","src/analyzers/rules/r002-unrestricted-filesystem-access.ts","src/analyzers/rules/r003-secret-credential-exposure.ts","src/analyzers/rules/r004-unrestricted-network-egress.ts","src/analyzers/rules/r005-ssrf-internal-network-access.ts","src/analyzers/rules/r006-tool-prompt-injection.ts","src/analyzers/rules/r007-excessive-tool-permissions.ts","src/analyzers/rules/r008-weak-missing-remote-authentication.ts","src/analyzers/rules/r009-supply-chain-dependency-risk.ts","src/analyzers/rules/r010-dangerous-data-flow-exfiltration-path.ts","src/analyzers/runtime-r008.ts","src/api/index.ts","src/api/server.ts","src/api/source-audit.ts","src/attack/attack-finding-adapter.ts","src/attack/attack-lab.ts","src/attack/capabilities-filesystem.ts","src/attack/capabilities-process.ts","src/attack/capability-adapter.ts","src/attack/controlled-mcp-session.ts","src/attack/default-registry.ts","src/attack/execution-bridge.ts","src/attack/executor.ts","src/attack/fixtures/synthetic-files.ts","src/attack/fixtures/synthetic-secrets.ts","src/attack/fixtures/synthetic-tools.ts","src/attack/preconditions.ts","src/attack/registry.ts","src/attack/result-validator.ts","src/attack/runner.ts","src/attack/safety-attestation.ts","src/attack/scenarios/command-execution.ts","src/attack/scenarios/controlled-exfiltration.ts","src/attack/scenarios/cross-tool-chaining.ts","src/attack/scenarios/execution-helpers.ts","src/attack/scenarios/filesystem-abuse.ts","src/attack/scenarios/multi-step.ts","src/attack/scenarios/permission-abuse.ts","src/attack/scenarios/precondition-helpers.ts","src/attack/scenarios/prompt-injection.ts","src/attack/scenarios/scenario-helpers.ts","src/attack/scenarios/sensitive-data-exposure.ts","src/attack/scenarios/ssrf.ts","src/attack/scenarios/tool-poisoning.ts","src/attack/types.ts","src/baseline/diff.ts","src/cli/index.ts","src/cli/program.ts","src/core/confidence-score.ts","src/core/decision.ts","src/core/finding-schema.ts","src/core/finding.ts","src/correlation/attack-graph.ts","src/discovery/capability-inventory-builder.ts","src/discovery/capability-inventory.ts","src/discovery/discover.ts","src/discovery/discovery-result.ts","src/discovery/dns-pinned-dispatcher.ts","src/discovery/dns-security.ts","src/discovery/ip-security.ts","src/discovery/mcp-http-connector.ts","src/discovery/runtime-auth-probe.ts","src/discovery/runtime-capability-discovery.ts","src/discovery/secure-fetch.ts","src/discovery/source-discovery.ts","src/discovery/static-capability-discovery.ts","src/discovery/target-resolver.ts","src/discovery/types.ts","src/discovery/url-security.ts","src/evidence/evidence-aggregator.ts","src/policies/policy-engine.ts","src/remediation/remediation-engine.ts","src/reports/json-reporter.ts","src/reports/report-document.ts","src/reports/report-writer.ts","src/reports/sarif-reporter.ts","src/risk/risk-scoring.ts","src/sandbox/docker-sandbox.ts","src/scan/rule-registry.ts","src/scan/scan-pipeline.ts","src/scan/scan-progress.ts","src/ui/app.js","src/ui/index.html","src/ui/styles.css","tests/agent/agent-contracts.test.ts","tests/agent/controlled-agent.test.ts","tests/agent/controlled-execution-gate.test.ts","tests/analyzers-runtime-r008.test.ts","tests/api/server.test.ts","tests/attack/attack-contract.test.ts","tests/attack/attack-finding-adapter.test.ts","tests/attack