Aguara v0.5.0:
173 Detection Rules and Confidence Scoring Strengthen the Oktsec Stack

The detection layer just got significantly stronger

Oktsec's security pipeline runs every agent message through Aguara, the open-source detection engine that performs content scanning across the MCP Gateway, proxy, audit, and MCP server operational modes. Today, Aguara v0.5.0 ships with the largest single-release expansion in the project's history: 20 new detection rules across 8 categories, pushing the total from 153 to 173 YAML-defined rules (177 including dynamic analyzer rules).

But the rule count is not the headline. Confidence scoring is. Every finding now carries a 0.0–1.0 confidence value that measures how certain the scanner is that a match is a true positive. For enterprise teams running Oktsec in production, this changes how you configure policies, set CI/CD gates, and manage alert fatigue.

What confidence scoring means for enterprise deployments

Before confidence scoring, every finding from the same rule had the same weight. A credential pattern in application code and a credential pattern in a markdown tutorial both triggered the same alert. Both matched the pattern. Only one was an actual risk. Without confidence, your SOC team had to investigate both with equal priority.

Confidence scoring solves this. Every finding now includes a confidence field (0.0–1.0) that is independent from severity. Severity measures impact if the finding is real. Confidence measures whether it is real. This distinction unlocks three capabilities for Oktsec deployments:

How confidence flows through the Oktsec pipeline

When Oktsec's content scanner processes an agent message, Aguara returns findings with confidence values. These values flow through the entire Oktsec security pipeline:

• MCP Gateway: per-agent tool allowlists can now include confidence thresholds. An agent might be allowed to call a tool unless the request triggers a HIGH+ finding with confidence above 0.8.
• Webhook payloads: the confidence field appears alongside rule_name, category, and match in webhook payloads. PagerDuty, Slack, and S3 destinations receive the confidence value for downstream processing.
• Audit trail: confidence values are stored in the audit database. Forensic investigations can filter by confidence to focus on high-certainty events.
• SARIF output: confidence maps to the SARIF rank property (0–100 scale) for integration with GitHub Advanced Security, SonarQube, and other SARIF consumers.

20 new rules closing real-world gaps

Every new rule came from one of two sources: attack patterns observed in Aguara Watch scans across 42,969 skills, or techniques documented in academic research. The expansion targets categories that were underrepresented relative to their risk in enterprise environments.

Third-Party Content (+5 rules)

The largest expansion. Third-party content execution is one of the most common attack vectors in MCP skill ecosystems. The new rules detect eval() and new Function() with external data, unsafe deserialization (pickle.loads, yaml.unsafe_load), script loading without SRI integrity checks, HTTP downgrades from HTTPS, and unsigned plugin/extension loading. THIRDPARTY_003 alone accounts for findings in 12 skills across Aguara Watch.

Indirect Injection (+4 rules)

Indirect injection is where an attacker places malicious instructions in a data source that an agent later reads and executes. The new rules detect database/cache queries driving agent behavior, webhook/callback registration with external services, git clone followed by code execution, and environment variable injection from network sources. The INDIRECT_013 pattern (git clone + execute) is particularly common in CI/CD integration skills.

Unicode Attack (+3 rules)

Zero-width character sequences, Unicode normalization inconsistencies, and mixed-script confusable identifiers. These techniques bypass string-matching security controls by exploiting the gap between what humans see and what machines process. A function named with Cyrillic "a" looks identical to one with Latin "a" but they are different identifiers.

MCP Attack & Config (+4 rules)

Auth-before-body parsing (slow-body DoS), canonicalization bypass via double-encoding, Docker --cap-add capabilities escalation, and --network host unrestricted container network access. The Docker rules came directly from Aguara Watch findings: 7 skills with --cap-add SYS_ADMIN and 23 skills with --network host in production registries.

Supply Chain, Prompt Injection & Credential Leak (+4 rules)

Sandbox escape via process spawn (CRITICAL), runtime events injected as user-role prompts, and HMAC/signing secrets in source code. SUPPLY_018 (sandbox escape) is rated CRITICAL because successful exploitation gives full host access. PROMPT_INJECTION_018 targets the subtle but powerful vector where tool error messages containing instructions get injected as user-role messages that the LLM follows.

Full detection landscape: 177 checks across 12 categories

Five analyzer engines process every scan target in sequence: Pattern Matcher, NLP Injection Detector, Toxic Flow Analyzer, Rug Pull Detector, and the post-processing pipeline (deduplication, scoring, correlation, confidence). All five engines now produce confidence-scored findings.

Configurable limits and operational hardening

Two additional changes in v0.5.0 affect operational deployments:

• Configurable max file size: the hard 50 MB scan limit from v0.4.0 is now configurable via --max-file-size flag, .aguara.yml, or the Go library API. Range: 1 MB–500 MB. Default remains 50 MB. This matters for teams scanning monorepo configurations or large YAML manifests that legitimately exceed the default threshold.
• Atomic state persistence: Aguara's state file (~/.aguara/state.json) now uses the tmp+rename pattern for writes. On POSIX systems, rename(2) is atomic within the same filesystem. A crash or OOM kill during a write no longer corrupts the state file. This is a correctness fix that matters for long-running CI/CD integrations where scans are killed by pipeline timeouts.

Stack alignment: from 153 to 173 rules across all modes

Aguara v0.5.0 is a drop-in upgrade. Because Aguara is embedded as the detection engine in Oktsec, upgrading Aguara immediately upgrades content scanning across all four Oktsec operational modes: proxy, audit, MCP server, and gateway. The 20 new rules apply to every message that passes through the pipeline.

What's next

The detection engine is heading toward 200+ rules. The next batch will focus on agentic tool abuse patterns: multi-step attack chains where individual tool calls look benign but the sequence is malicious, implicit permission escalation through tool composition, and data exfiltration via tool output channels. These patterns require understanding tool call sequences and context flow — the natural extension of the confidence scoring architecture.

Confidence scoring opens the door to adaptive policy enforcement. Instead of static severity filters, Oktsec will support confidence-based policies at the gateway level: auto-block critical findings above 0.9 confidence, create tickets for high findings above 0.7, and suppress anything below a team-defined threshold. Smarter defaults, fewer false positives, more actionable security outputs.

Every component ships under the same coordinated release cadence. When Aguara gains new detection rules, Oktsec gains them immediately. The security pipeline is production-ready. If your AI agents are connecting to databases, APIs, payment systems, or file servers without a security layer in between, let's talk about your deployment.