III. Crosswalks

ATR × SAF-MCP techniques

Not an endorsementATR maintainers wrote this mapping. SAF-MCP has not reviewed or endorsed it. It is not evidence of compliance with any regulation.

Sourcedocs/SAFE-MCP-MAPPING.md · last commit 2026-11-10

Framework: SAF Framework Model v2 — secure-agentic-framework/saf-mcp, research/framework-model.yml at 4a74d69 (2026-09-02) ATR release reviewed: v4.1.5 (reviewed 2026-10-16)

How to read this

Each pair was proposed from the rule's actual patterns and conditions, then kept only if two independent reviewers agreed on the technique fit and the relationship. Relationships follow the SAF registry semantics; nothing is marked direct.
partial: the rule represents a bounded subset of the technique. adjacent: the rule provides supporting context but does not by itself represent the technique. These follow the SAF detection registry definitions.
Modalities name the observation surfaces the rule actually inspects, using the SAF registry vocabulary.
This is an inventory of candidate mappings, not a coverage or effectiveness claim, and none of the pairs has been validated by SAF. SAF decides whether an external mapping is validated in its own registry.
Deprecated SAF techniques are not mapped.
Per-rule references.safe_mcp tags inside rule files are author-declared and are not reconciled with this table; where they differ, this table is the reviewed result.

Summary

Active techniques in the framework model: 78
Techniques with at least one reviewed ATR rule (partial or adjacent): 55
Of those, techniques whose only reviewed rules are adjacent (supporting context, not detection of the technique itself): 20
Techniques with none: 23 (listed at the end)
Reviewed pairs: 131

Mappings

SAF-T1001 — Tool Poisoning Attack

Tactic: ATK-TA0001 Initial Access

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00161	partial	content	Matches <IMPORTANT>...</IMPORTANT> blocks with read/send/invoke/forward verbs, references to an 'also present'/'previously declared' companion tool, and 'before using this tool, read <path>' directives. This is the Invariant-style cross-tool redirection variant of T1001. One condition (any bare sensitive-file name) is not specific to tool metadata, so the rule covers only a subset.
ATR-2026-00579	partial	content	Regexes require a JSON "description"/"param_description" value (or 'tool description' text) carrying an agent-addressed imperative such as 'before using this tool', 'you must ... read/send/forward/route' or 'ignore previous'. That is the instruction-bearing tool-metadata subset of T1001; it does not observe definition drift or the redirected call that follows.
ATR-2026-01300	partial	content	Patterns match tool description or schema text telling the model to put the full chat history or transcript into a notes/history parameter. This is the argument-alteration subset of T1001, where metadata changes call arguments against the user's intent. It is limited to that one exfiltration idiom.
ATR-2026-02025	partial	content	Detects directives hidden in inputSchema parts other than the description, such as imperative parameter names (contentfromreading...idrsa), extra/sidenote/doc_ fields that say to read and pass secrets, and 'in order to ... you must' text inside required/default fields. This matches T1001's parameter-schema poisoning vector, which changes arguments.

SAF-T1002 — Supply Chain Compromise

Tactic: ATK-TA0001 Initial Access

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00575	adjacent	static	Flags the binding.gyp <!(...) install-time fetch-and-run primitive and agent-config backdoor writes used by the Phantom Gyp/Miasma worm, which republished compromised legitimate packages. The rule has no condition on the T1002 discriminator: digest, signature or provenance mismatch on a trusted channel. It gives only artifact-level supporting context.

SAF-T1003 — Malicious MCP-Server Distribution

Tactic: ATK-TA0001 Initial Access

ATR rule	Relationship	Modalities	Evidence
ATR-2026-02405	partial	static	Scans MCP-server and skill package contents for the AgentBaiting/FakeGit distribution structure: a .cmd/.bat launcher starting a renamed exe with a .txt argument, a LuaJIT runtime with a releases zip, mcp_servers configs pointing at .cmd/.bat, and campaign IOC repos and hashes. These packages were published intentionally through MCP registries, which is a bounded subset of malicious MCP-server distribution.

