From 3af7376b950a369c249c087d08165d6fd220edd2 Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Wed, 7 Oct 2026 18:57:10 -0400 Subject: [PATCH 1/3] Remove retired and superseded MCP servers Signed-off-by: Dan Barr <6922515+danbarr@users.noreply.github.com> --- Taskfile.yml | 4 +- npx/browserbase-mcp-server/SECURITY.md | 124 ------------------------- npx/browserbase-mcp-server/spec.yaml | 51 ---------- npx/magic-mcp/spec.yaml | 24 ----- npx/mcp-jetbrains/spec.yaml | 33 ------- npx/onchain-mcp/spec.yaml | 37 -------- uvx/aws-diagram/spec.yaml | 37 -------- uvx/ida-pro-mcp/spec.yaml | 28 ------ uvx/pagerduty-mcp/spec.yaml | 33 ------- 9 files changed, 2 insertions(+), 369 deletions(-) delete mode 100644 npx/browserbase-mcp-server/SECURITY.md delete mode 100644 npx/browserbase-mcp-server/spec.yaml delete mode 100644 npx/magic-mcp/spec.yaml delete mode 100644 npx/mcp-jetbrains/spec.yaml delete mode 100644 npx/onchain-mcp/spec.yaml delete mode 100644 uvx/aws-diagram/spec.yaml delete mode 100644 uvx/ida-pro-mcp/spec.yaml delete mode 100644 uvx/pagerduty-mcp/spec.yaml diff --git a/Taskfile.yml b/Taskfile.yml index c266719f..4c799370 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -7,7 +7,7 @@ tasks: Run Cisco AI Defense mcp-scanner on a specific MCP server configuration. Usage: - task scan -- npx/browserbase-mcp-server + task scan -- npx/playwright-mcp task scan -- uvx/blender-mcp task scan -- npx/sentry-mcp-server @@ -136,7 +136,7 @@ tasks: echo " scan-help - Show this help" echo "" echo "Examples:" - echo " task scan -- npx/browserbase-mcp-server" + echo " task scan -- npx/playwright-mcp" echo " task scan -- uvx/blender-mcp" echo " task scan-all" echo " task scan-setup" diff --git a/npx/browserbase-mcp-server/SECURITY.md b/npx/browserbase-mcp-server/SECURITY.md deleted file mode 100644 index 3436be3f..00000000 --- a/npx/browserbase-mcp-server/SECURITY.md +++ /dev/null @@ -1,124 +0,0 @@ -# Security Analysis: browserbase-mcp-server MCP Server - -## Overview -The browserbase-mcp-server package has been flagged with two security issues by mcp-scan: -- **TF001**: Data leak toxic flow detected -- **TF002**: Destructive toxic flow detected - -## Analysis Results: ⚠️ BOTH ISSUES ARE VALID - -### TF001: Data Leak Toxic Flow - VALID CONCERN - -**Issue**: The same agent has access to tools that produce untrusted content, access private data, and behave as public sinks. - -**Root Cause Analysis**: - -1. **Untrusted Content Sources** (7 tools): - - `multi_browserbase_stagehand_extract_session()` - Extracts data from web pages (potentially untrusted) - - `browserbase_session_close()` - Session management with external data - - `browserbase_stagehand_navigate()` - Navigates to external URLs - - `browserbase_stagehand_act()` - Performs actions on web pages - - `browserbase_stagehand_extract()` - Extracts content from web pages - - `browserbase_stagehand_observe()` - Observes web page elements - - `browserbase_screenshot()` - Captures screenshots of web content - -2. **Private Data Access** (4 tools): - - `multi_browserbase_stagehand_extract_session()` - Can access sensitive page content - - `browserbase_stagehand_navigate()` - Can access private/authenticated pages - - `browserbase_stagehand_extract()` - Can extract private data from pages - - `browserbase_screenshot()` - Can capture sensitive visual information - -3. **Public Sink Capabilities** (4 tools): - - `browserbase_session_create()` - Creates external browser sessions - - `browserbase_session_close()` - Communicates with external Browserbase service - - `browserbase_screenshot()` - Can save/transmit screenshots - - `browserbase_stagehand_act()` - Can perform actions that send data externally - -**Attack Vector**: -An attacker could use the browser