dream(security-adversarial): mcp-scan missed Bash(python *) — live in vertical:ai (evaluated)

[ruvnet]

MetaHarness Dream Cycle, 2026-08-18. Deep surface: security-adversarial (slot 3). Full detail, receipts, candidate-selection reasoning, adversarial-critique writeup, and sbom/policy scan findings: #209.

Hypothesis

Given scanMcp's host-permission-check loop, which flags only exact wildcard strings (*, mcp__*, mcp__*__*) and a regex over a fixed binary list (rm|curl|wget|sudo|chmod|ssh), when the regex's binary alternation is extended to include arbitrary-code interpreters (python, python3, node, ruby, perl, bash, sh) and a new exact-match branch flags fully unscoped Bash/Bash(*) as a separate HIGH finding, then a real metaharness --template vertical:ai scaffold's shipped Bash(python *) allow-rule should be flagged risky-bash-allow (MEDIUM) where it previously scanned clean, subject to: (a) zero regression in the package's 455-test baseline, (b) no existing test modified, (c) the new checks must not false-positive on narrower, legitimately-scoped Bash(...) rules, (d) diff materially under 300 lines.

Candidate

packages/create-agent-harness/src/mcp-scan.ts's host-permission-check loop gained: (1) an exact-match branch for Bash/Bash(*) → new unrestricted-bash-allow HIGH finding; (2) the existing risky-bash-allow regex's binary alternation extended with python3?|node|ruby|perl|bash|sh. 2 source files (mcp-scan.ts +9/-2), 1 test file (+38 lines, 5 new tests). 44 lines net — well under the 300-line target.

Evaluation Receipt

• Real-world repro (not synthetic): ran the actual CLI — metaharness --template vertical:ai --host claude-code — producing a real .claude/settings.json containing "Bash(python *)". harness mcp-scan against that output: before fix, 2 findings (no-policy HIGH, unpinned-deps LOW), python grant invisible; after fix, 3 findings, adding [MED] Risky shell allow-rule: Bash(python *). Byte-identical CLI invocation, only the scanner code differed.
• Deterministic before/after stash repro: with only src/mcp-scan.ts reverted (tests kept), the 5 new tests fail exactly as predicted; the 10 pre-existing tests are unaffected.
• Fix restored: packages/create-agent-harness 457 passed, 2 skipped (baseline 455/2, 0 regressions), tsc --noEmit clean, full monorepo build clean (no wasm/NAPI degradation tonight).
• False-positive check: a dedicated test confirms Bash(*) doesn't double-fire the narrower risky-bash-allow id; scoped rules (Bash(npx foo*), Bash(git *)) remain unflagged.

Baseline Comparison

@metaharness/agntcy (the one dependent package that structurally reads mcp-scan's Finding[] shape, per its own from-mcp-scan.ts docstring) re-run clean (1/1) — its badge-derivation logic only maps allow-shell/allow-network/allow-file-write ids to badges and deliberately treats other ids (including the two new ones) as risk findings, not badges, matching existing design intent.

Darwin Lineage

Not run — this is a static-analysis coverage fix to a CLI scanner (fixed regex/exact-match check), not a tunable routing/topology/prompt/tool/tier parameter; no Darwin mutation surface applies (ADR-071 allowlist), same reasoning as the 2026-08-16/17 entries.

Flywheel Evidence

Not applicable in the "ran a flywheel evolution" sense — this candidate hardens @metaharness/create-agent-harness's own static scanner. Durable evidence is the real-CLI + deterministic repro above, committed to docs/dream-cycle/2026-08-18-gist.md.

Reward Hack Check

Purely additive diff — no existing test, fixture, or gold data touched (confirmed independently by the adversarial critic re-reading the diff hunks). No threshold changed, no metric substituted. mcp-scan remains pure/read-only, unchanged tonight.

Security Review

This is the security-review surface tonight. Also checked and clear: no other .claude/settings.json.tmpl template ships an unscoped shell/interpreter allow-rule (vertical_ai was the only offender); redact.ts/secrets.ts untouched; no new dependency or credential/network surface added.

Regression Analysis

Zero regression: 457/457 packages/create-agent-harness tests pass (0 failures, 2 pre-existing skips unaffected), tsc and full repo build clean, dependent-package test unaffected (1/1).

ADR

Appended a dated 2026-08-18 section to ADR-022 (the ADR that documents mcp-scan's checks) rather than minting a new ADR number, matching the 2026-08-13/14/17 precedent for a coverage/completion addition to an existing architectural decision.

Research Gist

No gist-creation tool is available in this session's toolset (matching 2026-08-13 through 08-17) — committed instead: docs/dream-cycle/2026-08-18-gist.md (GIST=LOCAL).

Issue

#209 (full findings, candidate-selection reasoning, adversarial-critique writeup including a self-caught overstatement correction, sbom/policy scan results, competitor review, ledger check/backfill).

Witness

session_commit : 5453c8c990824b54e05f289774e5a8b2cea0a32e
report_sha256  : 007959c64d46f68cfb273142e1b37a175ffd91f53c0c015c1f3be1bfd8517883
witness        : 97587f9cdd8fee182c05ae0f1a47946738195e04ae0126495119f5354c49dc18

Verifier procedure is in the gist's Witness section and was independently self-verified (round-trip reproduced programmatically) before this PR was opened.

Merge Policy

Human review required. Do not self-merge. Do not autonomously promote Flywheel state.

Recommendation: ACCEPT-WITH-CAVEATS — small, dual-repro'd (real CLI + deterministic unit) fix to a genuinely live gap in the repo's own security scanner. One disclosed correction along the way: the initial draft overstated the Bash(*)/bare-Bash half as traceable to a live generator bug at host-config.ts:45; an independent critic traced the real call graph, found that path unreachable through any shipped generator today, and the framing was corrected before this PR opened — that half ships as disclosed defense-in-depth, not as a second live-vulnerability claim. Two comparable-class gaps in sibling tools are disclosed as open next steps, not silently fixed under scope pressure: (1) threat-model never consults mcp-scan's findings, so the same harness can be HIGH on one tool and "clean" on the other; (2) harness sbom has no Cargo/Rust awareness despite --with-wasm legitimately shipping Rust deps in scaffolded harnesses.

---

Generated by Claude Code