OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}Validate OAuth scopes on every endpoint. Check that the token has required permissions.
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: anthropics/claude-code-action@v1
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
req = _find_request(request_id)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
- @app.tool(model=True) for tools accessible from both model and UI
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("search", {"query": "Bluesky", "limit": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
def take_screenshot() -> Image:
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.
async with db.execute("SELECT * FROM tools WHERE enabled = 1") as cursor:Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.
Backslash-based directory traversal patterns targeting Windows file systems.
print(result[0].text[:500] + "...\n")
Normalize path separators and apply traversal checks for both forward and backslashes.
Detected catch blocks with empty bodies. Empty catch blocks silently swallow errors, making it impossible to diagnose failures, detect attacks, or audit security-relevant events.
.catch(function() {})Always handle or log errors in catch blocks. At minimum, log the error for debugging and auditing purposes.
Dynamic imports with variable URLs can load malicious code at runtime.
# avoid a circular import (client.client -> mixins.tools -> client.client),
Use static imports only. Do not dynamically import modules from variable paths.
String literals matching known API key prefixes (sk-, ghp_, AKIA, xoxb-, etc.) or long base64-like strings may expose secrets in source code.
"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR4"
Remove hardcoded secrets from source code. Use environment variables or a secrets manager.
An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.
s.listen(1)
Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.
Tool names mimicking built-in system tools (e.g., 'bash', 'shell', 'terminal') can trick the LLM into routing actions to a malicious handler.
discovery_tools=[Search(name="execute")],
Rename the tool to avoid colliding with system commands (bash, shell, exec, etc.).
Python's exec() function executes arbitrary code strings and is a vector for code injection.
exec(wrapped, namespace, namespace)
Remove exec() calls. Use ast.literal_eval for safe expression evaluation.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
claude-oauth-token:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
description: "Claude Code OAuth token for authentication"
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
claude_code_oauth_token: ${{ inputs.claude-oauth-token }}Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""OAuth client example for connecting to FastMCP servers.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to connect to an OAuth-protected FastMCP server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth = OAuth(additional_client_metadata={"token_endpoint_auth_method": "none"})Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""OAuth client example for connecting to FastMCP servers.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to connect to an OAuth-protected FastMCP server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(SERVER_URL, auth="oauth") as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""AWS Cognito OAuth server example for FastMCP.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.server.dependencies import get_access_token
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
mcp = FastMCP("AWS Cognito OAuth Example Server", auth=auth)Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
token = get_access_token()
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""OAuth client example for connecting to FastMCP servers.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to connect to an OAuth-protected FastMCP server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(SERVER_URL, auth="oauth") as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""OAuth client example for connecting to a Clerk-protected FastMCP server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to connect to an OAuth-protected FastMCP server
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(SERVER_URL, auth="oauth") as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Discord OAuth client example for connecting to FastMCP servers.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to connect to a Discord OAuth-protected FastMCP server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(SERVER_URL, auth="oauth") as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Discord OAuth server example for FastMCP.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to protect a FastMCP server with Discord OAuth.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
- FASTMCP_SERVER_AUTH_DISCORD_CLIENT_ID: Your Discord OAuth app client ID
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
- FASTMCP_SERVER_AUTH_DISCORD_CLIENT_SECRET: Your Discord OAuth app client secret
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
mcp = FastMCP("Discord OAuth Example Server", auth=auth)Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""OAuth client example for connecting to FastMCP servers.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to connect to an OAuth-protected FastMCP server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client import Client, OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(SERVER_URL, auth=OAuth()) as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""GitHub OAuth server example for FastMCP.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to protect a FastMCP server with GitHub OAuth.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
- FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID: Your GitHub OAuth app client ID
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
- FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET: Your GitHub OAuth app client secret
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
mcp = FastMCP("GitHub OAuth Example Server", auth=auth)Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""OAuth client example for connecting to FastMCP servers.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to connect to an OAuth-protected FastMCP server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(SERVER_URL, auth="oauth") as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Mounted OAuth servers client example for FastMCP.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates connecting to multiple mounted OAuth-protected MCP servers.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(GITHUB_URL, auth="oauth") as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(GOOGLE_URL, auth="oauth") as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Mounted OAuth servers example for FastMCP.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates mounting multiple OAuth-protected MCP servers in a single
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
- GitHub discovery: http://localhost:8000/.well-known/oauth-authorization-server/api/mcp/github
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
- Google discovery: http://localhost:8000/.well-known/oauth-authorization-server/api/mcp/google
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
- FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID: Your GitHub OAuth app client ID
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
- FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET: Your GitHub OAuth app client secret
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
- FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID: Your Google OAuth client ID
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
- FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET: Your Google OAuth client secret
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# --- GitHub OAuth Server ---
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
return "This is the GitHub OAuth protected MCP server"
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# --- Google OAuth Server ---
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
return "This is the Google OAuth protected MCP server"
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# - /.well-known/oauth-authorization-server/api/mcp/github
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# - /.well-known/oauth-authorization-server/api/mcp/google
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
print("Starting mounted OAuth servers...")Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
f" GitHub: {ROOT_URL}/.well-known/oauth-authorization-server{API_PREFIX}/github"Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
f" Google: {ROOT_URL}/.well-known/oauth-authorization-server{API_PREFIX}/google"Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""OAuth client example for connecting to PropelAuth-protected FastMCP servers.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to connect to a PropelAuth OAuth-protected FastMCP server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(SERVER_URL, auth="oauth") as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""OAuth client example for connecting to Scalekit-protected FastMCP servers.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to connect to a Scalekit OAuth-protected FastMCP server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(SERVER_URL, auth="oauth") as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""OAuth client example for connecting to FastMCP servers.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to connect to an OAuth-protected FastMCP server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async with Client(SERVER_URL, auth="oauth") as client:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""WorkOS OAuth server example for FastMCP.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This example demonstrates how to protect a FastMCP server with WorkOS OAuth.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
mcp = FastMCP("WorkOS OAuth Example Server", auth=auth)Validate OAuth scopes on every endpoint. Check that the token has required permissions.
