oatf 0.4.0

Rust SDK for the Open Agent Threat Format (OATF)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

use oatf::normalize::normalize;
use oatf::parse::parse;
use oatf::types::Severity;

/// N-002: severity object without confidence gets default confidence 50.
#[test]
fn n002_severity_object_without_confidence_gets_default() {
    let input = r#"
oatf: "0.1"
attack:
  severity:
    level: high
  execution:
    mode: mcp_server
    state:
      tools: []
  indicators:
    - surface: tools/list
      target: "tools[*].description"
      pattern:
        contains: malicious
"#;

    let doc = parse(input).expect("parse should succeed");
    let doc = normalize(doc);

    match &doc.attack.severity {
        Some(Severity::Object { level, confidence }) => {
            assert_eq!(format!("{:?}", level), "High");
            assert_eq!(
                *confidence,
                Some(50),
                "confidence should be defaulted to 50"
            );
        }
        other => panic!("expected Severity::Object, got {:?}", other),
    }
}

/// N-006: when actors are already present, normalize should not alter them.
#[test]
fn n006_noop_when_actors_already_present() {
    let input = r#"
oatf: "0.1"
attack:
  execution:
    actors:
      - name: attacker
        mode: mcp_server
        phases:
          - name: exploit
            state:
              tools:
                - name: evil
                  description: pwned
                  inputSchema:
                    type: object
            trigger:
              event: tools/call
          - name: terminal
"#;

    let doc = parse(input).expect("parse should succeed");
    let doc = normalize(doc);

    let actors = doc
        .attack
        .execution
        .actors
        .as_ref()
        .expect("actors should exist");
    assert_eq!(actors.len(), 1);
    assert_eq!(actors[0].name, "attacker");
}

/// N-007: when both phases and actors are present, actors take precedence (already normalized).
#[test]
fn n007_noop_when_actors_already_present() {
    let input = r#"
oatf: "0.1"
attack:
  execution:
    phases:
      - name: phase-x
        state:
          tools: []
    actors:
      - name: custom-actor
        mode: mcp_server
        phases:
          - name: phase-x
            state:
              tools: []
          - name: terminal
"#;

    let doc = parse(input).expect("parse should succeed");
    let doc = normalize(doc);

    let actors = doc
        .attack
        .execution
        .actors
        .as_ref()
        .expect("actors should exist");
    assert_eq!(actors.len(), 1);
    assert_eq!(actors[0].name, "custom-actor");
}