fix(security): add SECURITY.md to all packages, harden langchain crypto fallback by imran-siddique · Pull Request #354 · microsoft/agent-governance-toolkit

imran-siddique · 2026-03-23T23:24:19Z

Add SECURITY.md to all 29 subpackages linking to root security reporting guidance. Harden langchain-agentmesh crypto fallback with SecurityWarning when running in simulation mode. 30 files changed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

…icrosoft#326)

…s (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package

…stall agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

…it CI - scripts/check_dependency_confusion.py: Pre-commit hook that scans for pip install commands referencing unregistered PyPI packages. Maintains an allowlist of known registered packages. - .github/workflows/weekly-security-audit.yml: Weekly CI job running dependency confusion scan, security skills scan, and weak crypto check. Uploads reports as artifacts with 90-day retention. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…icrosoft#349) * docs: add testing guide for external testers and customers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add regulatory alignment table and Purview positioning to README Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): restore read-all at workflow level for Scorecard verification The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add comprehensive docstrings to mcp_adapter.py classes (microsoft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316 * ci: add markdown link checker workflow (microsoft#323) Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (microsoft#326) * fix: remove unregistered PyPI packages from notebooks and requirements (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package * fix(security): complete dependency confusion fix — replace all pip install agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update framework star counts to current values Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Parsa Faraji Alamouti <165321600+parsa-faraji@users.noreply.github.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Zeel Desai <72783325+zeel2104@users.noreply.github.com> Co-authored-by: Xavier Garceau-Aranda <xavier.garceau-aranda@posteo.net>

- agentmesh → agentmesh-platform (5 files) - agentmesh-governance → agent-governance-toolkit - agent-os-observability → agent-os-kernel[observability] - hashlib.md5 → hashlib.sha256 (3 files) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

…to fallback - Add SECURITY.md to 29 packages (9 main + 20 integrations) linking to root security reporting guidance - Harden langchain-agentmesh crypto fallback: emit SecurityWarning when cryptography package unavailable (simulation mode) - Add explicit SECURITY WARNING comments on fallback code paths Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-03-23T23:24:53Z

🤖 AI Agent: security-scanner — Security Review of Pull Request

Security Review of Pull Request

This pull request introduces two main changes:

Adds SECURITY.md files to 29 subpackages, linking to the root repository's security reporting guidelines.
Updates the langchain-agentmesh package to include warnings about the use of an insecure cryptographic fallback mechanism when the cryptography package is not installed.

Findings

1. Prompt Injection Defense Bypass

No issues found.
The changes in this PR do not directly interact with prompt injection defenses.

2. Policy Engine Circumvention

No issues found.
The changes do not introduce any mechanisms to bypass policy enforcement.

3. Trust Chain Weaknesses

Finding: 🔴 CRITICAL
- The fallback mechanism in langchain-agentmesh for signing and verifying data when the cryptography library is not installed is insecure. Specifically:
  - The fallback signing mechanism uses a simple concatenation of the data and private key, followed by a SHA-256 hash. This is not a secure cryptographic signature and can be trivially forged by an attacker who knows the private key.
  - The fallback verification mechanism accepts any non-empty signature, which is a critical vulnerability. This effectively disables signature verification entirely, allowing attackers to bypass any security mechanisms that rely on signature validation.
- While the warning added in the PR highlights the insecurity of the fallback mechanism, it does not prevent its use. This could lead to developers unknowingly deploying insecure configurations in production environments.
Suggested Fix:
- Remove the insecure fallback mechanism entirely. If the cryptography library is not installed, the system should fail securely and refuse to proceed with signing or verifying operations.
- Alternatively, implement a secure fallback mechanism using a well-established cryptographic library that is bundled with the package (e.g., Python's hashlib or hmac for HMAC-based signing and verification).

4. Credential Exposure

Finding: 🔴 CRITICAL
- The fallback signing mechanism in langchain-agentmesh includes the private key in the signature computation (sig_input = f"{data}:{self.private_key}"). This could lead to inadvertent exposure of the private key if the sig_input or resulting signature is logged, stored, or transmitted insecurely.
Suggested Fix:
- As mentioned above, remove the insecure fallback mechanism entirely. If the cryptography library is not installed, the system should fail securely.
- If a fallback mechanism is absolutely necessary, ensure that the private key is never included in any logged or transmitted data.

