v3.16.0

sinewaveai/agent-security-scanner-mcpv3.16.0Feb 28, 2026by sinewaveai

AI Summary

Hardening release for the MCP manifest scanner introducing 9 new detection rules to identify injection vulnerabilities, cross-tool manipulation, and statistical anomalies in tool descriptions.

Key Highlights

9 new detection rules for comprehensive MCP manifest scanning
Schema-level injection detection and suspicious default value flags
Cross-tool manipulation and priority override detection
Suspicious URL detection including tunneling URLs
YAML rule paths filter and suppression support

New Features

Schema-level injection detection rules
Cross-tool reference and priority override detection
Statistical anomaly detection using Z-score analysis
YAML rule paths filter support
.scannerrc.yaml for rule suppression

Full Release Notes

## v3.16.0 - MCP Scanner Hardening

9 new detection rules for comprehensive MCP manifest security scanning.

### New Features

**Schema-level injection detection**:
- `mcp.schema-description-injection` (ERROR) - Detects injection language in property descriptions
- `mcp.schema-suspicious-default` (ERROR) - Flags suspicious default values with shell commands/URLs
- `mcp.schema-open-additionalProperties` (WARNING) - Flags additionalProperties:true with empty properties

**Cross-tool manipulation detection**:
- `mcp.cross-tool-reference` (ERROR) - Detects tool descriptions directing LLM to invoke other tools
- `mcp.cross-tool-priority-override` (ERROR) - Flags tools claiming execution priority

**Statistical anomaly detection**:
- `mcp.description-length-anomaly` (WARNING) - Z-score analysis to flag outlier descriptions

**Suspicious URL detection**:
- `mcp.description-suspicious-url` (WARNING) - Flags external URLs in descriptions
- `mcp.description-tunneling-url` (ERROR) - Detects ngrok, webhook.site, etc.

**Nested base64 detection**:
- `nested-base64` (ERROR) - Detects double-encoded base64 obfuscation

### Bug Fixes

- YAML rule paths filter support (respects paths.include/exclude)
- Fixed use-escapexml false positives on JS template literals
- Added .scannerrc.yaml for rule suppression
- CI fork permission handling

### Test Coverage

- 17 new tests (100% pass rate)
- 14 new tests in scan-mcp.test.js
- 3 new tests in scan-prompt.test.js

### Contributors

- @Har1sh-k - PR #20 (scanner hardening, path filter fix, CI improvements)

See [CHANGELOG](https://github.com/sinewaveai/agent-security-scanner-mcp/blob/main/CHANGELOG.md) for full details.