Arara Revenue OS

Revenue operations platform with WhatsApp messaging via Arara API and payment link generation through AbacatePay.

api-integration

GitHub

0Tools

43Findings

1Stars

—Downloads

Mar 24, 2026Last Scanned

Findings43

6critical

35high

1medium

1low

0informational

criticalK14Agent Credential Propagation via Shared StateMCP05-privilege-escalationAML.T0054

Never write credentials to shared agent state. Use credential vaults (HashiCorp Vault, AWS Secrets Manager) with per-agent scoped access. Implement OAuth token exchange (RFC 8693) for cross-agent authorization. Redact credentials from all agent outputs before writing to shared memory. Required by OWASP ASI03/ASI07 and MAESTRO L7.

criticalC1Command InjectionMCP03-command-injectionAML.T0054

Pattern "`[^`]+`" matched in source_code: "`❌ ${message}`" (at position 2029)

Replace exec()/execSync() with execFile() and pass arguments as an array, never as a string. Validate all inputs against an allowlist before use in any shell context. For subprocess.run, always pass a list and shell=False.

criticalQ3Localhost MCP Service HijackingMCP07-insecure-configT1557

Pattern "cors\s*$\s*$(?!.*origin)" matched in source_code: "cors()" (at position 64253)

MCP servers binding to localhost must: (1) validate the Host header to prevent DNS rebinding attacks (CVE-2025-49596), (2) set strict CORS origins instead of wildcard '*', (3) require authentication tokens even for local connections, (4) use random high ports instead of predictable defaults. For stdio transport, validate all input at the JSON-RPC level before processing. Consider using Docker MCP Gateway or similar container isolation.

criticalQ9Agentic Workflow DAG ManipulationMCP05-privilege-escalationAML.T0058

MCP tools must NOT modify agentic workflow graphs, execution order, or routing during runtime. Workflow structure should be immutable once execution begins. If dynamic workflow modification is required, implement: (1) approval gates that require human confirmation before graph mutations, (2) integrity checks that validate the workflow graph against a known-good baseline after each step, (3) audit logging of all graph modifications with rollback capability. Reference: arXiv 2602.19555, Trend Micro subgraph impersonation attack (2026).

criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054

Pattern "["']@modelcontextprotocol/sdk["']\s*:\s*["'](?:\^|~|\*|latest)" matched in source_code: ""@modelcontextprotocol/sdk": "^" (at position 70012)

MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.

criticalK8Cross-Boundary Credential SharingMCP05-privilege-escalationAML.T0054

Pattern "(return|respond|output|result).*(?:token|credential|api[_\s-]?key|secret|password|bearer)" matched in source_code: "return apiKey || sessionKey || process.env.ARARA_API_KEY" (at position 1298)

Never forward, share, or embed credentials across trust boundaries. Use OAuth token exchange (RFC 8693) to create scoped, delegated tokens instead of passing original credentials. Never include credentials in tool responses. Required by ISO 27001 A.5.17 and OWASP ASI03.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L648 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L781 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L820 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L899 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L946 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L1013 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L1079 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L1131 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L1185 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L1226 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L1261 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L1309 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L1450 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L1468 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highC7Wildcard CORSMCP07-insecure-config

Pattern "cors\s*$\s*$" matched in source_code: "cors()" (at position 64253)

Replace wildcard CORS with an explicit allowlist of permitted origins. Wildcard CORS allows any website to make requests to the MCP server.

highD1Known CVEs in DependenciesMCP08-dependency-vuln

Dependency "@modelcontextprotocol/sdk@1.0.1" has known CVEs:

Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.

highD1Known CVEs in DependenciesMCP08-dependency-vuln

Dependency "axios@1.6.7" has known CVEs:

Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.

highD1Known CVEs in DependenciesMCP08-dependency-vuln

Dependency "express@4.18.2" has known CVEs:

Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.

highI15Transport Session SecurityMCP07-insecure-configAML.T0054

Pattern "(session[_\s-]?id|sessionId)\s*[:=]\s*["'][a-zA-Z0-9_-]{1,8}["']" matched in source_code: "sessionId = "default"" (at position 6944)

Use HTTPS for all MCP Streamable HTTP endpoints. Generate cryptographically random session IDs (min 128 bits entropy). Do not accept session IDs from user input (CVE-2025-6515). Validate TLS certificates — do not disable certificate verification.

highJ4Health Endpoint Information DisclosureMCP07-insecure-configAML.T0054

Remove detailed system information from health endpoints. Health checks should return only { status: 'ok' } with no system details. If monitoring data is needed, protect endpoints with authentication and restrict to internal networks. See CVE-2026-29787.

highK11Missing Server Integrity VerificationMCP10-supply-chainAML.T0054

Implement cryptographic verification for MCP server connections: (1) Pin server TLS certificates or public keys, (2) Verify server tool definition checksums against a known-good manifest, (3) Use package manager integrity checks (npm integrity, pip --require-hashes). The MCP spec recommends but doesn't yet mandate server signing — implement it proactively. Required by ISO 27001 A.8.24 and CoSAI MCP-T6.

highK13Unsanitized Tool OutputMCP02-tool-poisoningAML.T0054

Sanitize all external data before including in tool responses. Implement output encoding that neutralizes prompt injection patterns. Truncate excessively long content. Validate structure before passing database results. Apply the principle: treat all external data as untrusted, even in tool outputs. Required by CoSAI MCP-T4.

