What's new in MoorAI, v1.17 to v1.46: MCP, secrets and oversight

The last round, What’s new in MoorAI: fail mode and living off the AI, covered agent v1.14 to v1.16. This one covers v1.17.0 to v1.46.1. The changes fall into seven groups: the agents MoorAI runs in, MCP, secrets and sensitive data, an agent working against its own guardrails, untrusted input, models, and frameworks and evidence.

Agents and where MoorAI runs

More agents. Factory Droid has pre-tool enforcement: MoorAI checks its shell, file, patch, fetch, sub-agent and MCP calls before they run. Adapters for Google Antigravity, Windsurf, Kiro and Cline are built from each vendor’s documentation.
Windows containment. A signed policy can require Codex and Copilot CLI to run their commands in Microsoft Execution Containers, and can put Claude Code’s Bash commands there too. See MoorAI and MXC.
Linux as a release. Every release ships a .deb and a tarball. The package is installed and its hook run on amd64 and arm64 in CI before it is attached.
A faster hook. moorai-hookd can serve the Claude Code hook over HTTP on loopback from pre-warmed workers, so a tool call need not start a new process.

Limit: the Antigravity, Windsurf, Kiro and Cline adapters have not yet been run against the live agents.

MCP

Drift against a fresh listing. With drift blocking on, the MCP guard and gateway judge a call against a tool listing at most five minutes old by default, re-listing the server themselves when it is stale or the server says its tools changed.
Command injection in arguments. An argument that carries a data value followed by a shell operator and a command is refused at the gateway (#54).
Package checks. An MCP server launched from a known-malicious or known-compromised package release is refused, and a signed catalogue of MCP servers and skills carries scan verdicts.
Approval receipts. A signed policy can name MCP servers, such as a remote-administration hub, whose allowed calls carry a short-lived ed25519 receipt the hub can verify.
Tool policy by class. A default policy per MCP tool class, with detokenize tools asking first.
Server-initiated requests. A server’s own sampling and elicitation requests (“run this prompt on your model”, “ask your user this”) are scanned before the client sees them.
Encoded arguments. A base64 or data: value in an outbound argument is decoded and scanned, or counted as not evaluated.

Against the ten Damn Vulnerable MCP challenges, the guard and gateway block 9 outright and all 10 with intellectual-property exposure set to block.

Limit: a device-signed approval receipt is advisory; only a receipt from the console lets a hub skip its own approval.

Secrets and sensitive data

Credentials written as text. A password or key written after a label, or listed under an “API keys” heading, is caught below the entropy bar, and so is an application-specific password.
Encoded secrets leaving. A local secret leaving base64, hex, percent-encoded, JSON-escaped, reversed or wrapped across lines is caught, and so is a secret the agent read earlier in the session.
Secrets in tool results are masked by default, and cardholder data is its own threat, with no card number or guessable hash in the evidence.
Sensitivity labels. A signed policy can act on Microsoft Purview labels in Office and PDF files an agent sends.
Cloud storage uploads. A command that uploads to S3, Azure Blob, GCS or a pre-signed URL is reported (#86).
File scanning before the model. The model proxy and moorai-serve can check each file an agent sends a model against a cloud file-scanning service. The default sends only the file’s SHA-256; uploading the file is an explicit opt-in.

Limit: the cloud-storage upload check reports by default; blocking is a policy choice.

When the agent works against its guardrails

Weakening oversight (#84). An edit or command that weakens monitoring, alerting, audit logging or safety tests asks first, and at the end of the turn MoorAI checks whether the agent said so. See When a coding agent weakens oversight.
Memory and skill files. Writes into CLAUDE.md, AGENTS.md, rules and memory files are reported, and new detectors find instructions hidden inside skill files.
Trust boundary changes (#85). When the agent adds a dependency, an outbound host, a credential path or a route in a repository that keeps a threat model as code, and leaves the model unchanged, MoorAI reports it at the end of the turn.
Agents launching agents (#88). A command that starts another agent non-interactively (claude -p, codex exec), installs one or schedules one is reported.

Limit: #85 applies only to repositories that keep a threat model as code (threatcl), and #88 is report-only by default.

Untrusted input and the task

Origin taint. Reading a file that came from outside, such as a browser download, raises scrutiny on what the agent does next, with no content analysis needed.
Quarantined reader. Under policy, such a file reaches the agent only as a summary written by a separate local model with no tools.
Task-bound tool calls. For a high-impact call, the object of the action must be named in the person’s task, a deterministic check with no model guarding a model.
The lethal trifecta (private data, untrusted content and a way out, in one session) can be enforced by policy, and knowledge-base poisoning now covers forged facts from untrusted sources and retrieved context that contradicts itself.

Limit: on Windows the quarantined reader’s owner cannot be verified, so every Windows reader is refused and outside files are blocked rather than summarised.

Models

Static model-file scanning. moorai-model-scan inspects pickle, PyTorch, Keras, TensorFlow, ONNX, GGUF and SafeTensors files without loading them, and model downloads an agent runs are scanned in the background.
Provenance pinning. The administrator lists the SHA-256 of each approved model file; a local model that is not on the list is reported, held or denied.

Limit: a pin proves which file runs, not that the file is free of a backdoor.

Frameworks and evidence

ATT&CK v20. Each partial credit now says whether it is bounded by design or an open gap. Of the 58 techniques in the agent lane, 2 are covered, 54 partial (8 by design, 46 open gaps) and 2 uncovered. See the coverage page.
CWE and CAPEC. Every threat rule carries MITRE CWE and CAPEC tags.
Watch, then enforce. moorai-profile learn drafts a workload profile from what a device already did, in report mode, and the AIBOM shows what is installed against what is actually used.
No lost alerts. Alerts the console has not acknowledged wait in a bounded, content-free outbox on the device. See When the console is down.
Incident response. Incident-response playbooks, and declared governance in the AIBOM.

Limit: a coverage level is a mechanism claim, not a detection rate.

Sources

Agent. MoorAI on GitHub: release notes for v1.17.0 to v1.46.1, and the README at v1.46.1, “What it does”, “Coverage” and “MITRE ATT&CK v20”.