Conversation
Injects HTTP_PROXY/HTTPS_PROXY env vars into child MCP server processes when egress_sandbox: true is configured. Forces all HTTP traffic through oktsec's forward proxy where egress policies apply. Blocks the litellm exfiltration step: POST to models.litellm.cloud fails because domain not in allowed list. Child inherits host PATH/HOME. User Env vars override sandbox vars. Warns if forward proxy not enabled. 18 tests covering gateway + stdio proxy.
Scans requirements.txt, package.json, go.mod against OSV.dev vulnerability database. Checks dependency count, lockfile presence, and version pinning. Semaphore-limited concurrent OSV queries. Exit codes: 0=clean, 1=critical (or WARNING+ with --strict), 2=error. Supports --json output. 18 tests with mocked HTTP.
Adds 10 rules detecting credential file reads in Python source, encrypted exfiltration (AES+RSA+tar+POST), .pth file abuse, cloud metadata access, K8s secrets API abuse, systemd persistence, and hardcoded key material. Derived from litellm attack analysis. Total rules: 255 (187 Aguara built-in + 68 oktsec custom).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
On March 24, 2026, litellm versions 1.82.7 and 1.82.8 were published to PyPI with a malicious
.pthfile that exfiltrates SSH keys, cloud credentials, Kubernetes configs, environment variables, and installs persistent backdoors. The package has 97M monthly downloads and spreads to any project depending on it. Details: litellm #24512.This PR adds defenses at three layers: network egress, pre-launch scanning, and detection rules.
Changes
Egress sandbox for MCP servers
New
egress_sandbox: trueconfig on MCP server definitions. When enabled, oktsec injectsHTTP_PROXY/HTTPS_PROXYenvironment variables into the child process, routing all HTTP traffic through oktsec's forward proxy. Egress policies then apply - only explicitly allowed domains are reachable.The child process inherits the host's
PATH,HOME, and other env vars. Customenventries override sandbox vars. A warning is logged if the forward proxy isn't enabled.This blocks the exfiltration step of the litellm attack: the POST to
models.litellm.cloudfails because the domain isn't in the allowed list.oktsec audit depscommandNew CLI command that scans an MCP server's dependency manifests against the OSV.dev vulnerability database.
Parses
requirements.txt,package.json, andgo.mod. For each package+version, queries the OSV API for known vulnerabilities. Also checks:>=instead of exact pins)Supports
--jsonfor machine consumption and--strictto fail on warnings. Exit codes: 0 = clean, 1 = critical, 2 = error.Aguara v0.11.0 (10 SC-EX rules)
Upgrades the detection engine to Aguara v0.11.0, which adds 10 supply chain exfiltration rules derived from the litellm malware analysis:
~/.ssh/,~/.aws/, etc.)os.environaccess combined with HTTP POST.pthfiles with executable content (import, subprocess, exec).pthfile presence flag for reviewTotal detection rules: 255 (187 Aguara built-in + 68 oktsec custom).
How these defenses map to the litellm attack
oktsec audit depsflags known-malicious packages via OSV.dev.pthfile reads credential files at Python startupos.environand queries cloud IMDS~/.config/sysmon/Test plan
make build && make test && make lint && make vet