automation tools to navigate to sensitive pages, extract private data, and exfiltrate it through the Browserbase cloud service or screenshot functionality. - -### TF002: Destructive Toxic Flow - VALID CONCERN - -**Issue**: The same agent has access to tools that produce untrusted content and tools that can behave destructively. - -**Root Cause Analysis**: - -1. **Untrusted Content** (same 7 tools as above) - -2. **Destructive Capabilities** (5 tools): - - `multi_browserbase_stagehand_observe_session()` - Can manipulate session state - - `browserbase_session_close()` - Can terminate browser sessions - - `browserbase_stagehand_extract()` - Can modify page state during extraction - - `browserbase_stagehand_observe()` - Can interfere with page functionality - - `browserbase_stagehand_act()` - **CRITICAL**: Can perform destructive actions like: - - Form submissions with malicious data - - Clicking destructive buttons (delete, purchase, etc.) - - Modifying form fields with harmful content - - Triggering unwanted transactions - -**Attack Vector**: -Malicious content from untrusted web sources could trigger destructive browser actions, leading to unintended form submissions, data modifications, or financial transactions. - -## Risk Assessment - -### High Risk Components -1. **`browserbase_stagehand_act()`** - Can perform arbitrary web actions -2. **Browser automation with external content** - Untrusted web data sources -3. **Cloud browser sessions** - Data transmitted to external Browserbase service -4. **Screenshot capabilities** - Potential for sensitive data capture - -### Legitimate Use Cases -- Web scraping and data extraction workflows -- Automated testing of web applications -- Browser-based task automation -- AI-assisted web navigation and interaction - -## Security Allowlist - -The following security issues have been explicitly allowed in the package configuration: - -```yaml -security: - allowed_issues: - - code: "TF001" - reason: "Data leak risk acceptable - tool designed for web automation workflows where external content interaction is essential. Users should be aware of potential data exposure through cloud browser service." - - code: "TF002" - reason: "Destructive flow risk acceptable - browserbase_stagehand_act tool is core functionality for web automation. Users should only use with trusted prompts and on non-production systems." -``` - -## Security Best Practices for Users - -### ⚠️ IMPORTANT WARNINGS - -1. **Use in isolated environments** (sandboxed browsers, test accounts) -2. **Only use with trusted prompts** and verified automation scripts -3. **Avoid sensitive or production systems** when using automation features -4. **Monitor browser actions** and review automation results -5. **Be cautious with form submissions** and destructive actions -6. **Limit access to sensitive websites** during automation -7. **Review extracted data** before processing or storing - -### Recommended Usage Patterns - -✅ **SAFE**: -- Using for public website scraping and data extraction -- Automated testing on development/staging environments -- Educational and learning purposes with test sites -- Web automation with non-sensitive, public content - -❌ **RISKY**: -- Automating actions on production systems -- Using with financial or sensitive personal accounts -- Running automation on confidential or proprietary websites -- Using with untrusted or malicious automation prompts -- Performing destructive actions without human oversight - -## Conclusion - -Both TF001 and TF002 are **legitimate security concerns** that accurately identify real risks in the browserbase-mcp-server package. The risks have been accepted because: - -1. **Core Functionality**: Browser automation requires the ability to interact with external web content -2. **Web Automation Workflows**: External content interaction is fundamental to the tool's purpose -3. **User Awareness**: Users can make informed decisions about acceptable risk levels - -**Users should understand these risks and take appropriate precautions when using this MCP server, especially avoiding use with sensitive accounts or production systems.