fix: address 7 critical/high security findings from deep audit

Proxy (cli/proxy.py):
- V11: Add target command allowlist — reject unlisted binaries
- V13: Wire dead audit log to AuditLog.log() for persistence
- V14: Drop non-JSON messages instead of forwarding (smuggling fix)
- V15: Skip forwarding blocked tool calls to target server

MCP server (integrations/mcp/__init__.py):
- V12: Validate tool handler kwargs against input_schema before dispatch

Policy engine (governance/policy.py):
- V26: Default to deny when no policies loaded (fail-closed)
- V27: Treat rule evaluation exceptions as match (fail-closed)

All 1852 tests pass, 0 failures.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: imran-siddique

packages/agent-mesh/src/agentmesh/cli/proxy.py

@@ -15,6 +15,7 @@
 
 import asyncio
 import json
+import os
 import sys
 from datetime import datetime
 from typing import Any, Dict, Optional, List
@@ -29,6 +30,14 @@
 
 logger = logging.getLogger(__name__)
 
+# Allowlist of binaries the proxy may spawn as MCP targets.
+# Extend via AGENTMESH_PROXY_ALLOWED_TARGETS env var (comma-separated).
+_DEFAULT_ALLOWED_TARGETS = frozenset({
+    "npx", "node", "python", "python3", "uvx", "uv",
+    "npx.cmd", "node.exe", "python.exe", "python3.exe",
+    "echo", "cat", "test",  # Common for testing
+})
+
 
 class MCPProxy:
     """
@@ -58,6 +67,9 @@ def __init__(
         self.policy_level = policy
         self.enable_footer = enable_footer
 
+        # V11: Validate target command against allowlist
+        self._validate_target_command(target_command)
+
         # Create proxy identity
         logger.info("Initializing AgentMesh proxy identity...")
         self.identity = AgentIdentity.create(
@@ -80,6 +92,23 @@ def __init__(
 
         logger.info("Proxy initialized with trust score: %d/1000", self.trust_score)
 
+    @staticmethod
+    def _validate_target_command(target_command: List[str]) -> None:
+        """Validate target command binary against the allowlist (V11)."""
+        if not target_command:
+            raise ValueError("target_command must not be empty")
+        binary = os.path.basename(target_command[0])
+        env_extra = os.environ.get("AGENTMESH_PROXY_ALLOWED_TARGETS", "")
+        allowed = _DEFAULT_ALLOWED_TARGETS | frozenset(
+            t.strip() for t in env_extra.split(",") if t.strip()
+        )
+        if binary not in allowed:
+            raise ValueError(
+                f"Target binary '{binary}' is not in the allowed list: "
+                f"{sorted(allowed)}. Set AGENTMESH_PROXY_ALLOWED_TARGETS "
+                f"to extend the allowlist."
+            )
+
     def _load_default_policies(self):
         """Load default policies based on policy level."""
         if self.policy_level == "strict":
@@ -195,14 +224,18 @@ async def _read_from_client(self):
                 try:
                     message = json.loads(line.strip())
                 except json.JSONDecodeError:
-                    # Not a JSON message, pass through
-                    self._write_to_target(line)
+                    # V14: Drop non-JSON messages — never forward unvalidated content
+                    logger.warning("Dropping non-JSON client message (potential smuggling)")
                     continue
 
                 # Intercept tool calls
                 if message.get("method") == "tools/call":
                     message = await self._handle_tool_call(message)
 
+                # V15: Don't forward blocked tool calls to target
+                if isinstance(message, dict) and message.get("_agentmesh_blocked"):
+                    continue
+
                 # Forward to target
                 self._write_to_target(json.dumps(message) + "\n")
 
@@ -354,9 +387,9 @@ def _audit_log_tool_call(
         decision: Any
     ):
         """Log tool call to audit trail."""
-        {
+        entry = {
             "timestamp": datetime.utcnow().isoformat() + "Z",
-            "agent": self.identity.did,
+            "agent": str(self.identity.did),
             "action": "mcp_tool_call",
             "tool": tool_name,
             "arguments": arguments,
@@ -367,8 +400,14 @@ def _audit_log_tool_call(
             "trust_score": self.trust_score,
         }
 
-        # In production, would write to persistent audit log
-        # For now, just track in memory
+        # V13: Actually persist to audit log
+        self.audit_log.log(
+            event_type="mcp_tool_call",
+            agent_did=str(self.identity.did),
+            action=tool_name,
+            data=entry,
+            outcome="allowed" if decision.allowed else "denied",
+        )
         logger.debug("Audit: %s - %s", tool_name, decision.action)
 
     def _update_trust_score(self, tool_name: str, allowed: bool):

packages/agent-mesh/src/agentmesh/governance/policy.py

@@ -86,8 +86,16 @@ def evaluate(self, context: dict) -> bool:
             # In production, would use a proper expression parser
             return self._eval_expression(self.condition, context)
         except Exception:
-            logger.debug("Policy rule evaluation failed for '%s'", self.name, exc_info=True)
-            return False
+            # V27: Fail-closed — treat evaluation errors as a match so
+            # the rule's action (typically "deny") takes effect. This
+            # prevents attackers from crafting inputs that trigger
+            # exceptions to bypass policy rules.
+            logger.warning(
+                "Policy rule evaluation error for '%s' — treating as MATCH (fail-closed)",
+                self.name,
+                exc_info=True,
+            )
+            return True
 
     def _eval_expression(self, expr: str, context: dict) -> bool:
         """Evaluate a simple expression."""
@@ -779,13 +787,15 @@ def evaluate(
         if applicable:
             default = applicable[0].default_action
         else:
-            default = "allow"  # No policies = default allow
+            # V26: Fail-closed — no policies loaded means deny by default.
+            # Operators must explicitly load an allow policy.
+            default = "deny"
 
         elapsed = (datetime.utcnow() - start).total_seconds() * 1000
         return PolicyDecision(
             allowed=(default == "allow"),
             action=default,
-            reason="No matching rules, using default",
+            reason="No matching rules, using default" if applicable else "No policies loaded (deny by default)",
             evaluated_at=start,
             evaluation_ms=elapsed,
         )

packages/agent-mesh/src/agentmesh/integrations/mcp/__init__.py

@@ -268,7 +268,19 @@ async def invoke_tool(
         # Execute tool
         call.trust_verified = True
         try:
-            result = await tool.handler(**arguments)
+            # V12: Validate arguments against input_schema before dispatch
+            allowed_keys = set(tool.input_schema.get("properties", {}).keys())
+            if allowed_keys:
+                sanitized = {k: v for k, v in arguments.items() if k in allowed_keys}
+                stripped = set(arguments.keys()) - allowed_keys
+                if stripped:
+                    logger.warning(
+                        "Stripped unexpected kwargs from %s call by %s: %s",
+                        tool_name, caller_did, stripped,
+                    )
+            else:
+                sanitized = arguments
+            result = await tool.handler(**sanitized)
             call.success = True
             call.result = result
             tool.total_calls += 1