# v0.5.7 — Manifest-only STDIO mode + fresh CVE presets

**Tagged 2026-04-26** · `pip install agent-airlock==0.5.7`

Five new opt-in primitives shipped in response to the OX Security
2026-04-15 deep dive. Anthropic confirmed the STDIO command-execution
behaviour is **"by design"** and declined to patch — sanitization is
now formally "the developer's responsibility." This release is the
developer's tools.

**Stats:** 1,761 tests · 83.15% coverage · zero new runtime deps.

## The single highest-leverage change: manifest-only mode

`mcp_spec/manifest_only_mode.py` ships the design that makes
runtime sanitization unnecessary because **argv never originates
from runtime input**:

```python
from agent_airlock import (
    ManifestRegistry,
    StdioManifest,
    launch_from_manifest,
)

registry = ManifestRegistry()
registry.register(
    StdioManifest(
        manifest_id="local-fs",
        command=("uvx", "mcp-server-everything"),
        env_allowlist=frozenset({"PATH", "HOME"}),
        signer="sre-team",
    ),
    signing_key=key,
)

# Anywhere in your runtime — no argv flows from runtime input:
proc = launch_from_manifest("local-fs", registry, runtime_env=os.environ)
```

A runtime caller passing `command=["evil"]` raises
`ManifestRuntimeOverrideAttempted`. That's the load-bearing
guarantee.

`SecurityPolicy.stdio_mode` defaults to `"allowlist"` so the
v0.5.1 behaviour is preserved. Manifest-only mode is **opt-in for
hardening-conscious deployments**.

Latency: resolve+verify is **~3 µs median**, register is **~20 µs
median**. Locked into CI via ``tests/benchmarks/test_bench_manifest_mode.py``.

See [`docs/mcp/manifest-only-mode.md`](../docs/mcp/manifest-only-mode.md).

## Two fresh CVE presets

### CVE-2026-6980 — GitPilot-MCP repo_path injection (CVSS 7.3)

Disclosed 2026-04-25 by RedPacket Security. **Vendor unresponsive;
project does not version.** Public PoC. The agent-airlock preset
matches by tool-name regex only (no version pin to wait on). See
[`docs/cves/cve-2026-6980.md`](../docs/cves/cve-2026-6980.md).

### CVE-2026-30615 — Windsurf zero-click MCP-config auto-load

The only true zero-click in the OX-disclosure family — attacker HTML
rewrites `.windsurf/mcp.json` from prompt injection alone, IDE
auto-launches the new server. Patched in Windsurf latest. The
class generalises to every IDE that auto-reads project-local MCP
config (VS Code, Cursor, Claude Code, JetBrains). New
`zero_click_config_guard.audit_config_diff` ships the
**diff-on-demand** API; the long-running daemon is queued for
v0.5.8. See
[`docs/cves/cve-2026-30615.md`](../docs/cves/cve-2026-30615.md).

## Static-analysis CI gate

`tools/scan_stdio_remote_input_flow.py` is the AST-based taint
analyzer. 9 default taint sources, 5+ STDIO sinks, multi-hop
tracking, `# noqa: AIRLOCK-TAINT-OK <reason>` pragma with
**required** reason (empty pragmas don't suppress). The
agent-airlock repo scans clean today — 170 files, 0 findings.
See [`docs/security/stdio-taint-scan.md`](../docs/security/stdio-taint-scan.md).

## Declarative composite preset

`presets/ox-mcp-2026-04.yaml` enables the nine OX-disclosure-class
presets in a single line. Loader uses a **stdlib-only**
restricted-grammar parser — no PyYAML dependency added (keeps the
package's 3-runtime-dep baseline). See
[`docs/presets/yaml-format.md`](../docs/presets/yaml-format.md).

## Top-level surfaces added

| Type | Symbol |
|---|---|
| Error | `ArgvStringConcatenationError` (re-export upgrade) |
| Error | `GitPilotRepoPathInjection` |
| Error | `MCPCommandMutationDetected` |
| Error | `ManifestNotRegisteredError` |
| Error | `ManifestRuntimeOverrideAttempted` |
| Error | `ManifestSignatureError` |
| Error | `ManifestSigningKeyError` |
| Error | `UnsignedMCPServerAdded` |
| Class | `ManifestRegistry` |
| Class | `StdioManifest` |
| Function | `launch_from_manifest` |
| Preset | `gitpilot_mcp_cve_2026_6980_defaults` |
| Preset | `windsurf_cve_2026_30615_defaults` |
| Field | `SecurityPolicy.stdio_mode` |

## Primary sources

- [OX Security — Mother of All AI Supply Chains (2026-04-15)](https://www.ox.security/blog/mother-of-all-ai-supply-chains-2026-04-20)
- [The Hacker News — Anthropic MCP Design Vulnerability (2026-04-16)](https://thehackernews.com/2026/04/anthropic-mcp-design-vulnerability.html)
- [SecurityWeek — 'By Design' Flaw in MCP (2026-04-16)](https://www.securityweek.com/by-design-flaw-in-mcp/)
- [Cloudflare enterprise MCP reference architecture (2026-04-22)](https://blog.cloudflare.com/enterprise-mcp/)
- [NVD CVE-2026-30615](https://nvd.nist.gov/vuln/detail/CVE-2026-30615)
- [RedPacket Security CVE-2026-6980 (2026-04-25)](https://www.redpacketsecurity.com/cve-alert-cve-2026-6980-divyanshu-hash-gitpilot-mcp/)