/attack-framework.test.ts","tests/attack/attack-lab.integration.test.ts","tests/attack/attack-registry.test.ts","tests/attack/attack-runner-integration.test.ts","tests/attack/attack-safety-evidence.test.ts","tests/attack/capability-adapter.test.ts","tests/attack/capability-gating.test.ts","tests/attack/command-execution-mcp.integration.test.ts","tests/attack/controlled-exfiltration-mcp.integration.test.ts","tests/attack/controlled-exfiltration-sink-regression.test.ts","tests/attack/controlled-mcp-agent.integration.test.ts","tests/attack/controlled-mcp-session.test.ts","tests/attack/cross-tool-chaining-mcp.integration.test.ts","tests/attack/execution-bridge.test.ts","tests/attack/filesystem-abuse-mcp.integration.test.ts","tests/attack/multi-step-mcp.integration.test.ts","tests/attack/permission-abuse-gate.test.ts","tests/attack/permission-abuse-integration.test.ts","tests/attack/permission-abuse-mcp.integration.test.ts","tests/attack/process-capability.test.ts","tests/attack/prompt-injection-mcp.integration.test.ts","tests/attack/result-validator.test.ts","tests/attack/safety-attestation.test.ts","tests/attack/sensitive-data-exposure-mcp.integration.test.ts","tests/attack/ssrf-mcp.integration.test.ts","tests/attack/tool-poisoning-runtime.test.ts","tests/attack/tool-poisoning.test.ts","tests/baseline/diff.test.ts","tests/cli.test.ts","tests/core-confidence-score.test.ts","tests/core-finding.test.ts","tests/correlation/attack-graph.test.ts","tests/decision/decision.test.ts","tests/discovery/capability-inventory-builder.test.ts","tests/discovery/capability-inventory.test.ts","tests/discovery/discover.test.ts","tests/discovery/dns-pinned-dispatcher.test.ts","tests/discovery/dns-security.test.ts","tests/discovery/ip-security.test.ts","tests/discovery/mcp-http-adversarial.test.ts","tests/discovery/mcp-http-connector.test.ts","tests/discovery/mcp-http-security-connector.test.ts","tests/discovery/real-mcp-http-runtime.test.ts","tests/discovery/real-mcp-runtime.test.ts","tests/discovery/runtime-auth-probe.test.ts","tests/discovery/runtime-capability-discovery.test.ts","tests/discovery/secure-fetch.test.ts","tests/discovery/source-discovery.test.ts","tests/discovery/static-capability-discovery.test.ts","tests/discovery/target-resolver.test.ts","tests/discovery/url-security.test.ts","tests/evidence/evidence-aggregator.test.ts","tests/fixtures/attack-lab-mcp-fixture.ts","tests/fixtures/attack-lab-mcp-server.ts","tests/fixtures/baseline/vulnerable-network-report.json","tests/fixtures/real-mcp/http-server.ts","tests/fixtures/real-mcp/server.ts","tests/fixtures/vulnerable-network/server.ts","tests/fixtures/vulnerable-ssrf/server.ts","tests/policies/policy-engine.test.ts","tests/r001.test.ts","tests/r002.test.ts","tests/r003.test.ts","tests/r004.test.ts","tests/r005.test.ts","tests/r006.test.ts","tests/r007.test.ts","tests/r008.test.ts","tests/r009-supply-chain-dependency-risk.test.ts","tests/r010-dangerous-data-flow-exfiltration-path.test.ts","tests/remediation/remediation-engine.test.ts","tests/reports/json-reporter.test.ts","tests/reports/report-document.test.ts","tests/reports/report-writer.test.ts","tests/reports/reports.test.ts","tests/reports/sarif-reporter.test.ts","tests/risk/risk-scoring.test.ts","tests/rule-registry.test.ts","tests/sandbox/docker-sandbox