ref-tools-mcp
Helping coding agents never make mistakes working with public or private libraries without wasting the context window.
0Tools
21Findings
1.0kStars
Mar 19, 2026Last Scanned
8 critical · 11 high · 1 medium · 1 low findings detected
Security Category Deep Dive
Prompt Injection
Prompt & context manipulation attacks
69
Maturity
14
Rules
5
Sub-Categories
1
Gaps
64%
Implemented
56
Tests
1
Stories
100%3 rules
Injection via tool descriptions and parameter fields
GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules
100%4 rules
Hidden instructions via external content and tool responses
100%2 rules
Context window saturation and prior-approval exploitation
100%3 rules
Payload hiding via invisible chars, base64, schema fields
100%2 rules
Injection via prompt templates and runtime tool output
Findings21
8critical
11high
1medium
1low
Critical8
criticalC1Command InjectionMCP03-command-injectionAML.T0054
Pattern "`[^`]+`" matched in source_code: "`Search for documentation on the web or github as well from private resources like repos and pdfs. Use Ref '${toolConfig.readToolName}' to read the content of a url.`" (at position 2087)
Replace exec()/execSync() with execFile() and pass arguments as an array, never as a string. Validate all inputs against an allowlist before use in any shell context. For subprocess.run, always pass a list and shell=False.
criticalJ7OpenAPI Specification Field InjectionMCP03-command-injectionAML.T0054
Pattern "(?:summary|operationId|description).*\$\{|`.*(?:summary|operationId)" matched in source_code: "description: `Search for documentation on the web or github as well from private resources like repos and pdfs. Use Ref '${" (at position 2074)
Sanitize all OpenAPI specification fields before using them in code generation or template interpolation. Treat summary, description, operationId, and extension fields as untrusted input. Use parameterized templates instead of string interpolation. See CVE-2026-22785/23947.
criticalK14Agent Credential Propagation via Shared StateMCP05-privilege-escalationAML.T0054
Pattern "(process\.env|os\.environ|setenv|putenv).*(?:token|credential|api[_\s-]?key|secret|password)" matched in source_code: "process.env.REF_ALPHA || process.env.REF_API_KEY || currentApiKey" (at position 6644)
Never write credentials to shared agent state. Use credential vaults (HashiCorp Vault, AWS Secrets Manager) with per-agent scoped access. Implement OAuth token exchange (RFC 8693) for cross-agent authorization. Redact credentials from all agent outputs before writing to shared memory. Required by OWASP ASI03/ASI07 and MAESTRO L7.
criticalK8Cross-Boundary Credential SharingMCP05-privilege-escalationAML.T0054
Pattern "(return|respond|output|result).*(?:token|credential|api[_\s-]?key|secret|password|bearer)" matched in source_code: "return process.env.REF_ALPHA || process.env.REF_API_KEY || currentApiKey" (at position 6637)
Never forward, share, or embed credentials across trust boundaries. Use OAuth token exchange (RFC 8693) to create scoped, delegated tokens instead of passing original credentials. Never include credentials in tool responses. Required by ISO 27001 A.5.17 and OWASP ASI03.
criticalL7Transitive MCP Server DelegationMCP06-excessive-permissionsAML.T0054
Pattern "(?:new\s+Client|createClient|MCPClient|StdioClientTransport|SSEClientTransport|StreamableHTTPClientTransport).*(?:server|handler|tool)" matched in source_code: "mcpClient === 'openai-mcp' ? OPENAI_DEEP_RESEARCH_TOOL_CONFIG : DEFAULT_TOOL" (at position 1919)
MCP servers MUST NOT create client connections to other MCP servers without explicit user disclosure. If delegation is required, declare all downstream servers in the server's capabilities and tool descriptions. Never forward user credentials to sub-servers. Implement a trust boundary between the approved server and any delegated servers. Log all transitive delegations for audit.
criticalN15JSON-RPC Method Name ConfusionMCP05-privilege-escalationAML.T0054
Pattern "(?:method|action)\s*[:=]\s*(?:(?:req|params|body|message|data)\s*\.\s*method)(?!.*(?:allowedMethods|ALLOWED_METHODS|whitelist|allowlist|switch\s*\(|includes\(|has\())" matched in source_code: "method: req.method" (at position 12696)
Validate all JSON-RPC method names against an explicit allowlist. Do not use dynamic dispatch (obj[method]()) for method routing — an attacker can invoke internal methods not intended for external access. Separate tool invocation (tools/call) from protocol methods (initialize, ping). Validate that tools/call only dispatches to registered tool names. Reference: JSON-RPC 2.0 Section 4.1, CWE-749 (Exposed Dangerous Method).
criticalQ1Dual-Protocol Schema Constraint LossMCP06-excessive-permissionsAML.T0054
Pattern "(openai|function[_\s-]?calling|tool[_\s-]?choice).{0,60}(mcp|model[_\s-]?context)" matched in source_code: "openai-mcp" (at position 1934)
Dual-protocol MCP servers must validate input constraints server-side, not rely on client-side schema enforcement. When translating MCP schemas to OpenAI function-calling format, constraints like `pattern`, `minLength`, `maxLength`, and `format` are silently dropped. Implement server-side Zod/AJV validation on all tool inputs regardless of the calling protocol.
criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054
Pattern "npx\s+(?:mcp-remote|mcp-proxy|mcp-gateway|@modelcontextprotocol)(?!@\d)" matched in source_code: "npx @modelcontextprotocol" (at position 18026)
MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.