** \ No newline at end of file diff --git a/npx/browserbase-mcp-server/spec.yaml b/npx/browserbase-mcp-server/spec.yaml deleted file mode 100644 index 98712c06..00000000 --- a/npx/browserbase-mcp-server/spec.yaml +++ /dev/null @@ -1,51 +0,0 @@ -# Browserbase MCP Server Configuration -# Cloud browser automation capabilities using Browserbase and Stagehand -# Package: https://www.npmjs.com/package/@browserbasehq/mcp -# Repository: https://github.com/browserbase/mcp-server-browserbase -# Will build as: ghcr.io/stacklok/dockyard/npx/browserbase-mcp-server:2.0.0 - -metadata: - name: browserbase-mcp-server - description: "MCP server for cloud browser automation with Browserbase and Stagehand" - protocol: npx - -spec: - package: "@browserbasehq/mcp" - version: "3.0.0" - overrides: - - package: "undici" - version: "6.29.0" - reason: | - undici 5.29.0 arrives via @browserbasehq/stagehand -> - @ai-sdk/amazon-bedrock -> @ai-sdk/provider-utils, which caps it at - ^5.29.0. The 5.x line is end of life, so the fixes for - GHSA-vrm6-8vpv-qv8q and GHSA-v9p9-hfj2-hcw8 (both 6.24.0), - GHSA-vxpw-j846-p89q (6.27.0) and GHSA-rfgv-xxqx-mfg5 (6.28.1) only exist - in 6.x. 6.29.0 is the newest 6.x release and no advisory affects it, so - it clears all of them without stepping into the 7.x advisories. - Cross-major force, but @ai-sdk/provider-utils 5.x upstream has itself - moved to undici ^7.28.0, so this consumer tracks well past 6.x. - -provenance: - repository_uri: "https://github.com/browserbase/mcp-server-browserbase" - repository_ref: "refs/heads/main" - -security: - # Mock env vars allow security scanning without real credentials - mock_env: - - name: BROWSERBASE_API_KEY - value: "mock-browserbase-api-key-for-scanning" - description: "Browserbase API key - mock value for security scanning" - - name: BROWSERBASE_PROJECT_ID - value: "mock-browserbase-project-id-for-scanning" - description: "Browserbase project ID - mock value for security scanning" - - name: GEMINI_API_KEY - value: "mock-gemini-api-key-for-scanning" - description: "Gemini API key used by Stagehand - mock value for security scanning" - allowed_issues: - - code: "AITech-8.2" - reason: "Data leak risk acceptable - tool designed for web automation workflows where external content interaction is essential. Users should be aware of potential data exposure through cloud browser service." - - code: "AITech-9.1" - reason: "Destructive flow risk acceptable - act tool is core functionality for web automation. Users should only use with trusted prompts and on non-production systems." - - code: "AITech-1.1" - reason: "Possible false positive on instructional text in tool descriptions. The act, observe and extract tools legitimately take natural-language instructions for autonomous web tasks, which is core functionality, not prompt injection." diff --git a/npx/magic-mcp/spec.yaml b/npx/magic-mcp/spec.yaml deleted file mode 100644 index fee5bd3c..00000000 --- a/npx/magic-mcp/spec.yaml +++ /dev/null @@ -1,24 +0,0 @@ -# Magic MCP Server Configuration -# AI-powered UI component generator MCP server by 21st.dev -# Package: https://www.npmjs.com/package/@21st-dev/magic -# Repository: https://github.com/21st-dev/magic-mcp -# Will build as: ghcr.io/stacklok/dockyard/npx/magic-mcp:0.1.0 - -metadata: - name: magic-mcp - description: "AI-powered UI component generator MCP server by 21st.dev" - protocol: npx - -spec: - package: "@21st-dev/magic" - version: "0.2.3" - -provenance: - repository_uri: "https://github.com/21st-dev/magic-mcp" - repository_ref: "refs/heads/main" - -# Security allowlist for known acceptable issues -security: - # Server requires API_KEY (21st.dev Magic) to start - cannot be scanned in CI - insecure_ignore: true - allowed_issues: [] diff --git a/npx/mcp-jetbrains/spec.yaml b/npx/mcp-jetbrains/spec.yaml deleted file mode 100644 index a267c443..00000000 --- a/npx/mcp-jetbrains/spec.