Detection Rules Catalog

Detects process executions (subprocess.run, os.system, exec) where commands or arguments originate from tool parameters or interpolated variables. Supports cross-function interprocedural tracing.

@mcp.tool()
def execute(cmd: str):
    return subprocess.run(cmd, shell=True)

@mcp.tool()
def execute(safe_target: str):
    return subprocess.run(["git", "status", safe_target])

Flags files accessing sensitive environment variables or local credentials while simultaneously initiating outbound HTTP requests.

Detects outbound HTTP calls (fetch, requests.get, axios.get) fetching URLs derived from unvalidated tool inputs without allowlist protection.

Catches file system reads and writes where file paths are constructed directly from user parameters, enabling directory traversal (../../etc/passwd).

Identifies dangerous deserializers such as yaml.load without SafeLoader or pickle.loads. Can be automatically remediated with agentshield fix.

Analyzes composite value-flow graphs where a local file or environment variable is read, transformed, and subsequently placed into an outbound HTTP network request body.

Detects unparameterized or dynamically interpolated SQL queries (cursor.execute(f"..."), pool.query(`...`), $queryRawUnsafe) in AI agent tools and MCP database servers.

Flags patterns where local file system contents (open().read(), fs.readFileSync()) are read and transmitted directly to external HTTP webhooks, POST endpoints, or multipart uploads.

Detects unsanitized parameters, tool inputs, or user variables interpolated directly into LLM system instructions (system_prompt = f"...", systemPrompt: `...`) without structural delimiters.

Flags MCP servers and agent transports that bind to wildcard interfaces (host="0.0.0.0", app.listen(port, "0.0.0.0")) without explicit authentication, preventing unauthorized network exposure and DNS rebinding attacks.

Detects temporary file creation using predictable paths in shared directories (/tmp/..., /var/tmp/...) or deprecated functions like tempfile.mktemp() subject to race conditions and symlink attacks.