High11
highI15Transport Session SecurityMCP07-insecure-configAML.T0054
Pattern "session[_\s-]?(token|key|id)\s*[:=]\s*(req\.|params\.|query\.|body\.)" matched in source_code: "sessionId = req." (at position 12342)
Use HTTPS for all MCP Streamable HTTP endpoints. Generate cryptographically random session IDs (min 128 bits entropy). Do not accept session IDs from user input (CVE-2025-6515). Validate TLS certificates — do not disable certificate verification.
highK1Absent Structured LoggingMCP09-logging-monitoringAML.T0054
Pattern "console\.(log|warn|error)\s*\(.*(?:tool|request|handler|execute|invoke)" matched in source_code: "console.error('[search_documentation] arguments', request" (at position 5822)
Implement structured logging (pino, winston, or equivalent) for all tool call handlers. Every tool invocation should log: timestamp, tool name, caller identity, parameters (sanitized), result status, and duration. Required by ISO 27001 A.8.15, CoSAI MCP-T12, and NIST AI RMF MEASURE 2.6.
highQ14Concurrent MCP Server Race ConditionMCP07-insecure-configT1068
Pattern "(?:fs\.(?:readFile|writeFile|unlink|rename|chmod))(?!.*(?:lock|atomic|exclusive))" matched in source_code: "fs.chmod" (at position 17659)
MCP servers sharing filesystem or database backends with other servers must implement proper concurrency controls. Use: (1) file locking (flock/lockfile) for filesystem operations, (2) database transactions for all read-modify-write sequences, (3) atomic file operations (O_EXCL, mkdtemp) instead of check-then-create, (4) lstat() to detect symlinks before following (CVE-2025-53109). Never assume exclusive access to shared resources — other MCP servers may be operating concurrently.
highK16Unbounded Recursion / Missing Depth LimitsMCP07-insecure-configAML.T0054
Pattern "(invoke|call|execute)[_\s-]?(?:tool|agent|self)(?!.*(?:depth|level|limit|max[_\s-]?(?:depth|recursi|iter|call)|count))" matched in source_code: "CallTool" (at position 441)
Add explicit depth/recursion limits to all recursive operations. Use iterative approaches where possible. Set maximum depth for directory walking (max_depth=10), tree traversal (max_level=20), and agent re-invocation (max_calls=5). Implement circuit breakers that halt after N iterations. Required by EU AI Act Art. 15 (robustness) and OWASP ASI08.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "esbuild@0.24.0" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
highN10Incomplete Handshake Denial of ServiceMCP07-insecure-configAML.T0054
Pattern "(?:createServer|listen)\s*\((?!.*(?:maxConnections|maxClients|connectionLimit|MAX_CONN))" matched in source_code: "createServer(" (at position 10960)
Enforce a handshake timeout (recommended: 30 seconds) — terminate connections that do not complete the initialize handshake within the deadline. Limit maximum concurrent pending connections. An attacker can exhaust server connection slots by initiating MCP connections without completing the handshake (Slowloris-style attack). Reference: MCP spec 2025-03-26 lifecycle — initialize MUST complete before functional requests.
highK18Cross-Trust-Boundary Data Flow in Tool ResponseMCP04-data-exfiltrationAML.T0054
Pattern "(?:process\.env|os\.environ|config|settings).*(?:fetch|axios|http|post|send|webhook)" matched in source_code: "process.env.TRANSPORT || 'stdio') as 'stdio' | 'http" (at position 1164)
Implement data flow taint tracking: tag data from sensitive sources (databases, credentials, files) and prevent it from flowing to external sinks (HTTP, webhooks, email) without explicit sanitization/redaction. Apply data classification and enforce boundary controls per trust level. Required by ISO 27001 A.5.14 and CoSAI MCP-T5.
highC3Server-Side Request Forgery (SSRF)MCP04-data-exfiltrationAML.T0057
Pattern "\baxios\.(?:get|post|put|delete|patch|head|options|request)\s*\(\s*(?:req|request|input|param|params|args|url|uri|href|link|target|destination|endpoint|host|address|resource|src|source|proxy)" matched in source_code: "axios.get(url" (at position 7940)
Validate ALL user-supplied URLs before making HTTP requests:
1. Parse the URL and check the hostname against an explicit allowlist of permitted domains.
2. Block requests to RFC 1918 private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
3. Block loopback (127.0.0.0/8), link-local (169.254.0.0/16), and IPv6 equivalents.
4. Block file:// and other non-http(s) protocols explicitly.
5. Disable automatic redirect following, or re-validate each redirect destination.
6. In cloud environments: block requests to IMDS endpoints (169.254.169.254,
metadata.google.internal) at both the application AND network layer.
Example (Node.js): Use the `ssrf-req-filter` package or implement URL validation
against an allowlist before calling fetch/axios/got.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "@modelcontextprotocol/inspector@0.16.1" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "@modelcontextprotocol/sdk@1.0.3" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "axios@1.8.4" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
Medium1
mediumK17Missing Timeout or Circuit BreakerMCP07-insecure-configAML.T0054
Pattern "(?:fetch|axios|got|request|urllib|httpx|http\.get|http\.post)\s*\((?!.*(?:timeout|signal|AbortSignal|deadline|cancel))" matched in source_code: "Request(" (at position 13709)
Add timeouts to ALL external calls: HTTP requests (30s), database queries (10s), subprocess execution (60s), and MCP tool calls (30s). Implement circuit breakers that open after N consecutive failures (e.g., opossum, cockatiel). Use AbortSignal for cancellable operations. Required by EU AI Act Art. 15 and OWASP ASI08.
Low1
lowF4MCP Spec Non-ComplianceMCP07-insecure-config
Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions
Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.