OpenAI Docs MCP

All 8 findings

1. high
   Tool `fetch_openai_doc` accepts an unconstrained URL / endpoint parameter· fetch_openai_docssrf surface

   The parameter(s) `url` look like URL or endpoint inputs but carry no `pattern` or `enum` constraint. An agent tricked by an indirect-injection payload can invoke this tool with an internal-service URL (e.g. `http://169.254.169.254/`) to exfiltrate cloud metadata, probe internal APIs, or pivot to services the host can reach but the caller cannot.

   fix: Constrain the URL parameter with an allow-list `enum`, or a `pattern` that restricts scheme and domain. Validate server-side against an allow-list and reject private / loopback / link-local address ranges at the HTTP client level.

2. high
   Tool `get_openapi_spec` accepts an unconstrained URL / endpoint parameter· get_openapi_specssrf surface

   The parameter(s) `url` look like URL or endpoint inputs but carry no `pattern` or `enum` constraint. An agent tricked by an indirect-injection payload can invoke this tool with an internal-service URL (e.g. `http://169.254.169.254/`) to exfiltrate cloud metadata, probe internal APIs, or pivot to services the host can reach but the caller cannot.

   fix: Constrain the URL parameter with an allow-list `enum`, or a `pattern` that restricts scheme and domain. Validate server-side against an allow-list and reject private / loopback / link-local address ranges at the HTTP client level.

3. medium
   Tool `search_openai_docs` accepts unconstrained string input· search_openai_docsunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `cursor`, `query`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

4. medium
   Tool `list_openai_docs` accepts unconstrained string input· list_openai_docsunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `cursor`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

5. medium
   Tool `list_openai_docs` fetches external web content -- indirect-injection surface· list_openai_docsindirect injection

   Description: "List or browse pages from `platform.openai.com`, `developers.openai.com`, and `learn.chatgpt.com` that this server crawls (useful when you don’t know the right query yet or you’re paging through results). Use this whenever you are working with the OpenAI API (including the Responses API), OpenAI API SDKs, ChatGPT Apps SDK, or Codex. Results include URLs—**after `list`, use `fetch_openai_doc`** on a result URL to get the full markdown." -- this tool pulls externally-controlled content into the agent's context window, the canonical indirect-injection vector. Even when the user supplies the URL, content at that URL can carry hostile instructions.

   fix: Sandbox the fetched content: strip prompts before forwarding to the model, constrain to an allow-list of domains, and route through capframe-guard with a `domain in [...]` caveat.

6. medium
   Tool `fetch_openai_doc` accepts unconstrained string input· fetch_openai_docunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `anchor`, `url`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

7. medium
   Tool `fetch_openai_doc` fetches external web content -- indirect-injection surface· fetch_openai_docindirect injection

   Description: "Fetch the markdown for a specific doc page from `developers.openai.com`, `platform.openai.com`, or `learn.chatgpt.com` so you can quote or summarize exact, up-to-date guidance (schemas, examples, limits, and edge cases). Prefer to **`search_openai_docs` first** (or `list_openai_docs` if you’re browsing) to find the best URL, then `fetch_openai_doc` to pull the exact text; you can pass `anchor` (for example, `#streaming`) to fetch just that section." -- this tool pulls externally-controlled content into the agent's context window, the canonical indirect-injection vector. Even when the user supplies the URL, content at that URL can carry hostile instructions.

   fix: Sandbox the fetched content: strip prompts before forwarding to the model, constrain to an allow-list of domains, and route through capframe-guard with a `domain in [...]` caveat.

8. medium
   Tool `get_openapi_spec` accepts unconstrained string input· get_openapi_specunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `url`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.