🛡️ MAS-Sentry-Toolkit

Unified offensive-security toolkit for Multi-Agent Systems — from MQTT-based IoT swarms to MCP-driven LLM agents. Aligned with OWASP Top 10 for Agentic Applications (2026) and powered by ABFP behavioral fingerprinting.

Why MAS-Sentry

The MAS security landscape changed twice in 2024–2026:

1. Anthropic's Model Context Protocol (MCP) became the de-facto standard for LLM agent tooling — and brought a fresh class of architectural vulnerabilities (STDIO RCE affecting 200K+ servers, tool poisoning, indirect prompt injection).
2. OWASP released the Top 10 for Agentic Applications (Dec 2025) — formalising ASI01–ASI10 risks.

Existing tools cover either classical IoT messaging (MQTT/AMQP) or LLM-agent risks. MAS-Sentry covers both under one threat model.

What's inside

🔬 ABFP — Agent Behavioral Fingerprinting Protocol

The core research contribution. Builds a unique fingerprint per agent across five dimensions:

Phases: passive learning → fingerprint build → active probing → anomaly scoring → STRIDE-mapped threat report.

Enables: rogue agent detection, impersonation attacks, privilege escalation detection, zero-day interaction-vuln discovery, forensic attribution without credentials.

OWASP Agentic Top 10 (2026) coverage

Full mapping in THREAT_MODEL.md.

Quick start

pipx install mas-sentry-toolkit
mas-sentry doctor
mas-sentry mqtt scan --target 192.168.1.10
mas-sentry mcp scan --target stdio://./vuln-server --checks all
mas-sentry abfp scan --target mqtt://broker.lab --duration 60
mas-sentry agentic scan --target http://langchain-app.lab --asi all
mas-sentry a2a scan --target http://agent.lab
mas-sentry a2a mesh --manifest mesh.json

Run the included vulnerable lab:

docker compose -f lab/docker-compose.yml up -d
mas-sentry mqtt scan --target localhost:1883
mas-sentry mcp scan --target stdio://lab/vuln-mcp/server.py

⚖️ Legal & Scope

Active modules require explicit scope confirmation. Use only on assets you own or have written authorization to test. Designed for legal contexts: HackerOne / Bugcrowd / Intigriti / Immunefi programs and internal red-team engagements. See SECURITY.md.

The authors and MASec Lab LLC accept no liability for any misuse of this software or for damage arising from its use. Responsibility for operating within applicable laws and within an authorized scope rests solely with the user.

Heuristic findings

ABFP behavioral fingerprinting, impersonation and rogue-agent scoring are probabilistic signals derived from observed traffic. They may produce false positives and false negatives and do not constitute proof that an agent is or is not compromised. Treat scores as leads for human review, not verdicts. The software is provided "as is", without warranty, as set out in the AGPL-3.0 license.

License

GNU Affero General Public License v3.0 or later. The author retains copyright and may grant commercial licenses separately.

ABFP — Quick demo

# 1. Start the lab broker (Mosquitto + 3 sample agents)
docker compose -f lab/docker-compose.yml up -d

# 2. Run a 60-second ABFP passive scan (writes a behavioral baseline snapshot)
mas-sentry abfp scan --target mqtt://localhost:1883 --duration 60

# 3. Re-scan later against the baseline to flag topology drift and impersonation
mas-sentry abfp scan --target mqtt://localhost:1883 --duration 60 --baseline reports/abfp_snapshot.json

# 4. Open the generated HTML report
xdg-open reports/abfp.html

Output snapshot:

+-----------------------+-------+----------+
| Agent                 | Score | Severity |
+-----------------------+-------+----------+
| inferred_sensors      |   12  |  INFO    |
| factory_robot_r17     |   78  |  HIGH    |
+-----------------------+-------+----------+