🔒 correctover-security-audit
🇨🇳 国内用户 · 支付宝一键购买
本工具的合规授权与批量能力可通过支付宝 SkillPay 获取：
- 打开货架：https://skillpay.alipay.com/public/correctover
- 或把这行发给你的 AI 助手：请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」
AI Agent Vulnerability Scanner — powered by CCS fault taxonomy v2.5.
Quick Start
pip install correctover-security-audit
correctover-security-audit quick
What It Does
Scans MCP configurations, Agent code, and framework implementations for:
- Command Injection (CWE-78)
- SSRF (CWE-918)
- Credential Exposure (CWE-200)
- Path Traversal (CWE-22)
- SQL/NoSQL Injection (CWE-89)
- Fail-Open Bypass (CWE-636)
Database
Values are the actual contents of the bundled CCS taxonomy v2.5 (verified 2026-08-22):
| Metric | Value |
|---|---|
| Detection rules | 32 |
| Fault types (CCS v2.5) | 32 |
| High-confidence rules | 14 |
| ZDI bounty cases | 52 |
| Verified PoCs | 8 |
| CVEs referenced | 4 |
CVE Attribution (verified 2026-08-22)
| CVE | Real target | CVSS | Status |
|---|---|---|---|
| CVE-2026-42271 | LiteLLM | 8.8 | verified |
| CVE-2026-25536 | MCP TypeScript SDK race condition | 7.1 | verified |
| CVE-2026-12957 | AWS Language Servers | 7.8 (v4.0: 8.5) | verified (NVD 2026-08-22) |
| CVE-2026-55646 | vLLM DoS | 6.5 | verified (NVD 2026-08-22) |
| CVE-2026-56274 | Flowise AI MCP Server | — | PoC with CVE assigned |
Free Tier
50 scans/day — no credit card required.
Unlock unlimited: correctover.com/checkout
export CORRECTOVER_LICENSE_KEY=your-key-here
Related Correctover Tools
| Tool | Install | Description |
|---|---|---|
| Security Scanner | npx correctover-scan |
MCP config security audit（checks 数未核实） |
| Self-Healing Test | pip install correctover-test |
Agent self-healing test suite（3 scenarios × 3 frameworks） |
| Vulnerability Scan | pip install correctover-security-audit |
32 detection rules (CCS v2.5) |
| Compliance Check | pip install correctover-compliance-check |
OAuth 2.1 + CCS v1.0 (18 checks) |
| Runtime Guard | pip install correctover-runtime-guard |
RCE/SSRF interception (P50 ≈ 2011µs local measurement) |
| MCP Server | npm install correctover-mcp-server |
Compatibility package（已退役，转发至 correctover-mcp-gateway） |
Website: correctover.com · GitHub: github.com/Correctover
1 maintainer
Metadata
1 maintainer
Release files for correctover-security-audit 1.4.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| correctover_security_audit-1.4.3.tar.gz | 25.9 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| correctover_security_audit-1.4.3-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 54.2 kB
Release files / correctover_security_audit-1.4.3.tar.gz
| Download URL | correctover_security_audit-1.4.3.tar.gz |
|---|---|
| Size | 25.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
272cc2aaa571e496c176df0c867063cd72bd8b293b738b5eb6160ad99895a707
|
|
BLAKE2b-256 checksum How to use checksums |
ca14c1533a00cb256f725461b544b494626220d1372cb1042ee41312448288e0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.12
|
Release files / correctover_security_audit-1.4.3-py3-none-any.whl
| Download URL | correctover_security_audit-1.4.3-py3-none-any.whl |
|---|---|
| Size | 28.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
231f0a67f1cbc1447ae2887ade1e89a6b6ef2428a69e53003564a81dfa0d1771
|
|
BLAKE2b-256 checksum How to use checksums |
519d317ee46a931f1bf02a91486f0235347e5f609f9dc7d3aed0e46fb0acdbb5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.12
|
Security for correctover-security-audit 1.4.3
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