.test.ts","tests/scan-progress.test.ts","tests/scan/scan-pipeline.test.ts","tests/source-audit.test.ts","tests/tsconfig.json","tsconfig.json","vitest.config.ts"],"sizes":{".github/workflows/ci.yml":692,".github/workflows/pr-security-check.yml":1949,".gitignore":313,"LICENSE":1086,"README.md":26816,"docs/PROJECT_STATE.md":15211,"docs/demo/mcp-security-review-engine-demo.mp4":8346930,"package-lock.json":66239,"package.json":1145,"scripts/copy-ui.mjs":337,"src/agent/action-gate.ts":725,"src/agent/agent-trace.ts":402,"src/agent/controlled-agent.ts":4610,"src/agent/types.ts":1034,"src/analyzers/rules/r001-arbitrary-shell-execution.ts":7725,"src/analyzers/rules/r002-unrestricted-filesystem-access.ts":9210,"src/analyzers/rules/r003-secret-credential-exposure.ts":5770,"src/analyzers/rules/r004-unrestricted-network-egress.ts":8475,"src/analyzers/rules/r005-ssrf-internal-network-access.ts":9996,"src/analyzers/rules/r006-tool-prompt-injection.ts":12254,"src/analyzers/rules/r007-excessive-tool-permissions.ts":13032,"src/analyzers/rules/r008-weak-missing-remote-authentication.ts":4740,"src/analyzers/rules/r009-supply-chain-dependency-risk.ts":9103,"src/analyzers/rules/r010-dangerous-data-flow-exfiltration-path.ts":18573,"src/analyzers/runtime-r008.ts":1673,"src/api/index.ts":640,"src/api/server.ts":17684,"src/api/source-audit.ts":7321,"src/attack/attack-finding-adapter.ts":4111,"src/attack/attack-lab.ts":2247,"src/attack/capabilities-filesystem.ts":1928,"src/attack/capabilities-process.ts":1386,"src/attack/capability-adapter.ts":790,"src/attack/controlled-mcp-session.ts":2434,"src/attack/default-registry.ts":1415,"src/attack/execution-bridge.ts":1789,"src/attack/executor.ts":2694,"src/attack/fixtures/synthetic-files.ts":262,"src/attack/fixtures/synthetic-secrets.ts":297,"src/attack/fixtures/synthetic-tools.ts":454,"src/attack/preconditions.ts":3728,"src/attack/registry.ts":2228,"src/attack/result-validator.ts":1448,"src/attack/runner.ts":1799,"src/attack/safety-attestation.ts":5242,"src/attack/scenarios/command-execution.ts":4433,"src/attack/scenarios/controlled-exfiltration.ts":5631,"src/attack/scenarios/cross-tool-chaining.ts":5224,"src/attack/scenarios/execution-helpers.ts":2450,"src/attack/scenarios/filesystem-abuse.ts":4287,"src/attack/scenarios/multi-step.ts":5483,"src/attack/scenarios/permission-abuse.ts":4734,"src/attack/scenarios/precondition-helpers.ts":2392,"src/attack/scenarios/prompt-injection.ts":1807,"src/attack/scenarios/scenario-helpers.ts":2362,"src/attack/scenarios/sensitive-data-exposure.ts":2374,"src/attack/scenarios/ssrf.ts":4373,"src/attack/scenarios/tool-poisoning.ts":1837,"src/attack/types.ts":2177,"src/baseline/diff.ts":2566,"src/cli/index.ts":468,"src/cli/program.ts":5284,"src/core/confidence-score.ts":607,"src/core/decision.ts":1897,"src/core/finding-schema.ts":1941,"src/core/finding.ts":1073,"src/correlation/attack-graph.ts":2868,"src/discovery/capability-inventory-builder.ts":937,"src/discovery/capability-inventory.ts":1055,"src/discovery/discover.ts":521,"src/discovery/discovery-result.ts":202,"src/discovery/dns-pinned-dispatcher.ts":2596,"src/discovery/dns-security.ts":1165,"src/discovery/ip-security.ts":2776,"src/discovery/mcp-http-connector.ts":3097,"src/discovery/runtime-auth-probe.ts":1544,"src/discovery/runtime-capability-discovery.ts":4219,"src/discovery/secure-fetch.ts":6742,"src/discovery/source-discovery.ts":2166,"src/discovery/static-capability-discovery.ts":1478,"src/discovery/target-resolver.ts":905,"src/discovery/types.ts":219,"src/discovery/url-security.ts":869,"src/evidence/evidence-aggregator.ts":2556,"src/policies/policy-engine.ts":3029,"src/remediation/remediation-engine.ts":10460,"src/reports/json-reporter.ts":219,"src/reports/report-document.ts":2139,"src/reports/report-writer.ts":863,"src/reports/sarif-reporter.ts":2695,"src/risk/risk-scoring.ts":3753,"src/sandbox/docker-sandbox.ts":8636,"src/scan/rule-registry.ts":1824,"src/scan/scan-pipeline.ts":14169,"src/scan/scan-progress.ts":664,"src/ui/app.js":32124,"src/ui/index.html":18828,"src/ui/styles.css":55840,"tests/agent/agent-contracts.test.ts":2637,"tests/agent/controlled-agent.test.ts":5808,"tests/agent/controlled-execution-gate.test.ts":1241,"tests/analyzers-runtime-r008.test.ts":951,"tests/api/server.test.ts":20314,"tests/attack/attack-contract.test.ts":2790,"tests/attack/attack-finding-adapter.test.ts":1608,"tests/attack/attack-framework.test.ts":9092,"tests/attack/attack-lab.integration.test.ts":1668,"tests/attack/attack-registry.test.ts":712,"tests/attack/attack-runner-integration.test.ts":8297,"tests/attack/attack-safety-evidence.test.ts":1837,"tests/attack/capability-adapter.test.ts":1632,"tests/attack/capability-gating.test.ts":4758,"tests/attack/command-execution-mcp.integration.test.ts":3241,"tests/attack/controlled-exfiltration-mcp.integration.test.ts":4429,"tests/attack/controlled-exfiltration-sink-regression.test.ts":1417,"tests/attack/controlled-mcp-agent.integration.test.ts":2901,"tests/attack/controlled-mcp-session.test.ts":1370,"tests/attack/cross-tool-chaining-mcp.integration.test.ts":3853,"tests/attack/execution-bridge.test.ts":4281,"tests/attack/filesystem-abuse-mcp.integration.test.ts":2513,"tests/attack/multi-step-mcp.integration.test.ts":4126,"tests/attack/permission-abuse-gate.test.ts":2077,"tests/attack/permission-abuse-integration.test.ts":1606,"tests/attack/permission-abuse-mcp.integration.test.ts":4122,"tests/attack/process-capability.test.ts":746,"tests/attack/prompt-injection-mcp.integration.test.ts":2846,"tests/attack/result-validator.test.ts":2554,"tests/attack/safety-attestation.test.ts":1267,"tests/attack/sensitive-data-exposure-mcp.integration.test.ts":2425,"tests/attack/ssrf-mcp.integration.test.ts":2949,"tests/attack/tool-poisoning-runtime.test.ts":1376,"tests/attack/tool-poisoning.test.ts":2644,"tests/baseline/diff.test.ts":3591,"tests/cli.test.ts":5110,"tests/core-confidence-score.test.ts":1380,"tests/core-finding.test.ts":3140,"tests/correlation/attack-graph.test.ts":4528,"tests/decision/decision.test.ts":3802,"tests/discovery/capability-inventory-builder.test.ts":3295,"tests/discovery/capability-inventory.test.ts":1717,"tests/discovery/discover.test.ts":1151,"tests/discovery/dns-pinned-dispatcher.test.ts":3411,"tests/discovery/dns-security.test.ts":755,"tests/discovery/ip-security.test.ts":1637,"tests/discovery/mcp-http-adversarial.test.ts":3919,"tests/discovery/mcp-http-connector.test.ts":1015,"tests/discovery/mcp-http-security-connector.test.ts":2200,"tests/discovery/real-mcp-http-runtime.test.ts":1459,"tests/discovery/real-mcp-runtime.test.ts":1278,"tests/discovery/runtime-auth-probe.test.ts":639,"tests/discovery/runtime-capability-discovery.test.ts":6062,"tests/discovery/secure-fetch.test.ts":4836,"tests/discovery/source-discovery.test.ts":1202,"tests/discovery/static-capability-discovery.test.ts":1779,"tests/discovery/target-resolver.test.ts":696,"tests/discovery/url-security.test.ts":1056,"tests/evidence/evidence-aggregator.test.ts":4395,"tests/fixtures/attack-lab-mcp-fixture.ts":5175,"tests/fixtures/attack-lab-mcp-server.ts":10324,"tests/fixtures/baseline/vulnerable-network-report.json":7352,"tests/fixtures/real-mcp/http-server.ts":2890,"tests/fixtures/real-mcp/server.ts":483,"tests/fixtures/vulnerable-network/server.ts":116,"tests/fixtures/vulnerable-ssrf/server.ts":113,"tests/policies/policy-engine.test.ts":6092,"tests/r001.test.ts":4256,"tests/r002.test.ts":4649,"tests/r003.test.ts":3363,"tests/r004.test.ts":4276,"tests/r005.test.ts":4498,"tests/r006.test.ts":5066,"tests/r007.test.ts":5749,"tests/r008.test.ts":2877,"tests/r009-supply-chain-dependency-risk.test.ts":7275,"tests/r010-dangerous-data-flow-exfiltration-path.test.ts":7407,"tests/remediation/remediation-engine.test.ts":6904,"tests/reports/json-reporter.test.ts":3816,"tests/reports/report-document.test.ts":5495,"tests/reports/report-writer.test.ts":3146,"tests/reports/reports.test.ts":2480,"tests/reports/sarif-reporter.test.ts":5201,"tests/risk/risk-scoring.test.ts":7909,"tests/rule-registry.test.ts":1234,"tests/sandbox/docker-sandbox.test.ts":16652,"tests/scan-progress.test.ts":1274,"tests/scan/scan-pipeline.test.ts":10159,"tests/source-audit.test.ts":2265,"tests/tsconfig.json":141,"tsconfig.json":643,"vitest.config.ts":178},"readme":"# AI Agent Security Attack Lab\n\n> **Controlled security testing and evidence-driven assessment platform\n> for AI agents and MCP servers.**\n\nAI Agent Security Attack Lab is a local-first security platform for\ndiscovering, testing, validating, and reporting security behavior in MCP\nservers and tool-using AI agent workflows.\n\nIt connects **MCP discovery, capability analysis, controlled attack\nexecution, evidence collection, security findings, risk analysis,\nattack-path correlation, policy decisions, remediation, and professional\nsecurity reporting** into one security workflow.\n\n------------------------------------------------------------------------\n\n## Product\n\n``` text\nAI Agent\n   │\n   ▼\nMCP Server / Tools\n   │\n   ▼\n┌──────────────────────────────────────────┐\n│       AI AGENT SECURITY ATTACK LAB       │\n├──────────────────────────────────────────┤\n│ Discovery & Capability Inventory         │\n│ Safety Attestation                       │\n│ Controlled Attack Scenarios              │\n│ Agent Action Gate                        │\n│ Execution Trace                          │\n│ Evidence & Result Validation             │\n│ Findings & Risk                          │\n│ Attack Graph & Correlation               │\n│ Policy & Security Decisions               │\n│ Remediation & Reporting                  │\n└──────────────────────────────────────────┘\n```\n\n### Core Security Model\n\n``` text\nMCP SERVER\n    │\n    ▼\nDISCOVERY\n    │\n    ▼\nCAPABILITY INVENTORY\n    │\n    ▼\nSAFETY ATTESTATION\n    │\n    ▼\nSCENARIO PRECONDITIONS\n    │\n    ▼\nCONTROLLED AGENT\n    │\n    ▼\nACTION