mcp-safeguard

mcp-safeguard · Rules

148 rules in v0.9.3.

This is a snapshot of the scanner's security://rules MCP resource, taken from the installed 0.9.3 package. The count changes between releases; the resource at runtime is the authoritative list. Regex patterns are omitted here and live in the scanner source.

Prompt injection

scan15 rules
IDTitleSeverityCVSS
PI-001Instruction Override AttemptCRITICAL9.3
PI-002Identity Hijacking PatternHIGH8.1
PI-003Fake System Message InjectionHIGH7.8
PI-004Constraint Bypass AttemptCRITICAL9.1
PI-005Hidden Instruction TagHIGH8.5
PI-006System Prompt ExfiltrationHIGH7.5
PI-007Deception InstructionMEDIUM5.5
PI-008Encoded Instruction ObfuscationMEDIUM5.8
PI-009Conditional Trigger InstructionMEDIUM5.2
PI-010Code Execution PromptHIGH8.0
PI-011Data Exfiltration InstructionCRITICAL9.5
PI-012Template Injection PatternMEDIUM5.0
PI-013Comment-Hidden InstructionMEDIUM4.8
PI-014Zero-Width Character SteganographyHIGH7.2
PI-015Forced Tool Call InstructionMEDIUM6.0

Schema risks

scan4 rules

Shape-of-schema checks that ride along with prompt injection.

IDTitleSeverity
PI-SCH-001Oversized Default Value (potential injection vector)MEDIUM
PI-SCH-002Unusually Long Parameter DescriptionLOW
PI-SCH-003Oversized Enum DefinitionLOW
PI-SCH-004Non-standard Schema ExtensionINFO

Credential leaks

scan31 rules
IDTitleSeverityCVSS
CRED-001Hardcoded API KeyCRITICAL9.8
CRED-002Hardcoded API Key AssignmentCRITICAL9.5
CRED-003Hardcoded PasswordCRITICAL9.8
CRED-004Hardcoded Secret KeyHIGH8.5
CRED-005Exposed JWT TokenHIGH8.8
CRED-006Exposed Bearer TokenHIGH8.5
CRED-007AWS Access Key IDCRITICAL9.9
CRED-008AWS Secret Access KeyCRITICAL9.9
CRED-009GitHub Personal Access TokenHIGH8.5
CRED-010GitLab Personal Access TokenHIGH8.5
CRED-011Database Connection String with CredentialsCRITICAL9.5
CRED-012Private Key MaterialCRITICAL10.0
CRED-013Hardcoded Access TokenHIGH8.0
CRED-014Slack API TokenHIGH8.5
CRED-015Stripe API KeyCRITICAL9.8
CRED-016OpenAI API KeyCRITICAL9.5
CRED-017Anthropic API KeyCRITICAL9.5
CRED-026Hugging Face API TokenHIGH8.0
CRED-027Replicate API TokenHIGH8.5
CRED-028Cohere API KeyHIGH8.0
CRED-018Stripe Credential in EnvironmentHIGH8.5
CRED-019OpenAI Credential in EnvironmentHIGH8.5
CRED-020Anthropic Credential in EnvironmentHIGH8.5
CRED-021Twilio Credential in EnvironmentHIGH7.5
CRED-022SendGrid Credential in EnvironmentHIGH7.5
CRED-023Slack Credential in EnvironmentHIGH7.5
CRED-024GitHub Credential in EnvironmentHIGH8.0
CRED-025AWS Credential in EnvironmentHIGH9.5
CRED-026Hugging Face Credential in EnvironmentHIGH8.0
CRED-027Replicate Credential in EnvironmentHIGH8.5
CRED-028Cohere Credential in EnvironmentHIGH8.0

Tool poisoning

scan11 rules
IDTitleSeverityCVSS
TP-001Hidden Side-Effect in Benign ToolHIGH8.0
TP-002Covert Operation DescriptorHIGH8.5
TP-003Instruction to Suppress LoggingCRITICAL9.0
TP-004Explicitly Covert Tool ActionCRITICAL9.5
TP-005Silent Data Exfiltration DescriptorCRITICAL9.8
TP-006Deceptive Tool DescriptionHIGH8.8
TP-007Forced Tool Chain TriggerMEDIUM6.0
TP-008User Awareness SuppressionCRITICAL9.5
TP-009Hidden Instruction Tag in Tool DescriptionCRITICAL9.0
TP-010Instruction to Conceal Action from UserHIGH8.0
TP-011Read Sensitive File Then Pass As ArgumentCRITICAL9.5

SSRF

scan3 rules

Severity is assigned per finding at scan time.

IDTitle
SS-001Unconstrained URL parameter with no allowlist/blocklist
SS-002Redirect-following URL fetch with no revalidation
SS-003Missing scheme restriction on a URL-fetching tool

OAuth scope risk

scan7 rules
IDTitleSeverityCVSS
OAUTH-001Wildcard or Admin OAuth ScopeCRITICAL9.0
OAUTH-002Write-Scoped OAuth (check if read-only suffices)MEDIUM4.5
OAUTH-003Delete-Scoped OAuth TokenHIGH7.5
OAUTH-004Offline Access Scope (persistent token risk)MEDIUM5.0
OAUTH-005Sudo/Impersonation OAuth ScopeCRITICAL9.5
OAUTH-006PII-Exposing OAuth ScopeLOW3.0
OAUTH-007Full Repository OAuth ScopeMEDIUM5.5

Sensitive endpoints

scan29 rules

Probed on a live host via check_endpoint_exposure or scan_mcp_server.