highK16Unbounded Recursion / Missing Depth LimitsMCP07-insecure-configAML.T0054

Pattern "function\s+(\w+).*\{[^}]*\1\s*\((?!.*(?:depth|level|limit|max|count|recursi))" matched in source_code: "function run() { const isSSE = process.env.MCP_TRANSPORT === "sse" || (process.env.PORT !== undefined && !process.argv.includes("--stdio")); if (isSSE) { const app = express(); app.use((req, _res, next) => { console.error(" (at position 63938)

Add explicit depth/recursion limits to all recursive operations. Use iterative approaches where possible. Set maximum depth for directory walking (max_depth=10), tree traversal (max_level=20), and agent re-invocation (max_calls=5). Implement circuit breakers that halt after N iterations. Required by EU AI Act Art. 15 (robustness) and OWASP ASI08.

highK18Cross-Trust-Boundary Data Flow in Tool ResponseMCP04-data-exfiltrationAML.T0054

Implement data flow taint tracking: tag data from sensitive sources (databases, credentials, files) and prevent it from flowing to external sinks (HTTP, webhooks, email) without explicit sanitization/redaction. Apply data classification and enforce boundary controls per trust level. Required by ISO 27001 A.5.14 and CoSAI MCP-T5.

highM7Tool Response Structure BombASI08-agentic-dosAML.T0054

Pattern "\.repeat\s*$\s*\d{3,}\s*$" matched in source_code: ".repeat(128)" (at position 66948)

Implement response size limits and nesting depth caps for all tool responses. Never construct responses with programmatic deep nesting or exponential expansion. CVE-2026-25048 demonstrated that nested structures can exhaust parser stacks in LLM pipelines. Set maximum response size (e.g., 100KB), maximum JSON nesting depth (e.g., 20 levels), and maximum array length. Use streaming for large responses rather than constructing them in memory.

highN1JSON-RPC Batch Request AbuseMCP07-insecure-configAML.T0054

Enforce a maximum batch size for JSON-RPC requests (recommended: 20-25 requests per batch). Reject batches exceeding the limit with a -32600 (Invalid Request) error. Implement per-batch timeout and memory limits. Reference: JSON-RPC 2.0 Section 6 (Batch) does not mandate limits — servers MUST enforce them.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L224 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highO6Server Fingerprinting via Error ResponsesMCP04-data-exfiltrationAML.T0057

Never expose process, OS, runtime, or database metadata in tool responses or error messages. Use generic error messages ("An error occurred") for production responses. Remove or disable debug/diagnostic endpoints. If health endpoints are needed, limit them to simple "ok"/"error" status without infrastructure details. Wrap all error handlers with a sanitization layer that strips system information.

highQ14Concurrent MCP Server Race ConditionMCP07-insecure-configT1068

MCP servers sharing filesystem or database backends with other servers must implement proper concurrency controls. Use: (1) file locking (flock/lockfile) for filesystem operations, (2) database transactions for all read-modify-write sequences, (3) atomic file operations (O_EXCL, mkdtemp) instead of check-then-create, (4) lstat() to detect symlinks before following (CVE-2025-53109). Never assume exclusive access to shared resources — other MCP servers may be operating concurrently.

highN10Incomplete Handshake Denial of ServiceMCP07-insecure-configAML.T0054

Pattern "(?:createServer|listen)\s*\((?!.*(?:maxConnections|maxClients|connectionLimit|MAX_CONN))" matched in source_code: "listen(" (at position 68967)

Enforce a handshake timeout (recommended: 30 seconds) — terminate connections that do not complete the initialize handshake within the deadline. Limit maximum concurrent pending connections. An attacker can exhaust server connection slots by initiating MCP connections without completing the handshake (Slowloris-style attack). Reference: MCP spec 2025-03-26 lifecycle — initialize MUST complete before functional requests.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L269 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L356 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L425 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L438 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L481 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

mediumK17Missing Timeout or Circuit BreakerMCP07-insecure-configAML.T0054

Pattern "(?:fetch|axios\.(?:get|post|put|delete))\s*$[^)]*$(?!.*(?:timeout|signal))" matched in source_code: "axios.post( `${ARARA_BASE}/v1/messages`, { receiver: to, body: text }, { headers: { Authorization: `Bearer ${activeKey}` } }, )" (at position 8846)

Add timeouts to ALL external calls: HTTP requests (30s), database queries (10s), subprocess execution (60s), and MCP tool calls (30s). Implement circuit breakers that open after N consecutive failures (e.g., opossum, cockatiel). Use AbortSignal for cancellable operations. Required by EU AI Act Art. 15 and OWASP ASI08.

lowF4MCP Spec Non-ComplianceMCP07-insecure-config

Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions

Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.

Tools

No tools exposed by this server.

Security Category Deep Dive

Sub-Category Tree · Remediation Roadmap · Attack Stories · Compliance Overlay · ATLAS Techniques · Maturity Model

⚡

Prompt Injection

Prompt & context manipulation attacks

Maturity

Rules

Sub-Categories

Gaps

64%

Implemented

Tests

Stories

PI-DIRDirect Input Injection

100%3 rules

Injection via tool descriptions and parameter fields

GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules

PI-INDIndirect / Gateway Injection

100%4 rules

Hidden instructions via external content and tool responses

PI-CTXContext Manipulation

100%2 rules

Context window saturation and prior-approval exploitation

PI-ENCEncoding & Obfuscation

100%3 rules

Payload hiding via invisible chars, base64, schema fields

PI-TPLTemplate & Output Poisoning

50%2 rules1 found

Injection via prompt templates and runtime tool output