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# JetBrains MCP Proxy Server Configuration -# A MCP proxy to redirect requests to JetBrains IDEs -# Package: https://www.npmjs.com/package/@jetbrains/mcp-proxy -# Repository: https://github.com/JetBrains/mcp-jetbrains -# Will build as: ghcr.io/stacklok/dockyard/npx/mcp-jetbrains:1.8.0 - -metadata: - name: mcp-jetbrains - description: "A MCP proxy to redirect requests to JetBrains IDEs" - protocol: npx - -spec: - package: "@jetbrains/mcp-proxy" - version: "1.8.0" - overrides: - - package: "@modelcontextprotocol/sdk" - version: "1.26.0" - reason: | - @jetbrains/mcp-proxy exact-pins @modelcontextprotocol/sdk 1.7.0, which - carries GHSA-w48q-cv73-mx4w (DNS rebinding, fixed 1.24.0) and - GHSA-8r9q-7v3j-jr4g (ReDoS, fixed 1.25.2). 1.26.0 rather than 1.25.2 - because GHSA-345p-7cg4-v4c7 affects >=1.10.0,<=1.25.3, which the pinned - 1.7.0 predates, so a smaller bump would trade two advisories for a third. - Same-major, and the proxy still starts and serves its tool list. - -provenance: - repository_uri: "https://github.com/JetBrains/mcp-jetbrains" - repository_ref: "refs/heads/main" - -# Security configuration -security: - # Server is a proxy that requires a running JetBrains IDE to connect to - cannot be scanned in CI - insecure_ignore: true diff --git a/npx/onchain-mcp/spec.yaml b/npx/onchain-mcp/spec.yaml deleted file mode 100644 index 50e55ad9..00000000 --- a/npx/onchain-mcp/spec.yaml +++ /dev/null @@ -1,37 +0,0 @@ -# Onchain MCP Server Configuration -# MCP server for blockchain data interaction through the Bankless API -# Package: https://www.npmjs.com/package/@bankless/onchain-mcp -# Repository: https://github.com/Bankless/onchain-mcp -# Will build as: ghcr.io/stacklok/dockyard/npx/onchain-mcp:1.0.6 - -metadata: - name: onchain-mcp - description: "MCP server for blockchain data interaction through the Bankless API" - protocol: npx - -spec: - package: "@bankless/onchain-mcp" - version: "1.0.6" - overrides: - - package: "@modelcontextprotocol/sdk" - version: "1.26.0" - reason: | - @bankless/onchain-mcp exact-pins @modelcontextprotocol/sdk 1.7.0, which carries - GHSA-8r9q-7v3j-jr4g (ReDoS, fixed 1.25.2) and GHSA-w48q-cv73-mx4w (DNS rebinding, - fixed 1.24.0). 1.26.0 rather than 1.25.2 because GHSA-345p-7cg4-v4c7 affects - >=1.10.0,<=1.25.3, so a smaller bump would trade two advisories for a third. - Same-major, and the server's 10 tools still enumerate correctly. - -provenance: - repository_uri: "https://github.com/Bankless/onchain-mcp" - repository_ref: "refs/heads/main" - -# Optional: Security allowlist -# No security issues currently flagged by scanner -security: - # Mock env vars allow security scanning without real credentials - mock_env: - - name: BANKLESS_API_TOKEN - value: "mock-bankless-api-token-for-scanning" - description: "Bankless API token - mock value for security scanning" - allowed_issues: [] diff --git a/uvx/aws-diagram/spec.yaml b/uvx/aws-diagram/spec.yaml deleted file mode 100644 index 5a0b3f38..00000000 --- a/uvx/aws-diagram/spec.yaml +++ /dev/null @@ -1,37 +0,0 @@ -# AWS Diagram MCP Server Configuration -# Official AWS Labs MCP server for creating AWS architecture diagrams -# Package: https://pypi.org/project/awslabs.aws-diagram-mcp-server/ -# Repository: https://github.com/awslabs/mcp/tree/main/src/aws-diagram-mcp-server -# Will build as: ghcr.io/stacklok/dockyard/uvx/aws-diagram-mcp-server:1.0.5 - -metadata: - name: aws-diagram - description: "Generate AWS diagrams, sequence diagrams, flow diagrams, and class diagrams using Python code" - protocol: uvx # Uses Python with uv package manager - -spec: - package: "awslabs.aws-diagram-mcp-server" # PyPI package name - version: "1.0.23" # Latest version from PyPI - -provenance: - # Expected source repository (used for attestation verification) - repository_uri: "https://github.com/awslabs/mcp" - repository_ref: "refs/heads/main" # Using main branch as specific tags are not available for this package - - # Attestation information (PEP 740) - # Verified with: dockhand verify-provenance -c uvx/aws-diagram/spec.yaml - attestations: - available: true - verified: true # Cryptographic verification via sigstore-go - publisher: - kind: "GitHub" - repository: "awslabs/mcp" - workflow: ".github/workflows/publish.yml" - -security: - # Security allowlist for known issues that are acceptable in this context - allowed_issues: - - code: "AITech-1.1" - reason: "Tool description contains imperative instructions for AI agents which are necessary for proper operation" - - code: "AITech-12.1" - reason: "Tool executes Python code to generate diagrams - this is core functionality, not tool poisoning. Code execution is isolated by container sandboxing" diff --git a/uvx/ida-pro-mcp/spec.yaml b/uvx/ida-pro-mcp/spec.yaml deleted file mode 100644 index ab5eee86..00000000 --- a/uvx/ida-pro-mcp/spec.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# IDA Pro MCP Server Configuration -# MCP server for IDA Pro reverse engineering and analysis -# Package: https://pypi.org/project/ida-pro-mcp/ -# Repository: https://github.com/mrexodia/ida-pro-mcp -# Will build as: ghcr.io/stacklok/dockyard/uvx/ida-pro-mcp:1.4.0 - -metadata: - name: ida-pro-mcp - description: "MCP server for IDA Pro reverse engineering and analysis" - protocol: uvx - -spec: - package: "ida-pro-mcp" - version: "1.4.0" - -provenance: - repository_uri: "https://github.com/mrexodia/ida-pro-mcp" - repository_ref: "refs/heads/main" - -# Security allowlist for false positives -security: - allowed_issues: - - code: "AITech-9.1" - reason: "Code execution and injection patterns are expected for a reverse engineering tool that disassembles and renames functions in IDA Pro" - - code: "AITech-12.1" - reason: "Tool poisoning patterns are false positives - modifying function prototypes, variable types, stack frames, and reading memory/data are core reverse engineering operations in IDA Pro" - - code: "AITech-8.2" - reason: "Data exfiltration patterns are false positives - reading strings and binary data from IDA databases is the fundamental purpose of this reverse engineering tool" diff --git a/uvx/pagerduty-mcp/spec.yaml b/uvx/pagerduty-mcp/spec.yaml deleted file mode 100644 index 387a84a4..00000000 --- a/uvx/pagerduty-mcp/spec.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# PagerDuty MCP Server Configuration -# Official MCP server for PagerDuty integration -# Package: https://pypi.org/project/pagerduty-mcp/ -# Repository: https://github.com/PagerDuty/pagerduty-mcp-server -# Will build as: ghcr.io/stacklok/dockyard/uvx/pagerduty - -metadata: - name: pagerduty - description: "MCP server that integrates with PagerDuty to manage incidents, services, schedules, event orchestrations, and more" - protocol: uvx - -spec: - package: "pagerduty-mcp" - version: "1.1.0" - -provenance: - repository_uri: "https://github.com/PagerDuty/pagerduty-mcp-server" - repository_ref: "refs/heads/main" # Using main branch as the primary development branch - -security: - # Mock