OpenZeppelin Stellar Contracts MCP
https://mcp.openzeppelin.com/contracts/stellar/mcp
Severity breakdown
Worst finding
Tool `stellar-non-fungible` accepts an unconstrained URL / endpoint parameter
· stellar-non-fungible
The parameter(s) `tokenUri` look like URL or endpoint inputs but carry no `pattern` or `enum` constraint. An agent tricked by an indirect-injection payload can invoke this tool with an internal-service URL (e.g. `http://169.254.169.254/`) to exfiltrate cloud metadata, probe internal APIs, or pivot to services the host can reach but the caller cannot.
fix: Constrain the URL parameter with an allow-list `enum`, or a `pattern` that restricts scheme and domain. Validate server-side against an allow-list and reject private / loopback / link-local address ranges at the HTTP client level.
All 1 finding
- highTool `stellar-non-fungible` accepts an unconstrained URL / endpoint parameter· stellar-non-fungiblessrf surface
The parameter(s) `tokenUri` look like URL or endpoint inputs but carry no `pattern` or `enum` constraint. An agent tricked by an indirect-injection payload can invoke this tool with an internal-service URL (e.g. `http://169.254.169.254/`) to exfiltrate cloud metadata, probe internal APIs, or pivot to services the host can reach but the caller cannot.
fix: Constrain the URL parameter with an allow-list `enum`, or a `pattern` that restricts scheme and domain. Validate server-side against an allow-list and reject private / loopback / link-local address ranges at the HTTP client level.
Reproduce this
Every finding above comes from a public, deterministic rule engine — no LLM in the decision path, same input always the same output. You can run it against this server yourself and get byte-identical results:
curl -fsSL capframe.ai/install | sh capframe find ./your-mcp-config.json --out findings.json
Five-step quickstart if you want the whole Find → Bind → Guard loop. If you'd rather have someone read your real tool definitions rather than the advertised surface — including the ones this public scan can't reach — that's the Agent Security Audit.
How this was scored
Source http — live HTTP MCP endpoint, classified against every rule. Findings are emitted by the public capframe.findings.v1 schema. Score = 100 − (10·Critical + 4·High + 2·Medium + 1·Low), clamped to [0, 100].
Disagree with a finding? Open an issue.