assay-cli 3.35.0

Policy-as-code gate for MCP agent tool calls, with verifiable evidence and Linux kernel enforcement.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

use assert_cmd::prelude::*;
use std::process::Command;
use tempfile::tempdir;

#[cfg(unix)]
fn shell_single_quote(value: &str) -> String {
    format!("'{}'", value.replace('\'', "'\\''"))
}

#[test]
fn test_profile_cli_workflow() -> anyhow::Result<()> {
    let tmp = tempdir()?;
    let out_yaml = tmp.path().join("policy.yaml");
    let out_report = tmp.path().join("report.md");
    let out_evidence = tmp.path().join("policy.evidence.yaml");

    let mut cmd = Command::new(assert_cmd::cargo_bin!("assay"));
    cmd.arg("sandbox")
        .arg("--profile")
        .arg(&out_yaml)
        .arg("--profile-report")
        .arg(&out_report)
        .arg("--quiet")
        .arg("--")
        .arg("true");

    let output = cmd.unwrap();
    assert!(output.status.success());

    // Verify files exist
    assert!(out_yaml.exists());
    assert!(out_report.exists());
    assert!(out_evidence.exists());

    let yaml_content = std::fs::read_to_string(out_yaml)?;
    let policy: serde_yaml::Value = serde_yaml::from_str(&yaml_content)?;
    assert_eq!(policy["api_version"], 1);
    assert!(
        policy["extends"].as_sequence().is_some_and(Vec::is_empty),
        "generated YAML policies must declare an empty extends list"
    );

    let evidence_content = std::fs::read_to_string(out_evidence)?;
    assert!(
        evidence_content.contains("version: '1.0'")
            || evidence_content.contains("version: \"1.0\"")
    );
    assert!(evidence_content.contains("total_runs: 1"));
    assert!(
        !evidence_content.contains("sandbox_degradations:"),
        "healthy run should not emit sandbox degradation observations"
    );

    Ok(())
}

#[test]
fn test_profile_json_output() -> anyhow::Result<()> {
    let tmp = tempdir()?;
    let out_json = tmp.path().join("policy.json");
    let out_evidence = tmp.path().join("policy.evidence.json");

    let mut cmd = Command::new(assert_cmd::cargo_bin!("assay"));
    cmd.arg("sandbox")
        .arg("--profile")
        .arg(&out_json)
        .arg("--profile-format")
        .arg("json")
        .arg("--quiet")
        .arg("--")
        .arg("true");

    let output = cmd.unwrap();
    assert!(output.status.success());

    assert!(out_json.exists());
    assert!(out_evidence.exists());
    let json_content = std::fs::read_to_string(out_json)?;
    let policy: serde_json::Value = serde_json::from_str(&json_content)?;
    assert_eq!(policy["api_version"], 1);
    assert!(
        policy["extends"].as_array().is_some_and(Vec::is_empty),
        "generated JSON policies must declare an empty extends list"
    );

    Ok(())
}

#[test]
#[cfg(unix)]
fn owasp_mcp05_sandbox_keeps_shell_metacharacters_as_argv() -> anyhow::Result<()> {
    let tmp = tempdir()?;
    let sentinel = tmp.path().join("injection-sentinel");
    let quoted_sentinel = shell_single_quote(&sentinel.to_string_lossy());
    let injection_arg = format!("; touch {quoted_sentinel}");

    let mut cmd = Command::new(assert_cmd::cargo_bin!("assay"));
    cmd.arg("sandbox")
        .arg("--quiet")
        .arg("--")
        .arg("sh")
        .arg("-c")
        .arg("printf safe")
        .arg(&injection_arg);

    let output = cmd.unwrap();
    assert!(output.status.success());
    assert_eq!(String::from_utf8_lossy(&output.stdout), "safe");
    assert!(
        !sentinel.exists(),
        "sandbox command construction executed shell metacharacters from argv"
    );

    Ok(())
}