feat(mcp): add ATR-derived MCP detection rules for further attack surfaces

[eeee2345]

Extends the ATR MCP detection rules from #422 with seven additional rules covering distinct MCP attack surfaces beyond the initial set (tool poisoning, credential exfiltration, command injection).

New rules (data/mcp/)

• mcp_tool_rug_pull — silent tool redefinition after client approval
• mcp_ssrf — server-side request forgery via tool URL/host arguments
• mcp_path_traversal — arbitrary file access via unconfined path arguments
• mcp_unsafe_deserialization — pickle / torch.load / yaml.load RCE on untrusted input
• mcp_sql_injection — string-built SQL from tool arguments
• mcp_missing_authentication — network-exposed MCP transport without enforced auth
• mcp_resource_prompt_injection — indirect injection via the resources / prompts surfaces

Each follows the existing info + prompt_template format from #422, emphasises concrete evidence with explicit false-positive guards (Strict Judgment Standards), and is authored by ATR (Agent Threat Rules).

Validation

Loaded each rule via NewYAMLPlugin and parsed + executed its prompt_template as a Go text/template (the scanner's runtime path) — all seven load and render cleanly; the internal/mcp package builds.

[boy-hack]

Code Review: PR #469 - feat(mcp): add ATR-derived MCP detection rules

Reviewer: aigsec | Date: 2026-07-14

✅ Overall Assessment: LGTM — recommend merge

This PR extends the ATR MCP detection rule set from #422 with 7 well-scoped new rules. Quality is consistently high.

---

Rule-by-Rule Review

Rule	Assessment	Notes
mcp_tool_rug_pull	✅	Solid post-approval mutation detection; correct false-positive guards (e.g., benign versioning)
mcp_ssrf	✅	Overlaps filename with #456 mcp_ssrf.yaml — check for file conflict before merge
mcp_path_traversal	✅	Overlaps filename with #456 mcp_path_traversal.yaml — check for file conflict
mcp_unsafe_deserialization	✅	Complements #456 mcp_insecure_deserialization.yaml (different filename, similar scope) — may need dedup
mcp_sql_injection	✅	Clear taint-path criterion, concrete evidence requirement
mcp_missing_authentication	✅	Well-scoped; correctly excludes loopback/localhost-only servers
mcp_resource_prompt_injection	✅	Good companion to existing tool-surface injection rules

---

⚠️ Conflict Warning

PR #456 (NY1024, currently open) already adds:

• data/mcp/mcp_ssrf.yaml
• data/mcp/mcp_path_traversal.yaml
• data/mcp/mcp_insecure_deserialization.yaml

If #456 merges first, this PR will have conflicts on the first two files. Recommend:

1. Merge this PR first (it validates cleanly per the author), or
2. Coordinate with feat(mcp-rules): add 4 new MCP security detection rules #456 author (NY1024) to avoid duplication / use the better version

Minor Suggestion

Consider adding info.author field to all 7 rules for consistency with newer rules that carry author attribution.

cc @pythoncheng @boy-hack for merge decision