apifox-mcp-server
使用 Apifox MCP Server,可以将 Apifox 项目内的接口文档作为数据源提供给 Cursor 等支持 AI 编程的 IDE 工具以便让 AI 能够直接访问项目对应的接口文档数据。
0Tools
17Findings
75Stars
Mar 22, 2026Last Scanned
7 critical · 8 high · 1 medium · 1 low findings detected
Security Category Deep Dive
Prompt Injection
Prompt & context manipulation attacks
69
Maturity
14
Rules
5
Sub-Categories
1
Gaps
64%
Implemented
56
Tests
1
Stories
Findings1
1 critical
criticalJ5Tool Output Poisoning PatternsMCP02-tool-poisoningAML.T0054
Pattern "throw.*Error.*(?:curl|wget|fetch|http|send).*(?:key|token|secret|password)" matched in source_code: "throw new TypeError("argument obj must be object");var r=Object.getOwnPropertyDescriptor(t,e);if(!r)throw new TypeError("must call property on owner object");if(!r.configurable)throw new TypeError("property must be configurable");var i=this,s=vu(),c=da(s[1]);c.name=e,"value"in r&&(r=J7(t,e,n));var u=r.get,l=r.set;typeof u=="function"&&(r.get=function(){return hu.call(i,n,c),u.apply(this,arguments)}),typeof l=="function"&&(r.set=function(){return hu.call(i,n,c),l.apply(this,arguments)}),Object.defineProperty(t,e,r)}function E1(t,e,n){var r=new Error,i;return Object.defineProperty(r,"constructor",{value:E1}),Object.defineProperty(r,"message",{configurable:!0,enumerable:!1,value:e,writable:!0}),Object.defineProperty(r,"name",{enumerable:!1,configurable:!0,value:"DeprecationError",writable:!0}),Object.defineProperty(r,"namespace",{configurable:!0,enumerable:!1,value:t,writable:!0}),Object.defineProperty(r,"stack",{configurable:!0,enumerable:!1,get:function(){return i!==void 0?i:i=Y7.call(this,n)},set:function(c){i=c}}),r}});var Cs=R((jV,A1)=>{"use strict";A1.exports=Object.setPrototypeOf||({__proto__:[]}instanceof Array?cP:uP);function cP(t,e){return t.__proto__=e,t}function uP(t,e){for(var n in e)Object.prototype.hasOwnProperty.call(t,n)||(t[n]=e[n]);return t}});var T1=R((qV,pP)=>{pP.exports={"100":"Continue","101":"Switching Protocols","102":"Processing","103":"Early Hints","200":"OK","201":"Created","202":"Accepted","203":"Non-Authoritative Information","204":"No Content","205":"Reset Content","206":"Partial Content","207":"Multi-Status","208":"Already Reported","226":"IM Used","300":"Multiple Choices","301":"Moved Permanently","302":"Found","303":"See Other","304":"Not Modified","305":"Use Proxy","307":"Temporary Redirect","308":"Permanent Redirect","400":"Bad Request","401":"Unauthorized","402":"Payment Required","403":"Forbidden","404":"Not Found","405":"Method Not Allowed","406":"Not Acceptable","407":"Proxy Authentication Required","408":"Request Timeout","409":"Conflict","410":"Gone","411":"Length Required","412":"Precondition Failed","413":"Payload Too Large","414":"URI Too Long","415":"Unsupported Media Type","416":"Range Not Satisfiable","417":"Expectation Failed","418":"I'm a Teapot","421":"Misdirected Request","422":"Unprocessable Entity","423":"Locked","424":"Failed Dependency","425":"Too Early","426":"Upgrade Required","428":"Precondition Required","429":"Too Many Requests","431":"Request Header Fields Too Large","451":"Unavailable For Legal Reasons","500":"Internal Server Error","501":"Not Implemented","502":"Bad Gateway","503":"Service Unavailable","504":"Gateway Timeout","505":"HTTP Version Not Supported","506":"Variant Also Negotiates","507":"Insufficient Storage","508":"Loop Detected","509":"Bandwidth Limit Exceeded","510":"Not Extended","511":"Network Authentication Required"}});var Ps=R((NV,O1)=>{"use strict";var Wf=T1();O1.exports=On;On.message=Wf;On.code=lP(Wf);On.codes=fP(Wf);On.redirect={300:!0,301:!0,302:!0,303:!0,305:!0,307:!0,308:!0};On.empty={204:!0,205:!0,304:!0};On.retry={502:!0,503:!0,504:!0};function lP(t){var e={};return Object.keys(t).forEach(function(r){var i=t[r],s=Number(r);e[i.toLowerCase()]=s}),e}function fP(t){return Object.key" (at position 5207)
Tool responses MUST NOT contain instruction-like content, file read directives, or social engineering phrases. Error messages should be factual and technical — never suggest actions involving sensitive data access. See CyberArk ATPA research for attack demonstration.
100%3 rules
Injection via tool descriptions and parameter fields
GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules
100%4 rules
Hidden instructions via external content and tool responses
100%2 rules
Context window saturation and prior-approval exploitation
100%3 rules
Payload hiding via invisible chars, base64, schema fields
50%2 rules1 found
Injection via prompt templates and runtime tool output