SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Tool Adds CI Gates to Catch AI Prompt Injection and MCP Tool-Poisoning in Pull Requests

0
·1 views

A developer walkthrough details how to integrate sentinel-scan-cli into GitHub Actions and pre-commit hooks to automatically flag AI security vulnerabilities on every pull request. The free, zero-dependency tool runs a 15-attack prompt-injection suite against LLM endpoints and performs static scanning of MCP manifests for tool poisoning and excessive agency, both mapped to the OWASP LLM Top 10 (2025). A key limitation disclosed in the post is that the CLI exits with code 0 even when high-severity issues are found, meaning a raw CI step would silently pass despite real vulnerabilities. To address this, the author provides a small Python wrapper script that reads the JSON scan output and exits with a non-zero code based on a configurable severity threshold. The approach ensures that findings such as hardcoded credentials, prompt injection vectors, and supply chain risks actually break the build rather than going unnoticed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

NestMux runs five AI coding agents simultaneously in isolated terminal panes

A developer has built NestMux, a desktop app that runs multiple AI coding agents — including Claude Code, Codex, and Gemini CLI — side by side in a single window using a grid of real terminals. Each pane is an isolated environment with its own redirected HOME directory and a separate git worktree, preventing agents from overwriting each other's work on shared repositories. The app uses node-pty to spawn shells and requires no agent-specific parsing or API wrapping, making it straightforward to add support for new CLI tools. A broadcast mode forwards raw keystrokes to all panes simultaneously, though this simplicity means the app cannot detect whether an agent is ready before receiving input. The developer openly acknowledges several limitations, including process tracking difficulties and state that does not persist across restarts.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer launches badBANANA Threat Observatory to surface cyber threat data transparently

A developer has publicly released the badBANANA Threat Observatory, an open-source cybersecurity monitoring tool that aggregates data from CISA KEV, ThreatFox, URLhaus, and MalwareBazaar. Unlike many existing threat dashboards that prioritize visual appeal over analytical rigor, the project was built to ensure the interface accurately reflects the state of the underlying evidence. Key design decisions include keeping missing data visibly absent rather than defaulting to zeroes, rejecting invalid indicators instead of silently reclassifying them, and clearly distinguishing between what sources report versus what the system can verify. The release underwent multiple audit and remediation passes covering hash validation, export safety, deployment hardening, and release provenance verification. The tool and its source code are freely available to the public on GitHub.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PingAuthorize Enforces Strict Policy Decisions for AI Agent Transactions

A technical implementation using PingAuthorize as a remote policy decision point integrates with an MCP gateway to authorize AI agent transactions. The system constructs policy requests from pre-verified identity values, including user, agent, workload, and caller identities, along with purpose scopes and tool names. A transaction is permitted only when all conditions are met simultaneously: policy status is OKAY, decision is PERMIT, authorised is true, and no unfulfilled obligations exist. Any malformed, oversized, timed-out, or contradictory response results in an automatic denial, and TLS verification cannot be bypassed. This approach replaces broad agent-level permissions with precise, context-specific authorization tied to verified workload, caller path, user transaction, and tool.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

SPIRE Workload Identity Binds AI Agents to Cryptographic Runtime Credentials

A technical deep-dive into the 'Trusted AI Agent Transactions' series explains how SPIRE distinguishes between a logical agent identity and a cryptographically attested workload identity using SPIFFE IDs. The implementation employs both JWT-SVIDs for agent authentication during RFC 8693 token exchange with PingFederate and X.509-SVIDs for mutual TLS between workloads. A transaction token remains fixed across the request chain while the verified caller identity shifts at each hop — from agent to gateway to MCP server to protected API — preventing direct agent calls even with a valid token. Docker-based lab workloads are assigned distinct SPIFFE IDs through registration entries and label selectors, with SPIRE performing attestation rather than allowing containers to self-select an identity. The article notes that the lab uses a join token for bootstrapping as a development convenience, and recommends hardware-backed or cloud-native node attestors for production deployments.

0 comments Read more at DEV Community
Tool Adds CI Gates to Catch AI Prompt Injection and MCP Tool-Poisoning in Pull Requests · ShortSingh