Port unsafe-command-allowlist risk flag from mcp-audit - #15
Merged
Conversation
Detects MCP command allowlists (e.g. ALLOW_COMMANDS) that name a binary with its own argument-level execution primitive, where checking argv[0] alone does not restrict execution (git -c alias, find -exec, python -c). Ported from the merged mcp-audit detection. - New data module allowlist_bypass_binaries.py (16 binaries, token-based key matching that excludes denylists and full-argv allowlists) - Wired into McpAuditDetector._identify_risks - risk_definitions entry (critical) + OWASP LLM06 mapping - Classified CONFIRMED in verdicts (a declared, re-checkable config fact) - 11 tests incl. denylist/toggle/full-argv negative cases 396 tests pass, ruff + mypy clean.
|
After this PR merges: 38 total AI surfaces, 42 total risk indicators · 2 high, 1 medium. 🤖 AI Surface ChangesNo AI surface changes in this PR. Powered by ai-surface. Useful? Star the repo so more engineers find it. Validate which of these surfaces are exploitable: apisec.ai/products. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the
unsafe-command-allowlistdetection (merged into mcp-audit in apisec-inc/mcp-audit#11) into ai-surface so it ships to users on the active tool.What it detects
MCP command allowlists (e.g.
ALLOW_COMMANDS) whose value names a binary with its own argument-level execution primitive. Checking argv[0] alone does not restrict execution when the allowlisted binary can be told to run arbitrary commands:git -c alias.x=!cmd,find -exec,python -c,tar --checkpoint-action=exec, and shells/env/xargs/ssh.Changes
data/mcp/allowlist_bypass_binaries.py— 16 argument-injection-prone binaries with per-binary reasons, plus token-based allowlist-key matching that correctly excludes denylists (DISALLOW_COMMANDS), unrelated toggles (ALLOW_COMMAND_LOGGING), and full-argv allowlists (ALLOW_COMMANDS="git status").McpAuditDetector._identify_risks.risk_definitionsentry (critical severity) + OWASP LLM06 Excessive Agency mapping.verdicts.py— the presence of a bypassable binary under an allowlist key is a declared, re-checkable fact of the config as written (same class asshell-access/broad-permissions).Verification
ALLOW_COMMANDS=git,ls,catflagsunsafe-command-allowlist(critical, LLM06, verdict CONFIRMED); a cleanALLOW_COMMANDS=ls,cat,echodoes not flag.Credit: original detection by @hackwither in apisec-inc/mcp-audit#11.