Community detection rules integration — ATR (108 rules, shipped in Cisco AI Defense)

[eeee2345]

Hi team,

ATR (Agent Threat Rules) maintains 108 open-source detection rules for AI agent threats — same rules that Cisco AI Defense ships in production (cisco-ai-defense/skill-scanner#79). We'd like to contribute these to Agent Governance Toolkit.

We noticed mcp-security.yaml has 51 detection patterns across 7 categories. ATR covers 9 categories with 87 high-confidence patterns tested on 53,577 real-world MCP skills (0% FP on clean content).

What ATR covers:

• Prompt injection (10 patterns)
• Tool poisoning (10 patterns)
• Credential exfiltration (10 patterns)
• Skill supply chain (10 patterns)
• Agent manipulation (10 patterns)
• Privilege escalation (10 patterns)
• Excessive autonomy (10 patterns)
• Data poisoning (10 patterns)
• Model abuse (7 patterns)

Questions before we submit a PR:

1. Would you prefer we enhance mcp-security.yaml or add a separate policy file?
2. Any format requirements beyond the existing detection_patterns schema?
3. We'd love to discuss ongoing community rule maintenance — would you be open to ATR as an upstream source for detection patterns?

Happy to adjust to whatever approach works best for your architecture.

• Website: https://agentthreatrule.org
• Rules: https://github.com/Agent-Threat-Rule/agent-threat-rules
• Cisco integration: feat: Add ATR community rule pack — 34 rules for MCP tool poisoning, multi-agent attacks, and advanced injection cisco-ai-defense/skill-scanner#79
• License: MIT

[github-actions]

Welcome to the Agent Governance Toolkit! Thanks for opening your first issue.
A maintainer will review this shortly. Check our Contributing Guide.
For security issues, use private vulnerability reporting.

[github-actions]

🤖 AI Agent: contributor-guide

Hi there, and welcome to the Agent Governance Toolkit community! 🎉 We're so excited to have you here, and thank you for taking the time to contribute such a valuable resource to the project. Your expertise and the ATR ruleset sound like a fantastic addition to our toolkit!

Let me break down your issue and provide some guidance:

---

🔍 Analyzing Your Issue

The ATR ruleset aligns closely with the goals of the agent-compliance package, which focuses on compliance frameworks and audit logging. Specifically, your contribution seems to enhance the detection capabilities for malicious or non-compliant agent behavior, which is critical for ensuring robust governance.

The file you mentioned, mcp-security.yaml, is indeed part of the agent-compliance package. This is the right place to focus your efforts, as it houses the detection patterns that your ATR rules would complement or extend.

---

📂 Relevant Code

To get started, you'll want to explore the following directories in the repository:

• /agent-compliance/policies/: This is where mcp-security.yaml resides. If you're enhancing or extending the existing detection patterns, this is the file to work with.
• /agent-compliance/schemas/: Check here for the detection_patterns schema to ensure your rules conform to the expected format.
• /agent-compliance/docs/: If you add new rules or categories, consider updating the documentation here to reflect the expanded coverage.

---

📚 Helpful Resources

Here are some resources to guide you as you prepare your contribution:

• CONTRIBUTING.md: This outlines the contribution process, including how to structure your pull request and any coding standards to follow.
• QUICKSTART.md: If you're new to the project, this guide will help you set up your environment and understand the toolkit's architecture.
• Code of Conduct: Please review this to ensure a welcoming and collaborative experience for everyone involved.

---

✅ Next Steps

Here’s how you can proceed:

1. Decide on Integration Approach: Based on your description, it might make sense to enhance mcp-security.yaml directly, as this would consolidate all detection patterns in one place. However, if the ATR rules introduce significant new functionality or categories, a separate policy file could also work. Feel free to propose your preferred approach in your PR.
2. Format Validation: Ensure your rules conform to the detection_patterns schema in /agent-compliance/schemas/. If you need clarification, let us know!
3. Submit a PR: When you're ready, submit a pull request with your proposed changes. Be sure to include a clear description of what you've added and how it aligns with the project's goals.
4. Discuss Ongoing Maintenance: Your idea of using ATR as an upstream source for detection patterns is intriguing! We’d love to explore this further. Perhaps we could discuss this in your PR or schedule a community call to dive deeper.

---

Thank you again for your thoughtful and detailed issue! Your contribution has the potential to significantly enhance the security and compliance capabilities of the toolkit. If you have any further questions or need assistance, don’t hesitate to ask. We’re here to help and excited to collaborate with you! 🚀

Looking forward to your PR! 😊

[eeee2345]

Thanks for the detailed guidance. Before we submit a PR, one clarification:

You mentioned exploring ATR as an upstream source for detection patterns. We'd be very interested in that model — ATR publishes new rules via npm (agent-threat-rules@1.1.1), so an update script could pull latest patterns into your mcp-security.yaml automatically.

Two approaches we can take:

1. One-time PR: enhance mcp-security.yaml with 87 curated high-confidence patterns. Simple, no ongoing dependency.
2. Upstream model: include a script (scripts/update-atr-rules.py) that regenerates the policy YAML from the latest ATR npm package. One command to stay current.

Which would you prefer? Happy to do either. We'll follow the detection_patterns schema in /agent-compliance/schemas/.

[imran-siddique]

Good question @eeee2345. Yes, we'd be open to exploring integration of detection rules as a complement to the existing policy engine. The best starting point would be mapping your ATR rules to our PolicyEvaluator interface — see packages/agent-os/src/agent_os/policies/ for the evaluation pipeline. A draft PR with a few example rules mapped would be the best way to evaluate the fit.

[eeee2345]

Draft PR submitted: #908

15 example rules mapped to PolicyDocument format (operator: matches with ATR regex patterns), covering prompt injection, tool poisoning, context exfiltration, and privilege escalation. Includes a sync script for all 108 rules and pytest tests (5 denied + 3 allowed).

Full documentation at agentthreatrule.org. Happy to iterate based on feedback.

[imran-siddique]

Thanks for the proposal! The ATR detection rules integration is an interesting idea — 108 rules covering 9 categories would significantly expand our detection coverage beyond the current 51 patterns in mcp-security.yaml.

Questions before we proceed:

1. What's the licensing model for the ATR rules? We'd need MIT-compatible licensing for inclusion.
2. Would this be a one-time import or an ongoing sync with the upstream ATR repo?
3. How do the 9 ATR categories map to our existing 7 categories? Is there overlap or are they complementary?

Labeling for triage. This would be a significant addition — we'd want to evaluate the rule quality and false-positive rates before integrating.