SAF-T1005 — Exposed Endpoint Exploit

Tactic: ATK-TA0001 Initial Access

ATR rule	Relationship	Modalities	Evidence
ATR-2026-01985	partial	content	Matches /bridge request bodies whose serverPath names a shell or interpreter alongside an args field, or a bash/sh serverPath whose -c/-lc args chain a recon or egress command. This is MCP Connect's unauthenticated-by-default route that spawns backend processes, the 'support/test endpoint spawning a process' variant of T1005. The rule keys on the payload, not on the missing-auth decision.
ATR-2026-01986	partial	content, network	Matches an OPTIONS preflight on /mcp answered with wildcard Access-Control-Allow-Origin/Methods, and tools/call PowerShell in the same exchange as ACAO '*'. This is the T1005 subset where a browser origin reaches an MCP endpoint without Origin validation.
ATR-2026-02021	partial	content, network	Matches the request a browser or curl sends to MCP Inspector's unauthenticated proxy: /sse?transportType=stdio&command=... or 0.0.0.0/127.0.0.1/[::1]:6277 with command=. This is the browser-to-local-proxy realization (CVE-2025-49596) cited by T1005. It is product-specific and does not itself check the auth or Origin decision.

SAF-T1006 — User-Social-Engineering Install

Tactic: ATK-TA0001 Initial Access

ATR rule	Relationship	Modalities	Evidence
ATR-2026-02405	partial	static	Several conditions match deceptive install content in fake MCP-server repos: download the release zip/exe and double-click it, click 'run anyway' past SmartScreen, disable Defender during setup, and mcp_servers configs whose command is a .cmd/.bat launcher. This is a bounded lure subset of user-approved attacker-controlled MCP installs. The rule does not observe the user's install action itself.

SAF-T1008 — Cross-Server Tool Shadowing

Tactic: ATK-TA0001 Initial Access, ATK-TA0004 Privilege Escalation

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00161	partial	content	Condition 2 requires a descriptor referencing a co-installed tool via 'also present / previously declared / already installed <tool>' wording, matching the Invariant Labs foreign-tool shadowing PoC; other OR-branches (<IMPORTANT> directives, credential paths) also fire on ordinary own-tool poisoning, so it covers a bounded subset.
ATR-2026-01775	partial	content	Branches 'after using <X> tool ... run this function ... modify/override result' and 'override the result of a check/verify tool' capture a descriptor directing how another tool's output is handled; its replacement/drop-in branches are name-squatting, which SAF scopes out of shadowing.
ATR-2026-00579	adjacent	content	Flags tool/parameter description fields ordering the model to prepend/run/route actions before using any tool or every shell command, which can alter invocation of tools from other servers, but it does not require a foreign-tool reference or provenance mismatch.

SAF-T1101 — Command Injection

Tactic: ATK-TA0002 Execution

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00434	partial	content	Requires an OAuth/OIDC metadata URL field (authorizationendpoint, tokenendpoint, etc.) carrying shell metacharacters ($( ), backticks, &&, \|cmd, ;cmd) - exactly the SAF 'authorization metadata' vector (CVE-2025-6514 mcp-remote), but only that one command-bearing input path.
ATR-2026-02021	partial	content	Matches /sse proxy requests with transportType=stdio plus an attacker-supplied command= parameter (or a request to localhost:6277 carrying command=), the CVE-2025-49596 full-executable-selection variant SAF cites; limited to the MCP Inspector proxy shape.
ATR-2026-02141	partial	content	Detects MCP server config command/args pairs that launch nc -e, a shell/interpreter -c with network-fetch/reverse-shell payloads, docker build from a URL, or npx --yes, covering the SAF 'server configuration crosses into process launch' vector only for those dangerous command shapes.
ATR-2026-00111	adjacent	content	Matches shell-syntax injection in argument text (semicolon-chained dangerous commands, $( ) or backtick substitution running curl/bash/rm, &&/\|\| chains, pipes to sh/nc), i.e. the 'command modification through executable syntax' tool-input variant, without proving a reachable launch boundary.

