Add ATR detection rules as community detection resource#187
Add ATR detection rules as community detection resource#187eeee2345 wants to merge 2 commits intosafe-agentic-framework:mainfrom
Conversation
|
ATR x SAFE-MCP Integration Details (PR #187 Follow-up) Thanks for reviewing this mapping. Wanted to add technical details that may be useful for the review. Testing Methodology ATR rules were validated against the PINT (Prompt Injection Needle Test) benchmark:
Rule Format Each ATR rule is a standalone YAML file: id: ATR-010
title: Malicious Content in MCP Tool Response
severity: critical
patterns:
- regex: '<pattern>'
location: tool_description | tool_response | full_content
tags: [SAFE-T1001, OWASP-A01]Rules map directly to SAFE-MCP technique IDs via tags, making cross-referencing straightforward. Known Limitations (Transparency)
Compatibility ATR rules are engine-agnostic YAML. They can be consumed by:
Question for Maintainers Is there a specific rule format or testing framework you'd like me to adapt these to? If SAFE-MCP plans to include detection signatures alongside technique descriptions, I'm happy to contribute ATR rules in whatever format works best for the project. ATR Repository: https://github.com/Agent-Threat-Rule/agent-threat-rules |
… section Add references to ATR (Agent Threat Rules), an open-source MIT-licensed detection ruleset that provides machine-readable YAML rules for 78 of 85 SAFE-MCP techniques (91.8% coverage). Changes: - README.md: Add Community Detection Tools section with ATR coverage table - SAFE-T1001: Add ATR detection rules (6 rules) to Security Tool Integration - SAFE-T1102: Add ATR detection rules (12 rules) to Detection Methods ATR complements SAFE-MCP by providing the detection layer (like Sigma/YARA) on top of the threat knowledge base (like MITRE ATT&CK). Full cross-reference mapping available in the ATR repository. Signed-off-by: Panguard AI <support@panguard.ai>
eeee2345
force-pushed
the
add-atr-detection-references
branch
from
8ad6b58 to
0ec42c4
Compare
|
Hi maintainers - friendly follow-up on this PR and the technical comment above. Quick update: ATR detection rules have been integrated into Cisco AI Defense (merged as PR #79 in cisco-ai-defense/skill-scanner). This adds enterprise-level validation for the detection approach, and further strengthens the case for ATR as a community detection resource alongside SAFE-MCP technique taxonomy. ATR has also grown to 76 rules since this PR was opened. Happy to update the mapping if there are any changes on the SAFE-MCP side. Let me know if there is anything else needed for review. Thanks! |
1 participant
TL;DR
SAFE-MCP defines the threats. ATR detects them.
Your framework tells people what to watch for. ATR tells their scanners how to detect it. Every SAFE-MCP user who installs ATR gets automated detection coverage of 91.8% of your threat taxonomy — one command:
What is ATR?
ATR (Agent Threat Rules) is an open-source, MIT-licensed detection ruleset — Sigma/YARA-style YAML signatures for AI agent threats.
Key stats (April 2026)
SAFE-MCP Coverage: 78/85 techniques (91.8%)
Detailed Mapping by Tactic
Initial Access — 9/9 FULL
Execution — 8/9 STRONG
Persistence — 8/8 FULL
Privilege Escalation — 8/9 STRONG
Defense Evasion — 7/8 STRONG
Credential Access — 7/7 FULL
Discovery — 5/6 STRONG
Lateral Movement — 7/7 FULL
Collection — 5/5 FULL
Command and Control — 4/4 FULL
Exfiltration — 5/6 STRONG
Impact — 6/6 FULL
Resource Development — 1/1 FULL
7 Gaps — Why They Exist
3 of 7 gaps are infrastructure-level threats outside ATR's agent interaction focus. The 2 actionable gaps (multimodal injection, debugging tool exploitation) are on the roadmap.
Changes in This PR
Paper
Methodology and design rationale: https://doi.org/10.5281/zenodo.19178002
Full cross-reference mapping: ATR SAFE-MCP Mapping
Happy to adjust format, add references to additional techniques, or discuss coverage gaps. The full mapping covers all 14 SAFE-MCP tactics.