IDPath · titleSeverity
EP-001/admin Exposed Admin PanelHIGH
EP-001/admin/ Exposed Admin PanelHIGH
EP-001/_admin Exposed Admin PanelHIGH
EP-002/debug Exposed Debug EndpointHIGH
EP-002/debug/ Exposed Debug EndpointHIGH
EP-002/__debug__ Exposed Debug EndpointHIGH
EP-003/health Health Endpoint (check response content)INFO
EP-003/healthz Health EndpointINFO
EP-003/ready Readiness EndpointINFO
EP-004/metrics Prometheus Metrics Exposed PubliclyMEDIUM
EP-004/_metrics Prometheus Metrics ExposedMEDIUM
EP-005/docs API Documentation ExposedLOW
EP-005/swagger Swagger UI ExposedLOW
EP-005/swagger-ui Swagger UI ExposedLOW
EP-005/redoc ReDoc Documentation ExposedLOW
EP-006/openapi.json OpenAPI Schema ExposedMEDIUM
EP-007/config Configuration Endpoint ExposedHIGH
EP-008/.env Environment File ExposedCRITICAL
EP-007/env Environment Endpoint ExposedHIGH
EP-009/mcp MCP Endpoint (verify auth required)INFO
EP-010/sse SSE Endpoint (verify auth)MEDIUM
EP-010/ws WebSocket Endpoint (verify auth)MEDIUM
EP-011/actuator Spring Actuator ExposedHIGH
EP-011/actuator/env Spring Actuator Env ExposedCRITICAL
EP-011/actuator/heapdump Spring Actuator Heap DumpCRITICAL
EP-012/version Version DisclosureLOW
EP-012/_version Version DisclosureLOW
EP-013/trace Trace Endpoint ExposedHIGH
EP-013/pprof Go pprof Profiler ExposedHIGH

Dangerous ports

scan12 rules
IDPort · serviceSeverity
EP-PORT-00122 SSHMEDIUM
EP-PORT-00223 TelnetHIGH
EP-PORT-0032375 Docker API (unauthenticated)CRITICAL
EP-PORT-0042376 Docker API (TLS)HIGH
EP-PORT-0054040 Ngrok Inspection UIMEDIUM
EP-PORT-0065000 Development ServerMEDIUM
EP-PORT-0075432 PostgreSQLHIGH
EP-PORT-0086379 Redis (commonly unauthenticated)HIGH
EP-PORT-0098080 HTTP Alt / Dev ServerLOW
EP-PORT-0108443 HTTPS AltLOW
EP-PORT-0119200 ElasticsearchCRITICAL
EP-PORT-01227017 MongoDBHIGH

Source audit

scan-source36 rules

Severity and CVSS are assigned per finding at scan time. Rule doc comments in source_scanner.py name the confirmed finding each was derived from.

IDTitle
SRC-001Auth header re-applied in transport without redirect guard
SRC-002httpx client follows redirects while carrying a bearer token
SRC-003SQL read-only enforced by string prefix check only
SRC-004Credential attached to a caller-influenced destination host
SRC-005Auth flag parsed and warned about, never enforced before serving
SRC-006Client-supplied resource ID keys shared state with no ownership check
SRC-007Read-only/destructive classifier recognizes syntax, not calls
SRC-008Client-supplied ownership field trusted on create/update
SRC-009Unescaped interpolation into a shell command
SRC-010Credential file written without permission hardening
SRC-011SSRF guard validates once; fetch call re-resolves DNS separately
SRC-012Manifest entry silently dropped with only debug-level logging
SRC-013TLS certificate verification disabled
SRC-014OAuth redirect_uri used in a redirect with no allowlist check
SRC-015Inbound Authorization header re-forwarded to an outbound request
SRC-016Write-capability flag gates tool listing, not tool execution
SRC-017Header value used as authorization identity with no authentication check
SRC-018Path traversal: joined path used with no containment check
SRC-019Unescaped interpolation into a shell command (broad check)
SRC-020Unencoded value interpolated into a URL query string
SRC-021Network listener starts with no authentication mechanism anywhere in the file
SRC-022SQL/query injection via unescaped string interpolation
SRC-023Outbound fetch of a caller-derived URL with no SSRF validation call in the file
SRC-024Resource ID used as a read/approval lookup key with no ownership check (BOLA)
SRC-025Unescaped request parameter interpolated into HTML response (reflected XSS)
SRC-026Loopback-bound server has no Origin-header check (DNS rebinding / cross-site WebSocket hijacking)
SRC-027OAuth scope taken from request with no role check before token issuance
SRC-028Full upstream response/exception body logged with no redaction
SRC-029Live runtime-obtained access token/secret written to disk in plaintext
SRC-030CORS wildcard or disabled dev-server host check exposes sensitive endpoints
SRC-031Credential passed as a URL query parameter on a GET request
SRC-032Session id from a client header reused with no ownership check (session hijacking)
SRC-033Caller-controlled simulate/dry-run flag is the sole gate before a signing/broadcast call
SRC-034State-changing FastAPI/Flask route with no authentication dependency anywhere in the file
SRC-035Secret-shaped constant falls back to a hardcoded non-empty string when its env var is unset
SRC-036MCP SDK's DNS-rebinding protection explicitly disabled