SAF-T1102 — Prompt Injection (Multiple Vectors)

Tactic: ATK-TA0002 Execution

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00001	partial	content	Regexes over user_input for ignore/disregard/override-previous-instructions, new-task switches and hidden-instruction reveal demands cover the SAF direct user-prompt vector only.
ATR-2026-00002	partial	content	Matches instruction-override text in HTML comments, CSS-hidden elements, runs of zero-width/bidi characters, injected [INST]/<\|im_start\|> wrappers and AI-addressed imperatives in external content, covering the indirect and visually hidden sub-vectors.
ATR-2026-00579	partial	content	Requires a JSON tool/parameter 'description' field (or described docstring) carrying a model-addressed imperative (you must prepend/run/route, ignore the user, before using this tool), covering the SAF tool-description injection sub-vector.

SAF-T1105 — Path Traversal via File Tool

Tactic: ATK-TA0002 Execution

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00578	partial	content	The rule matches non-canonical paths: a sensitive prefix followed by ./ or ../ hops, /etc/../etc/shadow bounces, and redundant slashes that resolve to protected files. This is T1105's 'alternate path forms defeat denylist checks' vector. It covers only sensitive-file targets and does no canonical containment check.
ATR-2026-01616	partial	content	The rule matches two or more ../ segments in toolargs that point into system directories (etc, root, home, proc, var), and deep traversal in userinput. That is lexical traversal in a file-tool argument, a bounded subset of T1105. The rule cannot compare the canonical resolved path with allowed roots, and it misses traversal through links or alternate path forms.
ATR-2026-02700	partial	content	The rule requires two or more percent-encoded ../ segments as the whole value of a named file-path parameter in tool_args, reaching a credential or system file. This covers the encoding-bypass vector T1105 describes. It is limited to credential-file targets, and its own documentation states it misses positional arguments.

SAF-T1106 — Autonomous Loop Exploit

Tactic: ATK-TA0002 Execution

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00209	partial	content	The rule matches MCP response fields set to imperative continuation directives: retryhint loop/until, continueaftererror with retry counts of 100 or more, nextaction invoke chains, and 'retry this tool indefinitely'. This is T1106's primary vector, where a malicious server returns follow-up instructions that cause re-invocation. The rule cannot confirm that the loop actually ran without an effective bound.

SAF-T1111 — AI Agent CLI Weaponization

Tactic: ATK-TA0002 Execution

ATR rule	Relationship	Modalities	Evidence
ATR-2026-01989	adjacent	content	The rule matches agent tool calls that run nmap CIDR sweeps across a port range, or subnet netcat loops. These are target-facing offensive actions that an agent CLI performs during T1111 operations. The rule cannot separate a weaponized CLI from a hijacked agent or an authorized test.
ATR-2026-02400	adjacent	content	The rule matches agent CLI names (claude, codex, gemini, hermes, aider and others) together with documented approval-bypass flags, environment variables and settings (--dangerously-skip-permissions, --yolo, bypassPermissions). That is the unsafe-mode marker in T1111's analytic. The rule does not require the correlated shell child process, and it also fires when a benign user's agent is hijacked, so it is supporting context rather than a bounded subset.

SAF-T1201 — Post-Approval Tool Mutation

Tactic: ATK-TA0003 Persistence

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00126	adjacent	static	The rule matches skill code patterns that make later mutation possible: eval(fetch(...)), base64-decode-then-exec, post-install remote fetch, and remote config loading. The rule itself says real rug-pull detection needs hash comparison over time. It flags the precondition, not the mutation after approval.
ATR-2026-00581	adjacent	content	The rule matches tool-definition text where a post-approval or version-bump trigger ('after the user approves', 'on subsequent runs', 'now that this tool is trusted') appears with an exfiltration or execution indicator. It also matches text that rewrites its own description to add required initialization steps. It sees only the content of the mutated definition, not T1201's decisive comparison of the approved hash against the observed hash.

