server-everything

All 5 findings

1. high
   Tool `get-env` exposes secrets or credentials to the agent· get-envsecret exposure

   `get-env` appears to read or return secrets, API keys, credentials, or environment variables (Returns all environment variables, helpful for debugging MCP server configuration). Values surfaced in the model context are visible to any prompt with injection access; a compromised agent can relay them to an attacker-controlled server.

   fix: Do not expose secrets to the agent: inject them server-side at call time rather than passing them through the model context. If a tool must return a credential, scope it with a capframe-bind time-limited caveat and log every issuance.

2. high
   Tool `toggle-subscriber-updates` name implies a side effect that is not declared· toggle-subscriber-updatesexcessive agency

   `toggle-subscriber-updates` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

   fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

3. medium
   Tool `echo` accepts unconstrained string input· echounconstrained input

   The following string parameter(s) have no `maxLength` constraint: `message`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

4. medium
   Tool `gzip-file-as-resource` accepts unconstrained string input· gzip-file-as-resourceunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `data`, `name`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

5. medium
   Tool `simulate-research-query` accepts unconstrained string input· simulate-research-queryunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `topic`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.