env vars allow security scanning without real credentials. pagerduty-mcp - # v1 creates the PagerDuty client eagerly at startup and raises RuntimeError - # without an API key, which previously prevented the scanner from connecting - # to the server at all. - mock_env: - - name: PAGERDUTY_USER_API_KEY - value: "mock-pagerduty-api-key-for-scanning" - description: "PagerDuty API key — mock value for security scanning" - allowed_issues: - - code: "AITech-8.2" - reason: "Data leak risk acceptable - incident management requires sharing operational data with responders and creating public status updates. Write operations are disabled by default, requiring explicit opt-in with --enable-write-tools flag." - - code: "AITech-9.1" - reason: "False positive - YARA rule triggers on 'change event' terminology in tool names (list_change_events, get_change_event, list_service_change_events, list_incident_change_events). These are read-only API calls to retrieve PagerDuty change events for incident correlation, not code execution capabilities. LLM analyzer confirms SAFE." From 136f3ca29408aefe2d14bdda89c514aa3d26f7fa Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Wed, 7 Oct 2026 19:08:21 -0400 Subject: [PATCH 2/3] Correct Octocode packaging provenance Signed-off-by: Dan Barr <6922515+danbarr@users.noreply.github.com> --- npx/octocode-mcp/spec.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/npx/octocode-mcp/spec.yaml b/npx/octocode-mcp/spec.yaml index 7f114fd1..d60e2762 100644 --- a/npx/octocode-mcp/spec.yaml +++ b/npx/octocode-mcp/spec.yaml @@ -2,8 +2,8 @@ # Octocode MCP Server Configuration # MCP server for advanced GitHub repository analysis and code discovery # Package: https://www.npmjs.com/package/octocode-mcp -# Repository: https://github.com/bgauryy/octocode-mcp -# Will build as: ghcr.io/stacklok/dockyard/npx/octocode-mcp:12.0.0 +# Repository: https://github.com/bgauryy/octocode +# Will build as: ghcr.io/stacklok/dockyard/npx/octocode-mcp:19.1.0 metadata: name: octocode-mcp @@ -28,9 +28,9 @@ spec: GHSA-f38q-mgvj-vph7, GHSA-jfj6-75fj-8934, GHSA-j3f2-48v5-ccww), fixed in 8.6.6+. provenance: - # Monorepo with multiple packages; npm versions don't match git tags - repository_uri: "https://github.com/bgauryy/octocode-mcp" - repository_ref: "refs/heads/main" + # Published octocode-mcp@19.1.0 npm gitHead; monorepo versions do not match git tags + repository_uri: "https://github.com/bgauryy/octocode" + repository_ref: "24ada10033de01215be62f53cd9293fbf36ca72a" security: allowed_issues: From d348de23de2e3e867f1f149e980266d9c8b9eba5 Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Wed, 7 Oct 2026 19:23:50 -0400 Subject: [PATCH 3/3] Remove redundant Octocode dependency overrides Signed-off-by: Dan Barr <6922515+danbarr@users.noreply.github.com> --- npx/octocode-mcp/spec.yaml | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/npx/octocode-mcp/spec.yaml b/npx/octocode-mcp/spec.yaml index d60e2762..041d2733 100644 --- a/npx/octocode-mcp/spec.yaml +++ b/npx/octocode-mcp/spec.yaml @@ -13,19 +13,6 @@ metadata: spec: package: "octocode-mcp" version: "19.1.0" - overrides: - - package: "minimatch" - version: "10.2.6" - reason: | - octocode-engine pulls bash-language-server -> editorconfig -> minimatch@10.0.1, - vulnerable to ReDoS (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, - GHSA-23c5-xmqv-rm74), fixed in 10.2.3+. - - package: "protobufjs" - version: "8.7.1" - reason: | - octocode-engine pulls intelephense -> protobufjs@8.3.0, vulnerable to - DoS/prototype-pollution issues (GHSA-94rc-8x27-4472, GHSA-wcpc-wj8m-hjx6, - GHSA-f38q-mgvj-vph7, GHSA-jfj6-75fj-8934, GHSA-j3f2-48v5-ccww), fixed in 8.6.6+. provenance: # Published octocode-mcp@19.1.0 npm gitHead; monorepo versions do not match git tags