All issues

Search results

Security: Arbitrary Directory Upload (CWE-22) via unvalidated sourceDirectory in create-deployment

Status: Open.

#116 In InsForge/insforge-mcp;

· shunfeng8421 opened on Aug 19, 2026

Security: Arbitrary File Read (CWE-22) via unvalidated file paths in bulk-upsert / create-function / update-function

Status: Open.

#115 In InsForge/insforge-mcp;

· shunfeng8421 opened on Aug 19, 2026

24 orphaned deployments still serve /oauth/* on public hostnames — shipping the OAuth fixes retires none of them

Status: Open.

#111 In InsForge/insforge-mcp;

· tonychang04 opened on Aug 3, 2026

Unauthenticated /oauth/callback forwards the platform's internal error text in its JSON body

Status: Open.

#110 In InsForge/insforge-mcp;

· tonychang04 opened on Aug 1, 2026

Error-surface follow-ups from #103/#107: four defects, four different remedies

Status: Open.

#109 In InsForge/insforge-mcp;

· tonychang04 opened on Aug 1, 2026

npm latest (1.2.11) predates the Redis removal — the published package and the service are an architecture apart

Status: Open.

#108 In InsForge/insforge-mcp;

· tonychang04 opened on Aug 1, 2026

Unauthenticated stack-trace disclosure on /oauth/callback (live on the slug)

Status: Open.

#106 In InsForge/insforge-mcp;

· tonychang04 opened on Aug 1, 2026

get-anon-key and download-template disagree about the anon endpoint's shape, and both are on a deprecated route

Status: Open.

#105 In InsForge/insforge-mcp;

· tonychang04 opened on Aug 1, 2026

OAuth authorization codes are replayable within their 5-minute window

Status: Open.

#102 In InsForge/insforge-mcp;

· tonychang04 opened on Aug 1, 2026

npx @insforge/mcp@1.2.7 fails with "could not determine executable to run"

Status: Open.

#48 In InsForge/insforge-mcp;

· dcde22345 opened on Mar 28, 2026

[Bug]: create-function and update-function accept empty code files without validation

Status: Open.

#41 In InsForge/insforge-mcp;

· AbdulWasih05 opened on Mar 21, 2026

MCP Server In VS code

Status: Open.

#14 In InsForge/insforge-mcp;

· Abiji-2020 opened on Oct 21, 2025