SAF-T1204 — Context Memory Implant

Tactic: ATK-TA0003 Persistence, ATK-TA0008 Lateral Movement

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00551	partial	memory, runtime	This trace forbid rule fires when a memory.write/vectorstore.upsert/longterm.append/rag.ingest TOOL span sets targetconversation_id to a value other than the active conversation.id. It observes a durable memory write that lands in another session's scope. Correlating that write with the later retrieval is left outside the rule.
ATR-2026-00075	adjacent	content	The regexes require explicit persistence verbs ('commit to memory', 'add ... to your permanent/long-term memory') or cross-session framing ('in all future sessions ... always'), joined to behavior-changing directives. That covers the memory-instruction-marked write stage of an implant, but not the later cross-session retrieval that T1204 also requires.

SAF-T1302 — Agentic Confused Deputy

Tactic: ATK-TA0004 Privilege Escalation

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00074	adjacent	content	Conditions match inter-agent requests such as 'execute this with your admin/elevated permissions', 'use my elevated access', or claims to act on behalf of an admin/orchestrator agent. These capture a lower-privilege principal asking a deputy agent to use authority the requester lacks. The rule does not observe the resulting privileged tool effect or the missing authorization check.
ATR-2026-00549	adjacent	runtime	This trace require rule fires when a TOOL span with tool.privilege=destructive has no earlier HUMAN span or approval attribute in the trace. That is the missing-approval indicator before an elevated action. It does not establish the low-trust requestor or untrusted content side of the authority mismatch.
ATR-2026-02667	adjacent	content	The rule matches a submitted job or workflow payload whose approve/approvedtools/autoapprovetools list already names executecommand, shell, delete_file and similar tools. In that case a requestor-supplied list neutralizes the runtime approval gate (the PraisonAI unauthenticated Jobs API case). That is one bounded variant of an action-bound approval that is ineffective against a low-trust requestor.

SAF-T1303 — Sandbox Escape via Server Exec

Tactic: ATK-TA0004 Privilege Escalation

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00567	adjacent	content	Regexes fire when an MCP stdio config's "command" is a raw shell or contains shell metacharacters, or when "args" passes -c/-e with a code payload. This is the attacker-supplied launch material in CVE-2026-42271 (LiteLLM stdio spawn, SAF claim C003). The rule sees only the request side and cannot confirm that the spawned process ran in a different, more privileged context.
ATR-2026-02141	adjacent	content	Matches dynamic MCP server config whose command/args launch an attacker-chosen process: nc -e, a shell or interpreter -c with a dangerous payload, docker build from a remote URL, an npx --yes allowlist bypass, or a node //path bypass. This is attacker-controlled launch material reaching a process launcher. The resulting privilege context is not observed.

SAF-T1305 — Host OS Priv-Esc (RCE)

Tactic: ATK-TA0004 Privilege Escalation

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00434	partial	content	Detects shell metacharacters, command substitution, or URL-encoded metacharacters inside authorization_endpoint and other OAuth metadata URLs in an MCP server response. This is exactly the CVE-2025-6514 mcp-remote vector that SAF cites as demonstrated host RCE. It is limited to that one metadata-to-exec flaw.
ATR-2026-01985	partial	content	Fires on a /bridge request whose serverPath names a shell or interpreter with an args field, or bash -c chained recon/egress commands. The flaw is an unauthenticated MCP bridge spawning an arbitrary host process as its own account. This is the same unauthenticated proxy-to-exec class as the Inspector case.
ATR-2026-02021	partial	content	Matches the MCP Inspector proxy request /sse?transportType=stdio&command=..., or a :6277 loopback URL carrying command=. This is the CVE-2025-49596 browser-to-Inspector unauthenticated command launch that SAF lists as demonstrated evidence. It covers one product path.