5. Sandbox Escape

No issues found.
The changes do not introduce any new mechanisms that could lead to a sandbox escape.

6. Deserialization Attacks

No issues found.
The changes do not involve deserialization of untrusted data.

7. Race Conditions

No issues found.
The changes do not introduce any new race conditions.

8. Supply Chain

Finding: 🟡 MEDIUM
- The PR introduces a dependency on the cryptography package (version >=44.0.0) for secure cryptographic operations. While cryptography is a widely used and trusted library, it is important to ensure that the dependency is pinned to a specific version or range of versions to avoid potential supply chain attacks or breaking changes in future releases.
Suggested Fix:
- Pin the cryptography dependency to a specific version or a well-defined range (e.g., cryptography>=44.0.0,<45.0.0) to reduce the risk of supply chain attacks or compatibility issues.

Summary of Findings and Recommendations

Finding	Severity	Recommendation
Insecure cryptographic fallback mechanism	🔴 CRITICAL	Remove the fallback mechanism or replace it with a secure implementation.
Potential private key exposure in fallback	🔴 CRITICAL	Remove the fallback mechanism or ensure private keys are never logged or exposed.
Unpinned `cryptography` dependency	🟡 MEDIUM	Pin the `cryptography` dependency to a specific version or range of versions.

Final Recommendation

This pull request introduces critical security vulnerabilities due to the insecure cryptographic fallback mechanism in the langchain-agentmesh package. While the addition of SECURITY.md files is a positive step, the fallback mechanism must be addressed before this PR can be approved.

github-actions

🤖 AI Agent: code-reviewer

Review Summary

This pull request introduces two main changes:

Adds a SECURITY.md file to all subpackages, linking to the root repository's security reporting guidelines.
Updates the langchain-agentmesh package to include a warning about the use of an insecure cryptographic fallback mechanism in simulation mode.

Below is a detailed review of the changes:

🔴 CRITICAL: Cryptographic Fallback in `langchain-agentmesh`

The fallback mechanism for cryptographic operations in langchain-agentmesh is not secure and could lead to severe security vulnerabilities if used in production. Specifically:

Simulation Mode Warning:
- The warning added via warnings.warn is a good step, but it is insufficient to prevent misuse in production environments.
- Developers may ignore warnings, especially if they are not familiar with the implications of using an insecure fallback.
Fallback Signature Generation:
- The fallback mechanism uses a SHA-256 hash of the concatenated data and private key (sig_input = f"{data}:{self.private_key}"). This is not a cryptographically secure signature and could be trivially forged by an attacker who knows the format.
Fallback Signature Verification:
- The fallback verification accepts any non-empty signature (return len(signature.signature) > 0). This effectively disables signature verification, which is a critical security flaw.

Recommendations:

🔴 Enforce secure cryptographic operations: Completely disable the fallback mechanism in production environments. Raise a RuntimeError if the cryptography package is not installed, rather than relying on warnings.

🔴 Environment-based enforcement: Use an environment variable or configuration flag to explicitly enable the insecure fallback for development or testing purposes. For example:

if not CRYPTO_AVAILABLE and not os.getenv("ALLOW_INSECURE_CRYPTO"):
    raise RuntimeError(
        "cryptography package is not installed. Install it using "
        "'pip install langchain-agentmesh[crypto]' or pip install cryptography>=44.0.0"
    )

🔴 Improve documentation: Clearly document the risks of using the fallback mechanism in the README and other relevant documentation. Highlight that it is only for testing and not for production use.

🟡 WARNING: Backward Compatibility

The changes to langchain-agentmesh introduce new behavior (warnings and potential exceptions) when the cryptography package is not installed. This could break existing workflows where the fallback mechanism is currently being used without warnings or exceptions.

Recommendations:

Provide a clear migration path for users who may be relying on the fallback mechanism.
Consider releasing this change as a minor version update and include a detailed changelog entry explaining the new behavior.

