Release notes from agent-audit-kit
Articles about Release notes from agent-audit-kit
Release v0.6.20 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM of the package and its runtime dependencies *.sigstore.json — Sigstore keyless signature bundles. Verify one, and that this release's workflow signed it:
Release v0.6.16 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM of the package and its runtime dependencies *.sigstore.json — Sigstore keyless signature bundles. Verify one, and that this release's workflow signed it:
Release v0.6.15 · sattyamjjain/agent-audit-kit
Upgrade notes AAK-AGENT-001 and AAK-AGENT-003 now report instructions, not keywords (#869). Most existing findings for these two rules will stop. These no longer fire: subprocess, eval(, exec( and sh -c in an instruction file; rm -rf on a build directory; "bypass" used as a noun, describing code, or inside a guardrail such as "Never bypass the pre-push hooks" or anything under a ### NEVER heading. These still fire: a command that runs downloaded code: curl | sh, bash -c "$(curl ...)", or PowerShell iex on a download;
Release v0.6.13 · sattyamjjain/agent-audit-kit
Upgrade note aak scan output for eleven rules now matches rules.json. Their findings take the title, description, remediation and AICM references from the rule registry instead of hand-written copies that had drifted (#858). The fix that matters most: AAK-DOCSGPT-MCP-STDIO-MITM-001 and AAK-GPTRESEARCHER-MCP-STDIO-MITM-001 no longer tell you to set deny_stdio_transport: true. That key is not an MCP spec field and your client ignores it. Their remediation now points at controls that work: a version pin and TLS on the MCP endpoint.
Release v0.6.10 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM of the package and its runtime dependencies *.sigstore.json — Sigstore keyless signature bundles. Verify one, and that this release's workflow signed it:
Release v0.6.9 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed chore(docs): refresh the CLAUDE.md memory files against the code by
Release v0.6.8 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed Give the corpus study a URL, and check every nav entry is actually served by
Release v0.6.7 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed chore(deps): Bump the github-actions group across 1 directory with 4 updates by
Release v0.6.6 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed Fix a run that passes when the scanner crashes, and close the 90898 deferral by
Release v0.6.5 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed Disposition the 2026-09-14 CVE queue against rules that already exist by
Release v0.6.4 · sattyamjjain/agent-audit-kit
fix(docs): four stale facts in files the count guard could not see (#
V0.6.3: Rewrite the README, and make docs/ somewhere worth sending people (#724)
docs: rewrite the README, and make docs/ somewhere worth sending people 7,056 words to 1,300. The 2026 median is 800-1,500 and a reader decides in under thirty seconds, so it was roughly five times too long -- but length was not the worst of it. Eleven badges. First runnable command at line 69. Bullets running eight to ten lines defending a number before the reader knew what the tool did; the "Mechanical fix recipes: 11 of 348 (3.2%)" bullet argued its own scope for ten lines above the fold. That reads as anxious.
Release v0.6.2 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed Rewrite the launch checklist against the state the repo is actually in by
Release v0.6.1 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed Name Deadbugz on the rules that answer it, and wire the repo description by
Release v0.6.0 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed Add the EU AI Act Article 50 transparency pack by
Release v0.5.2 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed Fix a latency guard that could not fail, and three stale claims by
Release v0.5.1 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed Read MCP configs recursively in the ADMT scanner by
Release v0.5.0 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed Add the Colorado ADMT developer-documentation pack by
Release v0.4.0 · sattyamjjain/agent-audit-kit
Installation pip: Docker: GitHub Action: Supply chain rules.json — deterministic rule bundle rules.json.sha256 — trusted digest sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle) What's Changed Emit an OpenVEX document beside the SBOM by