Resolve
Provides structured error recovery playbooks for AI agents across 20+ services.
0Tools
8Findings
0Stars
Mar 22, 2026Last Scanned
3 critical · 4 high · 1 low findings detected
Security Category Deep Dive
Prompt Injection
Prompt & context manipulation attacks
69
Maturity
14
Rules
5
Sub-Categories
1
Gaps
64%
Implemented
56
Tests
1
Stories
100%3 rules
Injection via tool descriptions and parameter fields
GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules
100%4 rules
Hidden instructions via external content and tool responses
100%2 rules
Context window saturation and prior-approval exploitation
100%3 rules
Payload hiding via invisible chars, base64, schema fields
100%2 rules
Injection via prompt templates and runtime tool output
Findings8
3critical
4high
1low
Critical3
criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054
Pattern "(?:mcp|fastmcp|langchain-mcp|llama-index-mcp)(?:>=|~=|==)?(?!\d)" matched in source_code: "MCP" (at position 40)
MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.
criticalK8Cross-Boundary Credential SharingMCP05-privilege-escalationAML.T0054
Pattern "(return|respond|output|result).*(?:token|credential|api[_\s-]?key|secret|password|bearer)" matched in source_code: "return os.environ.get("RESOLVE_API_KEY" (at position 551)
Never forward, share, or embed credentials across trust boundaries. Use OAuth token exchange (RFC 8693) to create scoped, delegated tokens instead of passing original credentials. Never include credentials in tool responses. Required by ISO 27001 A.5.17 and OWASP ASI03.
criticalK14Agent Credential Propagation via Shared StateMCP05-privilege-escalationAML.T0054
Pattern "(process\.env|os\.environ|setenv|putenv).*(?:token|credential|api[_\s-]?key|secret|password)" matched in source_code: "os.environ.get("RESOLVE_API_KEY" (at position 558)
Never write credentials to shared agent state. Use credential vaults (HashiCorp Vault, AWS Secrets Manager) with per-agent scoped access. Implement OAuth token exchange (RFC 8693) for cross-agent authorization. Redact credentials from all agent outputs before writing to shared memory. Required by OWASP ASI03/ASI07 and MAESTRO L7.
High4
highO8Timing-Based Covert ChannelMCP04-data-exfiltrationAML.T0057
Pattern "(?:delay|sleep|timeout|interval)\s*[:=]\s*(?:[^;]*(?:secret|token|password|credential|key|env))" matched in source_code: "timeout=10,
)
if resp.status_code == 200:
return json.dumps(resp.json(), indent=2)
try:
body = resp.json()
hint = body.get("hint", "")
error = body.get("error", resp.text)
msg = f"Resolve API error {resp.status_code}: {error}"
if hint:
msg += f" -- {hint}"
return msg
except Exception:
return f"Resolve API error {resp.status_code}: {resp.text}"
except httpx.TimeoutException:
return "Resolve API error: request timed out after 10 seconds"
except httpx.RequestError as exc:
return f"Resolve API error: network error -- {exc}"
@mcp.tool()
def list_services() -> str:
"""List all services that have resolution data in Resolve.
Call this before resolve_error if you are unsure whether a service is
covered. Returns a list of service name strings (e.g. "openai",
"stripe", "postgres") and a count. No API key required.
Use the exact service name string from this list when calling
resolve_error -- the API is case-insensitive but exact spelling matters.
"""
try:
resp = httpx.get(f"{BASE_URL}/services", timeout=10)
if resp.status_code == 200:
return json.dumps(resp.json(), indent=2)
return f"Resolve API error {resp.status_code}: {resp.text}"
except httpx.TimeoutException:
return "Resolve API error: request timed out after 10 seconds"
except httpx.RequestError as exc:
return f"Resolve API error: network error -- {exc}"
@mcp.tool()
def submit_feedback(
resolution_id: str,
helpful: bool,
agent_id: str = "",
) -> str:
"""Report whether a resolution from resolve_error was helpful.
Submit this after attempting to recover using a resolution. Feedback
improves resolution quality over time -- unhelpful reports flag
resolutions for review so guidance can be tightened.
Requires RESOLVE_API_KEY environment variable.
