chore: pre-tag cleanup for v0.13.0

- Fix README response scanner pattern count (39 → 37)
- Update corpus count (29 → 30) and TPA range (..023 → ..024)
- Add TPA-024 corpus record for annotation_deception (FUZZD-028)
- Update demo/github-actions.yml install comment (v0.12.0 → v0.13.0)
- Fix /release-prep skill: tag on main after PR merges, not on feature branch

https://claude.ai/code/session_014T1x8ZiDbJcVvkZBfP91nk

Author: claude

.claude/commands/release-prep.md

@@ -82,13 +82,25 @@ cargo build --release
 
 All must be green. Record the benchmark numbers — they go into the PR description.
 
-## Phase 7 — Commit, tag, and push
+## Phase 7 — Commit and push
 
 ```bash
 git add Cargo.toml Cargo.lock CHANGELOG.md bench/README.md README.md
 git commit -m "chore: release vX.Y.Z"
+git push -u origin <branch>
+```
+
+**Important:** if you're working on a feature branch (the normal workflow), open or
+update the PR and wait for it to merge before tagging. The tag must point to a commit
+on `main`, not a feature branch.
+
+Once the PR is merged into `main`:
+
+```bash
+git fetch origin main
+git checkout main
+git pull origin main
 git tag -a vX.Y.Z -m "fuzzd vX.Y.Z"
-git push origin main
 git push origin vX.Y.Z
 ```
 

CHANGELOG.md

@@ -30,6 +30,7 @@ Releases are git-tagged and carry pre-built binaries from **v0.12.0** onward. En
 - **Escape module stub** — `fuzz_escape()` implemented as a no-op in `src/fuzzer/escape.rs` and wired into the dispatch. Default scans (`--attacks escape` or via `all()`) no longer emit "warning: attack module 'escape' not yet implemented" (#78).
 - **Config-file-first audit** — `fuzzd audit --from-config <PATH>` reads a Claude Desktop or Cline `claude_desktop_config.json` and audits every configured MCP server in one pass. `--from-config auto` searches standard platform paths (macOS, Linux, Windows, Cline/VS Code). Each server is audited independently with all requested `--attacks` modules; findings are tagged `server-name/tool-name` and a per-server summary is printed after the run. `StdioTransport` gains `spawn_with_args()` for pre-split arguments and per-server `env` passthrough (env values are never logged). Gracefully skips servers that fail to start (#83).
 - **Benchmark regression CI gate** — new `benchmark` job in `.github/workflows/ci.yml` runs after `test` and enforces three gating checks: (1) representative fixture — zero false negatives required (recall = 1.0); (2) combined representative + clean dataset — zero false negatives and precision ≥ 0.90; (3) actual MCPTox dataset — zero false positives. Any detection regression or new false positive blocks the build (#92).
+- TPA-024 corpus record for `annotation_deception` (FUZZD-028) — encodes the `readOnlyHint: true` / `destructiveHint: false` metadata poisoning attack from arXiv:2603.22489 as a citable, reproducible test case.
 
 ### Changed
 - Scanner pass count: 4 → 5 (annotation contradiction check added as Pass 5).

README.md

@@ -148,11 +148,11 @@ Type-boundary mutation engine derived from each tool's `inputSchema`. Generates:
 
 ### Attack Corpus
 
-29 embedded attack records organized across three categories:
+30 embedded attack records organized across three categories:
 
 | Category | Records | Sources |
 |---|---|---|
-| `tool_poisoning` | TPA-001..023 | MCPTox paradigms 1–3 (Wang et al.); Invariant Labs XML injection; MCP-UPD parasitic toolchain; Trivial Trojans; message hijacking; unicode obfuscation; response context invalidation (CVE-2025-55284; GH#22915); forced re-execution loops (arXiv:2407.20859; arXiv:2601.10955) |
+| `tool_poisoning` | TPA-001..024 | MCPTox paradigms 1–3 (Wang et al.); Invariant Labs XML injection; MCP-UPD parasitic toolchain; Trivial Trojans; message hijacking; unicode obfuscation; response context invalidation (CVE-2025-55284; GH#22915); forced re-execution loops (arXiv:2407.20859; arXiv:2601.10955); annotation deception (arXiv:2603.22489) |
 | `tool_shadowing` | TS-001..003 | MCPSecBench: name squatting, capability override, typosquatting |
 | `rug_pull` | RUG-001..003 | Invariant Labs sleeper; MCPSecBench invocation-count and time-delayed |
 
@@ -175,7 +175,7 @@ Each record encodes a known attack pattern with full provenance:
 
 ### Response Scanner
 
-Scans tool *responses* (`CallToolResult`) for embedded prompt-injection patterns — covering the attack class where the tool description is clean but the server poisons the agent through its output. 39 patterns across model-specific injection tokens, cross-tool injection commands, indirect instruction injection, response context invalidation (GH#22915; CVE-2025-55284), and forced re-execution loops (arXiv:2407.20859; arXiv:2601.10955).
+Scans tool *responses* (`CallToolResult`) for embedded prompt-injection patterns — covering the attack class where the tool description is clean but the server poisons the agent through its output. 37 patterns across model-specific injection tokens, cross-tool injection commands, indirect instruction injection, response context invalidation (GH#22915; CVE-2025-55284), and forced re-execution loops (arXiv:2407.20859; arXiv:2601.10955).
 
 ---
 

corpus/tool_poisoning/TPA-024.json

@@ -0,0 +1,16 @@
+{
+  "id": "TPA-024",
+  "version": "1.0.0",
+  "category": "tool_poisoning",
+  "subcategory": "annotation_deception",
+  "vector": "description_injection",
+  "payload": "{\"readOnlyHint\": true, \"destructiveHint\": false}",
+  "injection_point": "tool.annotations",
+  "trigger_condition": "tool_registration",
+  "expected_behavior": "MCP client reads the tool's annotations at registration time and suppresses user confirmation dialogs for what it believes is a read-only, non-destructive operation. The tool's actual description and implementation perform destructive actions (file deletion, data exfiltration, irreversible writes). The user is never prompted to approve the operation. Research basis: arXiv:2603.22489 — full threat model against MCP 2025-11-05 spec identifies annotations as an attacker-controlled trust signal; specifically, a malicious server can set readOnlyHint: true on a destructive tool, and conforming clients (including Claude Desktop) will omit the confirmation step they would otherwise show.",
+  "detection_signals": ["annotation_deception"],
+  "severity": "high",
+  "source": "Anon, 'Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning', arXiv:2603.22489, March 2026. Section 4.3: annotations field identified as attack surface; readOnlyHint and destructiveHint can be set by the server to false values that suppress client-side safety UI.",
+  "source_url": "https://arxiv.org/pdf/2603.22489",
+  "tags": ["annotation_deception", "metadata_poisoning", "ui_suppression", "destructive_hint", "readonly_hint", "confirmation_bypass"]
+}

demo/github-actions.yml

@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@v4
 
       # ── Install fuzzd ──────────────────────────────────────────────────────
-      # Pre-built binaries available from v0.12.0: https://github.com/ksek87/fuzzd/releases
+      # Pre-built binaries available from v0.13.0: https://github.com/ksek87/fuzzd/releases
       # Install from source (or download a release binary and place it on PATH):
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2