SAF-T1307 — Confused Deputy Attack

Tactic: ATK-TA0004 Privilege Escalation

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00434	partial	content	SAF-T1307 cites CVE-2025-6514 as a direct deputy case: untrusted server metadata reaches a privileged URL-opening path. It also names 'untrusted authorization endpoint preceding a process launch' as a product IoC, and this rule matches that malicious authorization_endpoint metadata. Initiator/deputy binding validity is not observed.
ATR-2026-02021	partial	content	SAF-T1307 lists CVE-2025-49596 as a direct vulnerability: an unauthenticated initiator exercises the Inspector proxy's stdio launch authority. This rule matches that unauthenticated proxy request shape (/sse transportType=stdio command=). It covers only this product-specific deputy path.

SAF-T1402 — Instruction Steganography

Tactic: ATK-TA0005 Defense Evasion

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00129	adjacent	content	On content (skill or tool metadata), the rule matches 3 or more Unicode Tag surrogate pairs, or 5 or more zero-width characters on one line. Both are invisible instruction carriers, but the same code points occur in legitimate text (a subdivision-flag emoji such as the England flag is a run of Tag characters and fires the first condition), and SAF states that character anomalies alone are insufficient. This is carrier-only supporting context with no recovery or action correlation.
ATR-2026-00258	adjacent	content	Regexes on tool_response fire on invisible Unicode Tag-block characters (U+E0000-E007F, including Tag-ASCII and escaped forms). That is one of the invisible Unicode carriers T1402 lists, but a single Tag-ASCII character also fires on legitimate subdivision-flag emoji, and SAF states that character anomalies alone are insufficient, so this is carrier-only supporting context. The rule does not see the decode or sensitive-action correlation that SAF requires, and it does not cover the image, share or opaque-state carriers.
ATR-2026-00312	partial	content	Fires on runs of 3 or more Variation Selectors Supplement codepoints in tool_response, and on 'decode variant selector' framing. This is an ASCII-smuggling encoding whose meaning is invisible to a reviewer but recoverable by the model, so it is one bounded encoded-carrier subset of T1402.
ATR-2026-00276	adjacent	content	Matches repeated zero-width characters and BiDi override/isolate controls in tool_response, plus their escaped forms in content. These map to the 'invisible Unicode and control characters' carrier in T1402. SAF notes that character anomalies alone are insufficient, so this is carrier-only supporting context.

SAF-T1405 — Tool Obfuscation/Renaming

Tactic: ATK-TA0005 Defense Evasion

ATR rule	Relationship	Modalities	Evidence
ATR-2026-00060	partial	content	Regexes on tool_name match typosquatted names (filesystem/github/slack/openai/anthropic variants), trust-implying prefixes (official-/verified-), fake version or enhanced suffixes, and description claims of being a replacement for a legitimate tool. These cover the deceptive-name and collision subset of T1405, but not definition-hash drift against an approved binding.
ATR-2026-01775	partial	content	The first two conditions match tool descriptions claiming to replace, shadow, act as, or be a drop-in replacement for an official or standard named tool. That is descriptor wording meant to cause misidentification with an expected capability. The other conditions target covert-action directives that are not T1405.
ATR-2026-01301	adjacent	content	Matches tool-description directives such as 'use this tool rather than', 'do NOT use other tools' and 'always use this tool regardless'. These bias preferential selection, but through instruction-bearing semantics, which SAF assigns to T1001 rather than to identity presentation.

SAF-T1408 — OAuth Protocol Downgrade

Tactic: ATK-TA0005 Defense Evasion

ATR rule	Relationship	Modalities	Evidence
ATR-2026-02409	partial	content	One condition requires MCP context markers (mcpServers, oauth-protected-resource, /mcp) within 600 chars of codechallengemethod=plain. That matches the T1408 indicator of an MCP authorization request using plain PKCE. The rule does not cover a missing code_challenge, verifier-without-challenge exchanges, or the S256-to-weaker transition, and the same condition also matches implicit and password grants.