GATE\n    │\n    ▼\nCONTROLLED TOOL EXECUTION\n    │\n    ▼\nOBSERVATION + EXECUTION TRACE\n    │\n    ▼\nRESULT VALIDATION\n    │\n    ▼\nSECURITY FINDING\n    │\n    ├──────────────► RISK\n    │\n    ├──────────────► ATTACK GRAPH\n    │\n    ├──────────────► POLICY\n    │\n    └──────────────► REMEDIATION\n                          │\n                          ▼\n                  SECURITY REPORT\n```\n\nThe platform is designed to distinguish between a **security signal**, a\n**controlled execution**, and a **validated security result**.\n\n------------------------------------------------------------------------\n\n## Why AI Agent Security Attack Lab?\n\nModern AI agents increasingly interact with tools, APIs, filesystems,\nnetworks, and external services.\n\nThat creates a security testing problem:\n\n> It is not enough to inspect what an agent or MCP server *can\n> theoretically do*. Security teams need controlled evidence of what\n> actually happens when security-relevant behavior is exercised.\n\nAI Agent Security Attack Lab is designed around that principle:\n\n``` text\nTHEORY\n  │\n  ▼\nPRECONDITION\n  │\n  ▼\nCONTROLLED TEST\n  │\n  ▼\nOBSERVATION\n  │\n  ▼\nEVIDENCE\n  │\n  ▼\nVALIDATED RESULT\n```\n\nNo attack should be treated as proven solely because static metadata\nsuggests that it might be possible.\n\n------------------------------------------------------------------------\n\n# Security Capabilities\n\n## MCP Security Assessment\n\n- MCP server discovery\n- Tool and capability discovery\n- Static security inventory\n- Runtime discovery\n- Streamable HTTP analysis\n- Authentication probing\n- Network and endpoint analysis\n- Security rule evaluation\n- Evidence collection\n- Finding generation\n- Risk scoring\n- Confidence assessment\n- Security policy decisions\n- Attack-path correlation\n- Remediation guidance\n\n## AI Agent Security Testing\n\nThe controlled agent layer provides:\n\n- Explicit action requests\n- Tool approval through an action gate\n- Approved MCP tool inventory\n- Controlled tool execution\n- Observation capture\n- Execution trace preservation\n- Timeout handling\n- Failure handling\n- Blocked-action evidence\n- Reproducible security testing\n\n------------------------------------------------------------------------\n\n# Controlled Attack Lab\n\nThe Attack Lab validates security behavior through explicitly defined\nscenarios.\n\n## V1 Attack Scenarios\n\n| ID         | Scenario                | Security Focus                                              ","price_usd":"999.00","clone_checkout":"https://api.checkout402.com/c/chk_ZSGLRQweBUgeCiQi","rehearse_checkout":"https://api.checkout402.com/c/chk_ZSGLRQweBUgeCiQi/test","preview":"/r/piyushranjan178/AI-Agent-Security-Attack-Lab/f/<path> serves file CONTENTS for the seller's preview paths; other paths answer with the price","how_to_buy":"pay clone_checkout with x402 (pay402 does it in one call); the goods arrive as payload_base64, a tar.gz of the full repo. Rehearse first at rehearse_checkout: same flow, simulated money.","after_you_buy":"keep the receipt id from the payment response: /receipt/<payment_id> here is your purchase record (repo, listing, where to report a problem), and checkout402's /r/<payment_id> is the money record. Tell your human both URLs."}