Request: pin MCP catalog versions, correct write-capable server tiers, sandbox MCP egress

Aperta
  • Qualcosa non va?
#686 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@HsienW ci sta già lavorando.

Dal 23/10/2026.

  • #782 di @HsienW — aperta

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
devtools, security

Direzione di ricerca

Start by locating MCP_CATALOG, buildDefaultMcpServers, and hookSettings, then trace how catalog entries are launched and scoped. The issue calls for reviewed exact version pins, accurate write-capability tiers, per-server consent, agent-level scoping, and a sandbox/proxy boundary with loopback denial or live egress checks. Done means the acceptance tests prove those requirements, including cold-start version resolution.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem. Munder's built-in MCP_CATALOG hardcodes unversioned npx -y <pkg> / uvx <pkg> specs that resolve to whatever is latest on npm/PyPI at every seat's cold start, running with the user's full identity outside the sandbox — a supply-chain risk (a compromised or typosquatted publish runs unsandboxed on every seat at its next start). The filesystem and git servers are both labelled safe-readonly with defaultEnabled: true, but server-filesystem has write/edit/move/create-directory tools and mcp-server-git has commit/add/reset/checkout/branch tools, both scoped to the agent's cwd — which for seats is the whole office tree — and both run outside Claude Code's sandbox entirely. Separately, an MCP stdio server is a child process Claude starts directly, not through Bash, so neither the sandbox's filesystem rules nor the egress-filtering proxy apply to it: the fetch server can reach arbitrary URLs unmediated and has no loopback block, so it can reach Munder's own loopback broker and hook ports (local server-side request forgery).

Proposed fix. Pin every catalog entry to an exact, reviewed version — no bare npx -y/uvx without a version at cold start. Correct the tier labels for server-filesystem and mcp-server-git to reflect their real write capability, and require explicit per-server consent rather than defaultEnabled: true. Scope both to the individual agent's own directory, not the whole office tree. Either run MCP servers inside the same sandbox/proxy boundary Bash-driven tools get (including an explicit loopback deny), or require live proof of egress-allowlist and loopback refusal before any network-capable server (fetch or future additions) is enabled by default.

Acceptance. A live test shows each catalog server resolves to its pinned exact version at cold start; filesystem/git servers carry their true tier label and require per-server consent, scoped per-agent; any network-capable server is proven refused outside its allowlist and refused on loopback before being enabled by default.

Supporting diagnosis with exact code citations (MCP_CATALOG, buildDefaultMcpServers, hookSettings) and exact internal evidence are available on request. Current state: no munder-* MCP tool has appeared live in any seat's session yet, so these risks are latent, not actively exploited today.

Lingua principale
TypeScript
Stelle
8.5k
Fork
1.2k
Merge medio
12h 50m
PR unite (30g)
63

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di HarnessMD/munder-difflin

Tutte le issue di HarnessMD/munder-difflin

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.