detect

Documentation

Overview

Injection-surface detections (plan §14): prompt-injection indicators, context/tool poisoning, invisible-Unicode instruction smuggling, and honeytoken access. All scans stream (any artifact size).

Mapping discipline: LLM Prompt Injection (AML.T0051) and LLM Plugin Compromise (AML.T0053) are valid MITRE ATLAS techniques for these surfaces. They remain INDICATORS — never auto-escalated to a compromise conclusion.

Package-aware detection rules (plan §14: the rule input contract is the whole package — events alone cannot express these). All content scans stream (see scan.go) so artifact size never causes a skip.

Package detect implements deterministic, rule-based detections over normalized events (plan §14). No LLM involvement — ever.

Mapping discipline (plan §15): MITRE ATLAS/ATT&CK fields are set only where a valid technique exists; absence of a mapping is correct behavior, not a gap. Findings never escalate to conclusions like "compromise" or "exfiltration" — they state what the evidence shows.

v0.5.0 behavioral and integrity rules — completes the plan §14 set. All deterministic over normalized events + manifest metadata.

Index

• func HoneytokenFindings(man *casepkg.Manifest, pkgDir string, markers []string) []schema.Finding
• func InjectionPhrase(text string) (string, bool)
• func Run(res *schema.Normalized) []schema.Finding
• func RunAll(res *schema.Normalized, pkgDir string, opts Options) []schema.Finding
• func RunPackage(res *schema.Normalized, pkgDir string) []schema.Finding
• func RunPackageWithOptions(res *schema.Normalized, pkgDir string, honeytokens []string) []schema.Finding
• func RunStream(pkgDir string, entities []schema.Entity, opts Options) ([]schema.Finding, error)
• func SecretKind(value string) (string, bool)
• type Live
  • func NewLive(opts Options) *Live
  • func (l *Live) Eval(ev schema.Event) []schema.Finding
• type Options

Functions

func HoneytokenFindings

func HoneytokenFindings(man *casepkg.Manifest, pkgDir string, markers []string) []schema.Finding

HoneytokenFindings flags planted canary markers appearing in agent conversations (killer feature #8).

func InjectionPhrase

func InjectionPhrase(text string) (string, bool)

InjectionPhrase reports the first instruction-override phrase found in text (case-insensitive). Shared with the MCP audit so tool descriptions are judged by the same conservative vocabulary as transcripts.

func Run

func Run(res *schema.Normalized) []schema.Finding

Run evaluates all rules and returns findings ordered by severity.

func RunAll

func RunAll(res *schema.Normalized, pkgDir string, opts Options) []schema.Finding

RunAll is the full deterministic rule set: event rules, package content scans, and the v0.5.0 behavioral/integrity rules.

func RunPackage

func RunPackage(res *schema.Normalized, pkgDir string) []schema.Finding

RunPackage evaluates event rules plus package-aware rules.

func RunPackageWithOptions

func RunPackageWithOptions(res *schema.Normalized, pkgDir string, honeytokens []string) []schema.Finding

RunPackageWithOptions keeps the historical signature (honeytokens only).

func RunStream

func RunStream(pkgDir string, entities []schema.Entity, opts Options) ([]schema.Finding, error)

RunStream evaluates the full deterministic rule set by streaming the normalized events overlay (normalized/events.jsonl) in two bounded passes, instead of holding every event in memory. Memory is bounded by session/agent/artifact count, not event count — this is the path `triage` uses so multi-hundred-thousand-event packages don't balloon RSS. Findings are identical to RunAll for the same input.

entities carries the (small) entity set from normalization, needed by rules that depend on sidechain membership.

func SecretKind

func SecretKind(value string) (string, bool)

SecretKind classifies a value against the well-known credential formats and returns the category name (never the value). Used by the MCP audit for inline env/header values in server configs.

Types

type Live

type Live struct {
	// contains filtered or unexported fields
}

Live evaluates events one at a time as they are tailed from a running agent session (real-time detection). It reuses the streaming engine's per-event rules and bounded aggregates in a single pass, so what fires live is a subset of what `triage` finds afterwards: every per-event and sequence rule, honeytokens and injection phrases in live content, and spawn-explosion. Whole-package rules that need the complete transcript (orphan agents, session tampering, timestomping, content scans of raw artifacts) remain post-hoc.

func NewLive

func NewLive(opts Options) *Live

NewLive creates a live evaluator.

func (*Live) Eval

func (l *Live) Eval(ev schema.Event) []schema.Finding

Eval ingests one event and returns the findings it triggers (may be none).

type Options

type Options struct {
	Honeytokens       []string
	SpawnThreshold    int      // AGENT_SPAWN_EXPLOSION per-session threshold (default 10)
	KnownDestinations []string // additional allowlisted network destinations
}

Options tunes package-aware detection.