io.github.meltingpixelsai/harvey-verify
Post-transaction outcome verification. LLM-as-judge for agent service quality.
0Tools
10Findings
Mar 24, 2026Last Scanned
3 critical · 5 high · 1 medium · 1 low findings detected
Security Category Deep Dive
Prompt Injection
Prompt & context manipulation attacks
69
Maturity
14
Rules
5
Sub-Categories
1
Gaps
64%
Implemented
56
Tests
1
Stories
100%3 rules
Injection via tool descriptions and parameter fields
GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules
100%4 rules
Hidden instructions via external content and tool responses
100%2 rules
Context window saturation and prior-approval exploitation
100%3 rules
Payload hiding via invisible chars, base64, schema fields
100%2 rules
Injection via prompt templates and runtime tool output
Findings10
3critical
5high
1medium
1low
Critical3
criticalC1Command InjectionMCP03-command-injectionAML.T0054
Pattern "`[^`]+`" matched in source_code: "`Error: ${err instanceof Error ? err.message : String(err)}`" (at position 808)
Replace exec()/execSync() with execFile() and pass arguments as an array, never as a string. Validate all inputs against an allowlist before use in any shell context. For subprocess.run, always pass a list and shell=False.
criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054
Pattern "["']@modelcontextprotocol/sdk["']\s*:\s*["'](?:\^|~|\*|latest)" matched in source_code: ""@modelcontextprotocol/sdk": "^" (at position 8499)
MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.
criticalQ3Localhost MCP Service HijackingMCP07-insecure-configT1557
Pattern "(?:express|fastify|koa|hono).*(?:listen|server)(?!.*(?:host[_\s]?(?:check|valid|verify)|helmet))" matched in source_code: "hono/node-server" (at position 79)
MCP servers binding to localhost must: (1) validate the Host header to prevent DNS rebinding attacks (CVE-2025-49596), (2) set strict CORS origins instead of wildcard '*', (3) require authentication tokens even for local connections, (4) use random high ports instead of predictable defaults. For stdio transport, validate all input at the JSON-RPC level before processing. Consider using Docker MCP Gateway or similar container isolation.
High5
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "@hono/node-server@1.19.5" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "@modelcontextprotocol/sdk@1.18.2" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
highK11Missing Server Integrity VerificationMCP10-supply-chainAML.T0054
Pattern "(?:mcp|server|tool)[_\s-]?(?:url|endpoint|address)\s*[:=].*(?:http|ws)(?!.*(?:verify|pin|cert|tls))" matched in source_code: "MCP endpoint: http" (at position 7165)
Implement cryptographic verification for MCP server connections: (1) Pin server TLS certificates or public keys, (2) Verify server tool definition checksums against a known-good manifest, (3) Use package manager integrity checks (npm integrity, pip --require-hashes). The MCP spec recommends but doesn't yet mandate server signing — implement it proactively. Required by ISO 27001 A.8.24 and CoSAI MCP-T6.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "hono@4.9.6" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
highO6Server Fingerprinting via Error ResponsesMCP04-data-exfiltrationAML.T0057
Pattern "(?:diagnostics?|debug|system_?info|server_?info|health_?detailed|status_?detail)\s*[:=]\s*\{[^}]*(?:version|os|arch|platform|uptime|memory|cpu|disk|hostname|pid)" matched in source_code: "serverInfo: { name: "harvey-verify", version" (at position 6271)
Never expose process, OS, runtime, or database metadata in tool responses or error messages. Use generic error messages ("An error occurred") for production responses. Remove or disable debug/diagnostic endpoints. If health endpoints are needed, limit them to simple "ok"/"error" status without infrastructure details. Wrap all error handlers with a sanitization layer that strips system information.
Medium1
mediumK17Missing Timeout or Circuit BreakerMCP07-insecure-configAML.T0054
Pattern "(?:query|execute|find|select|aggregate)\s*\((?!.*(?:timeout|maxTimeMS|statement_timeout|deadline|cancel))" matched in source_code: "query (" (at position 4694)
Add timeouts to ALL external calls: HTTP requests (30s), database queries (10s), subprocess execution (60s), and MCP tool calls (30s). Implement circuit breakers that open after N consecutive failures (e.g., opossum, cockatiel). Use AbortSignal for cancellable operations. Required by EU AI Act Art. 15 and OWASP ASI08.
Low1
lowF4MCP Spec Non-ComplianceMCP07-insecure-config
Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions
Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.