detect

Documentation

Overview

Injection-surface detections (plan §14): prompt-injection indicators, context/tool poisoning, invisible-Unicode instruction smuggling, and honeytoken access. All scans stream (any artifact size).

Mapping discipline: LLM Prompt Injection (AML.T0051) and LLM Plugin Compromise (AML.T0053) are valid MITRE ATLAS techniques for these surfaces. They remain INDICATORS — never auto-escalated to a compromise conclusion.

Package-aware detection rules (plan §14: the rule input contract is the whole package — events alone cannot express these). All content scans stream (see scan.go) so artifact size never causes a skip.

Package detect implements deterministic, rule-based detections over normalized events (plan §14). No LLM involvement — ever.

Mapping discipline (plan §15): MITRE ATLAS/ATT&CK fields are set only where a valid technique exists; absence of a mapping is correct behavior, not a gap. Findings never escalate to conclusions like "compromise" or "exfiltration" — they state what the evidence shows.

v0.5.0 behavioral and integrity rules — completes the plan §14 set. All deterministic over normalized events + manifest metadata.

Index

• func HoneytokenFindings(man *casepkg.Manifest, pkgDir string, markers []string) []schema.Finding
• func InjectionPhrase(text string) (string, bool)
• func Run(res *schema.Normalized) []schema.Finding
• func RunAll(res *schema.Normalized, pkgDir string, opts Options) []schema.Finding
• func RunPackage(res *schema.Normalized, pkgDir string) []schema.Finding
• func RunPackageWithOptions(res *schema.Normalized, pkgDir string, honeytokens []string) []schema.Finding
• func RunStream(pkgDir string, entities []schema.Entity, opts Options) ([]schema.Finding, error)
• func SecretKind(value string) (string, bool)
• type Options

Functions

func HoneytokenFindings

func HoneytokenFindings(man *casepkg.Manifest, pkgDir string, markers []string) []schema.Finding

HoneytokenFindings flags planted canary markers appearing in agent conversations (killer feature #8).

func InjectionPhrase

func InjectionPhrase(text string) (string, bool)

InjectionPhrase reports the first instruction-override phrase found in text (case-insensitive). Shared with the MCP audit so tool descriptions are judged by the same conservative vocabulary as transcripts.

func Run

func Run(res *schema.Normalized) []schema.Finding

Run evaluates all rules and returns findings ordered by severity.

func RunAll

func RunAll(res *schema.Normalized, pkgDir string, opts Options) []schema.Finding

RunAll is the full deterministic rule set: event rules, package content scans, and the v0.5.0 behavioral/integrity rules.

func RunPackage

func RunPackage(res *schema.Normalized, pkgDir string) []schema.Finding

RunPackage evaluates event rules plus package-aware rules.

func RunPackageWithOptions

func RunPackageWithOptions(res *schema.Normalized, pkgDir string, honeytokens []string) []schema.Finding

RunPackageWithOptions keeps the historical signature (honeytokens only).

func RunStream

func RunStream(pkgDir string, entities []schema.Entity, opts Options) ([]schema.Finding, error)

RunStream evaluates the full deterministic rule set by streaming the normalized events overlay (normalized/events.jsonl) in two bounded passes, instead of holding every event in memory. Memory is bounded by session/agent/artifact count, not event count — this is the path `triage` uses so multi-hundred-thousand-event packages don't balloon RSS. Findings are identical to RunAll for the same input.

entities carries the (small) entity set from normalization, needed by rules that depend on sidechain membership.

func SecretKind

func SecretKind(value string) (string, bool)

SecretKind classifies a value against the well-known credential formats and returns the category name (never the value). Used by the MCP audit for inline env/header values in server configs.

Types

type Options

type Options struct {
	Honeytokens       []string
	SpawnThreshold    int      // AGENT_SPAWN_EXPLOSION per-session threshold (default 10)
	KnownDestinations []string // additional allowlisted network destinations
}

Options tunes package-aware detection.