@vncy/persona-mcp

Global Persona & Relationship Vault MCP server

vinceyisecurityTypeScript

GitHub npm

0Tools

5Findings

—Stars

—Downloads

Mar 24, 2026Last Scanned

Findings5

2critical

2high

0medium

1low

0informational

criticalC1Command InjectionMCP03-command-injectionAML.T0054

Pattern "`[^`]+`" matched in source_code: "`특정 인물의 전체 맥락(Context)을 하나의 통합 텍스트로 반환합니다. 동작: 1. profiles/{name}.md 의 정적 프로필을 읽어 핵심 정체성 및 지침 제공. 2. memory.db의 events 테이블에서 코사인 유사도 검색으로 해당 인물의 최근 관련 사건 최대 5건 추출. 3. relationships 테이블에서 해당 인물이 주체 또는 대상인 모든 관계를 조회. 호출 시점: - 사용자가 특정 인물을 언급하거나 "@me"로 본인을 참조할 때 반드시 호출. - 이미지 게임(Profiling Game)의 질문 설계 전 맥락 인출 단계에서 호출. 주의: - '@me'는 사용자 본인(profiles/me.md)을 의미하며 Instruction Sovereignty가 적용됨. - 프로필 파일이 없는 인물이라도 메모리와 관계망은 정상 반환.`" (at position 981)

Replace exec()/execSync() with execFile() and pass arguments as an array, never as a string. Validate all inputs against an allowlist before use in any shell context. For subprocess.run, always pass a list and shell=False.

criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054

Pattern "["']@modelcontextprotocol/sdk["']\s*:\s*["'](?:\^|~|\*|latest)" matched in source_code: ""@modelcontextprotocol/sdk": "^" (at position 6360)

MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.

highD1Known CVEs in DependenciesMCP08-dependency-vuln

Dependency "@modelcontextprotocol/sdk@1.0.0" has known CVEs:

Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.

highK11Missing Server Integrity VerificationMCP10-supply-chainAML.T0054

Implement cryptographic verification for MCP server connections: (1) Pin server TLS certificates or public keys, (2) Verify server tool definition checksums against a known-good manifest, (3) Use package manager integrity checks (npm integrity, pip --require-hashes). The MCP spec recommends but doesn't yet mandate server signing — implement it proactively. Required by ISO 27001 A.8.24 and CoSAI MCP-T6.

lowF4MCP Spec Non-ComplianceMCP07-insecure-config

Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions

Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.

Tools

No tools exposed by this server.

Security Category Deep Dive

Sub-Category Tree · Remediation Roadmap · Attack Stories · Compliance Overlay · ATLAS Techniques · Maturity Model

⚡

Prompt Injection

Prompt & context manipulation attacks

Maturity

Rules

Sub-Categories

Gaps

64%

Implemented

Tests

Stories

PI-DIRDirect Input Injection

100%3 rules

Injection via tool descriptions and parameter fields

GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules

PI-INDIndirect / Gateway Injection

100%4 rules

Hidden instructions via external content and tool responses

PI-CTXContext Manipulation

100%2 rules

Context window saturation and prior-approval exploitation

PI-ENCEncoding & Obfuscation

100%3 rules

Payload hiding via invisible chars, base64, schema fields

PI-TPLTemplate & Output Poisoning

100%2 rules

Injection via prompt templates and runtime tool output