[astrogilda]

Fixes #

Describe the changes you have made in this PR -

No linked issue. This pull request adds MCP abuse, context-injection, approval-bypass and unsafe-tool-execution cases, at least one of each.

This adds six MCP abuse cases at trace level, each with a trace that trips it: two in schema categories no bundled scenario used (context_injection, unauthorized_outbound_action), and four on the MCP surface that the bundled MCP scenarios do not cover.

Each failing trace runs in the regression_demo gate, following examples/traces/README.md: a scenario that cannot fail is no regression test.

The approval_required assertion matches its action against observed tool names. MCP calls are recorded as mcp/<server_id>/<tool>, so a bare action name returns not_run even when an agent called it.

The cases exercise the evidence vectors at probityai/agent-evidence-vectors, cited in each scope note.

Edited 2026-10-09: the approval_required docs line and its two tests are in this PR, and the vectors link points at the current owner.

---

Code Understanding and AI Usage

Did you use AI assistance (ChatGPT, Claude, Copilot, etc.) to write any part of this code or documentation ?

• No, I wrote all the code myself
• Yes, I used AI assistance

If you used AI assistance, briefly describe:

• Tool(s) used: Claude Code.
• Parts of the contribution that were AI-assisted: scenario YAML, trace fixtures and prose, from my own threat model of MCP servers and attack cases I wrote.
• How you reviewed the output: I read each scenario against schemas/scenario.schema.json. I checked each fails on its violating trace, and passes or returns not_run on its clean one.
• Tests or checks I ran: the commands below, on a clean checkout.

ruff check src tests
mypy
pytest --cov=src/agent_harness --cov-fail-under=80
# plus the whole security-regression job, with its three regression_demo gates

---

Checklist before requesting a review

• I have added proper PR title and linked to the issue. Title yes; issue no, because no open issue covers this.
• I have performed a self-review of my code
• I can explain the purpose of every documentation, function, class, and logic block I added
• I understand why my changes work and have tested them thoroughly
• I have considered potential edge cases and how my code handles them
• If it is a core feature, I have added thorough tests
• My code follows the project's style guidelines and conventions
• I added an entry under [Unreleased] in CHANGELOG.md (or this PR does not need one — pure refactor, internal tests, or CI-only change)

[astrogilda]

Hey @mertsatilmaz, the tests run on this pull request is waiting for approval. I ran its three jobs against the merge commit, and lint, tests and the security-regression job all pass. Each of the six new MCP scenarios returns fail against its failing trace, as that job requires. Would you approve the run when you have a moment?