René's URL Explorer Experiment

Title: JS: Add models for the MCP server SDKs and flow summaries for zod by Alex-Hofer · Pull Request #22749 · github/codeql · GitHub

Open Graph Title: JS: Add models for the MCP server SDKs and flow summaries for zod by Alex-Hofer · Pull Request #22749 · github/codeql

X Title: JS: Add models for the MCP server SDKs and flow summaries for zod by Alex-Hofer · Pull Request #22749 · github/codeql

Description: Follow-up to #22702; #22703 proposes the same for Python. MCP servers expose tools to LLM agents. Every argument of a tool, resource or prompt callback is chosen by the client, that is by a model that prompt injection can steer, or by anyone who can reach the server over HTTP. This PR models that input for the TypeScript SDKs as data extensions in javascript/ql/lib/ext: the callback arguments and the low-level requests as sources of the opt-in ai threat model (#22810), the request headers and the bearer token as sources of the remote threat model. First commit, the MCP SDKs: @modelcontextprotocol/sdk 1.x and @modelcontextprotocol/server 2.x, McpServer: the arguments of the callbacks of tool, registerTool, prompt and registerPrompt, and the URI and template variables of resource and registerResource. The low-level Server: request.params in handlers of setRequestHandler, also when the server is reached through McpServer.server, and the parameters of custom methods in 2.x. The request headers and the bearer token that the SDK hands to a callback: extra.requestInfo.headers and extra.authInfo.token in 1.x, ctx.http.req.headers.get() and ctx.http.authInfo.token in 2.x. fastmcp: addTool({execute}), addResourceTemplate({load}), addPrompt({load}). typeModel rows for the import paths with and without .js and for a server that arrives as a typed parameter. Second commit, flow summaries for zod (independent of the first, can be split off): handlers of the low-level server get the raw arguments and validate them with a zod schema before use (Schema.parse(request.params.arguments)). There is no model of zod, so the flow ends at that call. Four rows let data flow from the argument of parse, safeParse, parseAsync and safeParseAsync to the result. I used kind value: js/path-injection does not follow a taint summary there (it is a data-flow configuration with flow states) and does follow a value one; I checked both on a small server. Tests: library-tests/threat-models/sources gets mcp.ts, fastmcp.ts and zod.ts with inline expectations (threat-source, hasFlow); callbacks that are not registered with a server and a static resource have none. codeql test run passes locally with CLI 2.27.1. Evidence: as a model pack, these rows take CodeQL 2.27.1 from 6 to 25 of 38 real, publicly disclosed vulnerabilities in TypeScript and JavaScript MCP servers in mcp-vulnbench. On the half of the cases that the models were not run on while they were written, plain CodeQL finds 3 of 21, the rows of the first commit 11, and both commits together 14 (the zod rows were measured with kind taint), at 2.62 instead of 0.08 alarms per KLOC. Known limits are documented there: servers kept in a field of a project class, handler tables built across modules, and sinks such as fetch from undici or Playwright's page.goto. The measurement used the rows as remote, which is on by default; with ai the same sources apply once that threat model is enabled.

Open Graph Description: Follow-up to #22702; #22703 proposes the same for Python. MCP servers expose tools to LLM agents. Every argument of a tool, resource or prompt callback is chosen by the client, that is by a model t...

X Description: Follow-up to #22702; #22703 proposes the same for Python. MCP servers expose tools to LLM agents. Every argument of a tool, resource or prompt callback is chosen by the client, that is by a model t...

Opengraph URL: https://github.com/github/codeql/pull/22749

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width