Args:
resolution_id: The "id" field from a prior resolve_error response
(UUID format). Required.
helpful: True if following the resolution allowed the agent to
recover successfully. False if it did not help.
agent_id: Your agent identifier (used for analytics). Optional.
"""
if not _api_key():
return (
"RESOLVE_API_KEY not set. Call get_free_key with your email "
"to get a free API key (500 requests/month), then set "
"RESOLVE_API_KEY in your environment."
)
payload: dict = {"resolution_id": resolution_id, "helpful": helpful}
if agent_id:
payload["agent_id"] = agent_id
try:
resp = httpx.post(
f"{BASE_URL}/resolve/feedback",
json=payload,
headers=_auth_headers(),
timeout=10,
)
if resp.status_code == 200:
return json.dumps(resp.json(), indent=2)
try:
body = resp.json()
error = body.get("error", resp.text)
return f"Resolve API error {resp.status_code}: {error}"
except Exception:
return f"Resolve API error {resp.status_code}: {resp.text}"
except httpx.TimeoutException:
return "Resolve API error: request timed out after 10 seconds"
except httpx.RequestError as exc:
return f"Resolve API error: network error -- {exc}"
@mcp.tool()
def get_free_key(email: str) -> str:
"""Get a free Resolve API key (500 requests/month).
Call this once to provision a free API key. After receiving the key,
set it as RESOLVE_API_KEY in your environment so resolve_error and
submit_feedback can authenticate.
Args:
email: Email address to associate with the key. Used for usage
notifications only.
"""
try:
resp = httpx.post(
f"{BASE_URL}/billing/free-key",
json={"email": email},
headers={"Accept": "application/json"},
timeout=10,
)
if resp.status_code == 200:
data = resp.json()
key = data.get("api_key", "")
return (
f"Your free API key: {key}\n\n"
f"Set it in your environment:\n"
f" export RESOLVE_API_KEY={key}\n\n"
f"Free tier: 500 requests/month. "
f"Upgrade at https://resolve.arflow.io for higher limits."
)
try:
body = resp.json()
error = body.get("error", resp.text)
return f"Could not provision key: {error}"
except Exception:
return f"Could not provision key" (at position 2962)
Remove all code that calculates sleep/delay durations from application data, secrets, or any variable-length content. Tool response times should be constant or determined only by legitimate processing time. If rate limiting is needed, use fixed intervals not derived from data values. Monitor for anomalous response time patterns that could indicate timing-based exfiltration.
highK15Multi-Agent Collusion PreconditionsMCP05-privilege-escalationAML.T0054
Pattern "(agent|delegate).*(?:send|receive|message|communicate)(?!.*(?:log|audit|trace|record|monitor))" matched in source_code: "agent receive" (at position 952)
Implement collusion-resistant multi-agent architecture: (1) Verify agent identity cryptographically before accepting commands, (2) Apply ACLs to shared write surfaces, (3) Rate-limit cross-agent invocations, (4) Audit all inter-agent communication with timestamps and agent IDs, (5) Baseline normal interaction patterns for anomaly detection. Required by MAESTRO L7 and CoSAI MCP-T9.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "mcp@null" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
highC3Server-Side Request Forgery (SSRF)MCP04-data-exfiltrationAML.T0057
Pattern "\bhttpx\.(?:get|post|put|delete|patch|head|options|request|AsyncClient|Client)\s*\([^)]*(?:req|request|input|param|params|args|url|uri|href|link|target|destination|endpoint|host|address|resource|src|source)" matched in source_code: "httpx.post(
f"{BASE_URL" (at position 2840)
Validate ALL user-supplied URLs before making HTTP requests:
1. Parse the URL and check the hostname against an explicit allowlist of permitted domains.
2. Block requests to RFC 1918 private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
3. Block loopback (127.0.0.0/8), link-local (169.254.0.0/16), and IPv6 equivalents.
4. Block file:// and other non-http(s) protocols explicitly.
5. Disable automatic redirect following, or re-validate each redirect destination.
6. In cloud environments: block requests to IMDS endpoints (169.254.169.254,
metadata.google.internal) at both the application AND network layer.
Example (Node.js): Use the `ssrf-req-filter` package or implement URL validation
against an allowlist before calling fetch/axios/got.
Low1
lowF4MCP Spec Non-ComplianceMCP07-insecure-config
Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions
Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.