💡 Suggestions for Improvement

Centralize SECURITY.md Files:
- While adding SECURITY.md to each subpackage is helpful for visibility, it introduces redundancy and maintenance overhead. Consider using a symlink to the root SECURITY.md file instead of duplicating the content across all subpackages. This ensures that updates to the root SECURITY.md automatically propagate to all subpackages.
Use Custom Warning Class:
- The SecurityWarning used in the warnings.warn call is not defined in the provided code. Define a custom warning class for better clarity:
```
class SecurityWarning(UserWarning):
    pass
```
Add Tests for Warning and Fallback Behavior:
- Add unit tests to ensure the warning is raised when the cryptography package is not installed.
- Add tests to verify that the fallback mechanism is only used when explicitly enabled (e.g., via an environment variable).
Improve Documentation for Cryptographic Operations:
- Expand the documentation in the langchain-agentmesh package to explain the cryptographic operations being performed, including the risks of using the fallback mechanism.
Consider Deprecating the Fallback Mechanism:
- Long-term, consider removing the insecure fallback mechanism entirely. If cryptographic operations are critical to the functionality of the package, the cryptography package should be a required dependency.

Final Assessment

The addition of SECURITY.md files is a positive step for improving security practices and transparency. However, using symlinks could simplify maintenance.
The cryptographic fallback mechanism in langchain-agentmesh is a critical security risk and must be addressed before merging this PR.
The changes to langchain-agentmesh may introduce breaking changes and should be clearly communicated to users.

Action Items

🔴 Address the insecure cryptographic fallback mechanism in langchain-agentmesh as outlined above.
🟡 Consider the potential backward compatibility impact and document the changes in the changelog.
💡 Replace duplicated SECURITY.md files with symlinks to the root SECURITY.md.
💡 Define a custom SecurityWarning class for better clarity.
💡 Add unit tests for the new warning and fallback behavior.
💡 Update documentation to highlight the risks of using the insecure fallback and provide guidance on installing the cryptography package.

Let me know if you need further clarification or assistance!

imran-siddique and others added 20 commits March 20, 2026 10:56

docs: add testing guide for external testers and customers

9bd6672

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

3ab4a65

…toolkit

ci: add markdown link checker workflow (microsoft#323)

baeed60

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (m…

8ee3c81

…icrosoft#326)

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

96b2046

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

3ac1f73

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

d0681ff

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

60bdccd

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

f87284e

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

ad5e9b1

…toolkit

github-actions bot added documentation Improvements or additions to documentation agent-mesh agent-mesh package agent-hypervisor agent-hypervisor package agent-sre agent-sre package size/XL Extra large PR (500+ lines) labels Mar 23, 2026

github-actions bot reviewed Mar 23, 2026

View reviewed changes

imran-siddique merged commit a9768c1 into microsoft:main Mar 23, 2026
52 checks passed

imran-siddique deleted the fix/plugin-security-hardening branch March 28, 2026 16:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): add SECURITY.md to all packages, harden langchain crypto fallback#354

fix(security): add SECURITY.md to all packages, harden langchain crypto fallback#354
imran-siddique merged 20 commits intomicrosoft:mainfrom
imran-siddique:fix/plugin-security-hardening

imran-siddique commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Security Review of Pull Request

Findings

1. Prompt Injection Defense Bypass

2. Policy Engine Circumvention

3. Trust Chain Weaknesses

4. Credential Exposure

5. Sandbox Escape

6. Deserialization Attacks

7. Race Conditions

8. Supply Chain

Summary of Findings and Recommendations

Final Recommendation

Uh oh!

github-actions bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

imran-siddique commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Security Review of Pull Request

Findings

1. Prompt Injection Defense Bypass

2. Policy Engine Circumvention

3. Trust Chain Weaknesses

4. Credential Exposure

5. Sandbox Escape

6. Deserialization Attacks

7. Race Conditions

8. Supply Chain

Summary of Findings and Recommendations

Final Recommendation

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

🤖 AI Agent: code-reviewer

Review Summary

🔴 CRITICAL: Cryptographic Fallback in langchain-agentmesh

🟡 WARNING: Backward Compatibility

💡 Suggestions for Improvement

Final Assessment

Action Items

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

🔴 CRITICAL: Cryptographic Fallback in `langchain-agentmesh`