experimental-mcp: SSE server exposes unauthenticated scan_vulnerable_dependencies tool with no path restrictions

[Tobsboy2]

Summary

The experimental-mcp SSE server starts with no authentication and accepts
arbitrary filesystem paths from any caller via the scan_vulnerable_dependencies
tool. The fileOpenedLogger returns absolute paths of every file scalibr opens
back to the MCP client verbatim.

Affected code

• cmd/osv-scanner/mcp/command.go:121 — DirectoryPaths: input.Paths
  (no path validation or allowlist)
• cmd/osv-scanner/mcp/stats.go:29 — filepath.Join(Root, Path)
  returned to caller in tool response
• cmd/osv-scanner/mcp/command.go:91 — SSE server starts with no
  auth middleware

Suggested fixes

1. Add token authentication to the SSE server
2. Restrict input.Paths to a declared workspace root using filepath.Rel
3. Exclude fileOpenedLogger output from the MCP tool response —
   it was likely intended for local debug output only

Notes

Reported to Google VRP — closed as below severity threshold with
permission to disclose publicly.