# v0.5.6 — Claude Managed Agents + fresh MCP CVE presets

**Tagged 2026-04-25** · `pip install agent-airlock==0.5.6`

Six opt-in primitives shipped on 24 hours of fresh April 2026 industry
signal: two MCP-server CVEs (one with no preset coverage anywhere,
one still unpatched upstream), the first-party Claude Managed Agents
audit hook, an "archived-but-still-published" MCP package gate, and a
time-windowed CVE-coverage report flag for the egress-bench walker.

**Stats:** 1,696 tests · 82.66% coverage · zero new runtime deps.

## Highlights

### Claude Managed Agents audit hook

Anthropic's Claude Managed Agents went public-beta on **2026-04-08**
at $0.08/runtime-hour, used in production by Notion, Rakuten, Asana,
Vibecode, and Sentry. The runtime ships a curated tool harness
(`read_file`, `bash`, `web_browse`, `code_execute`) and streams raw
tool inputs/outputs over Server-Sent Events.

agent-airlock 0.5.6 adds the caller's side of the integration:

- **Pinned beta header + toolset version** to detect Anthropic schema
  drift early.
- **Tool-list intersection** at the request boundary — your local
  `SecurityPolicy.allowed_tools` is enforced against the harness
  toolset.
- **SSE frame redaction** via the v0.5.3 `log_redaction` filter so
  tool inputs/outputs surfaced over the stream don't carry raw
  bearer tokens / JWTs / API keys to your log handler.
- **OTel span emission** (`airlock.managed_agents.invoke`) per audit.

See [`docs/integrations/managed-agents.md`](../docs/integrations/managed-agents.md).

### Two fresh MCP CVE presets

- **CVE-2026-39884** — `flux159/mcp-server-kubernetes` argv flag-
  injection (disclosed 2026-04-14, fixed in 3.5.0). New
  `mcp_spec/argv_guard.py` covers a regression class distinct from
  v0.5.5's CVE-2026-5023: this one rejects space-injected flag
  concatenation that has *no* shell metacharacters present. See
  [`docs/cves/cve-2026-39884.md`](../docs/cves/cve-2026-39884.md).

- **CVE-2026-23744** — MCPJam Inspector unauthenticated public bind
  (CVSS 9.8). New `mcp_spec/bind_address_guard.py` rejects
  `0.0.0.0`-class binds unless explicitly opted in *and* auth is
  configured. See
  [`docs/cves/cve-2026-23744.md`](../docs/cves/cve-2026-23744.md).

### Archived-MCP-server gate

Tools whose `package_origin` references an archived-but-still-
published MCP package now fail closed by default. Seed list:
Puppeteer (~91k npm downloads/month, advisory 3662 covering SSRF +
indirect prompt injection + Chromium sandbox bypass), Brave Search,
EverArt. Allow-list opt-out for in-house forks.

> ⚠️ **Known v0.5.6 bug — fixed in v0.5.6.1.** The v0.5.6 wheel
> shipped without the seed block-list (it was loaded from
> `tests/cves/fixtures/`, which isn't packaged). On a clean
> `pip install agent-airlock==0.5.6`, the preset silently failed
> open. Upgrade to **v0.5.6.1** to pick up the fix.

### `airlock egress-bench --since YYYY-MM-DD`

Time-windowed CVE coverage report. Useful for security-team
reporting: *"what April 2026 CVEs are we now blocking?"*. Required
new `disclosed_at` field on every fixture; v0.5.6 backfilled the
five v0.5.x fixtures (file-level) plus the ten OX-supply-chain
umbrella sub-entries (per-payload). See
[`docs/cli/egress-bench.md`](../docs/cli/egress-bench.md).

### README honesty fix

Performance table claimed `9` framework integrations; the Complete
Examples table directly above it listed `10` (Claude Agent SDK was
added in v0.5.1 but the metric never caught up). Bumped to `10` and
added a regression test that locks the two tables together.

## Top-level surfaces added

| Type | Symbol |
|---|---|
| Error | `ArgvStringConcatenationError` |
| Error | `BindAddressPublicError` |
| Error | `UnauthenticatedPublicBindError` |
| Error | `ManagedAgentToolBlocked` |
| Error | `ManagedAgentBetaHeaderMissingError` |
| Error | `UnknownToolsetVersionError` |
| Error | `ArchivedMcpServerBlocked` |
| Preset | `flux159_mcp_kubernetes_cve_2026_39884_defaults` |
| Preset | `mcpjam_cve_2026_23744_defaults` |
| Preset | `claude_managed_agents_safe_defaults` |
| Preset | `archived_mcp_server_advisory_defaults` |

## Primary sources (cited verbatim in each new module docstring)

- [SentinelOne CVE-2026-39884 (2026-04-14)](https://www.sentinelone.com/vulnerability-database/cve-2026-39884/)
- [GHSA-232v-j27c-5pp6 / CVE-2026-23744](https://github.com/advisories/GHSA-232v-j27c-5pp6)
- [Anthropic — Claude Managed Agents launch (2026-04-08)](https://claude.com/blog/claude-managed-agents)
- [GitHub modelcontextprotocol/servers issue #3662 — Puppeteer](https://github.com/modelcontextprotocol/servers/issues/3662)