API endpoints without rate limiting are vulnerable to brute force and denial of service.
@app.get("/users", tags=["users", "public"])Add rate limiting middleware to all public API endpoints.
API endpoints without rate limiting are vulnerable to brute force and denial of service.
@app.post("/users", tags=["users", "admin"])Add rate limiting middleware to all public API endpoints.
API endpoints without rate limiting are vulnerable to brute force and denial of service.
@app.get("/admin/stats", tags=["admin", "internal"])Add rate limiting middleware to all public API endpoints.
API endpoints without rate limiting are vulnerable to brute force and denial of service.
@app.get("/health", tags=["public"])Add rate limiting middleware to all public API endpoints.
API endpoints without rate limiting are vulnerable to brute force and denial of service.
@app.get("/metrics")Add rate limiting middleware to all public API endpoints.
POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.
@app.post("/users", tags=["users", "admin"])Implement CSRF protection using tokens or SameSite cookies.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"Authorization": f"Bearer {surge_settings.api_key}",Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
Applies ``auth='oauth'`` automatically for HTTP-based targets unless
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
effective_auth = "oauth"
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from .auth import OAuth, BearerAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"OAuth",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from .bearer import BearerAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from .oauth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from .oauth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
__all__ = ["BearerAuth", "OAuth"]
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
request.headers["Authorization"] = f"Bearer {self.token.get_secret_value()}"Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
OAuth callback server for handling authorization code flows.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This module provides a reusable callback server that can handle OAuth redirects
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
title: str = "FastMCP OAuth",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Create a styled HTML response for OAuth callbacks."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Container for OAuth callback results, used with anyio.Event for async coordination."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
Create an OAuth callback server.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
callback_path: The path to listen for OAuth redirects on
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Handle OAuth callback requests with proper HTML responses."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# Check for missing state parameter (indicates OAuth flow issue)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"The OAuth server did not return the expected state parameter."
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
print("🎭 OAuth Callback Test Server")Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.bearer import BearerAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.oauth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.oauth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth: httpx.Auth | Literal["oauth"] | str | None = None,
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth: Authentication method - httpx.Auth, "oauth" for OAuth flow,
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth: Authentication method - httpx.Auth, "oauth" for OAuth flow,
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
or a bearer token string.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
def _set_auth(self, auth: httpx.Auth | Literal["oauth"] | str | None):
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
if auth == "oauth":
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
resolved = OAuth(
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
elif isinstance(auth, OAuth):
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# Only inject the transport's factory into OAuth if OAuth still
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# Only inject the transport's factory into OAuth if OAuth still
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.bearer import BearerAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.oauth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.oauth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth: httpx.Auth | Literal["oauth"] | str | None = None,
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
def _set_auth(self, auth: httpx.Auth | Literal["oauth"] | str | None):
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
if auth == "oauth":
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
resolved = OAuth(
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
elif isinstance(auth, OAuth):
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# Only inject the transport's factory into OAuth if OAuth still
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# Only inject the transport's factory into OAuth if OAuth still
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
CurrentAccessToken,
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"CurrentAccessToken",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
str | Literal["oauth"] | httpx.Auth | None,
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
description='Either a string representing a Bearer token, the literal "oauth" to use OAuth authentication, or an httpx.Auth instance for custom authentication.',
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
description='Either a string representing a Bearer token, the literal "oauth" to use OAuth authentication, or an httpx.Auth instance for custom authentication.',
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
description='Either a string representing a Bearer token, the literal "oauth" to use OAuth authentication, or an httpx.Auth instance for custom authentication.',
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
discovery_endpoint: URL of the OAuth metadata discovery endpoint
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
<p>Your MCP client opened this page to complete OAuth authorization,
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
OAuth 2.0 requires clients to register before authorization.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
In browser-delegated OAuth flows, your application cannot
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This maintains OAuth 2.1 compliance (returns 400 for invalid client_id)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
provider: OAuth authorization server provider
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
discovery_endpoint = f"{self._base_url}/.well-known/oauth-authorization-server"Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
f'<{registration_endpoint}>; rel="http://oauth.net/core/2.1/#registration"'Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""OAuth Proxy Provider for FastMCP.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This package provides OAuth proxy functionality split across multiple modules:
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Utilities for validating client redirect URIs in OAuth flows.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# PydanticAdapter for type-safe storage (following OAuth proxy pattern)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
which can be useful for OAuth callbacks, health checks, or admin APIs.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.oauth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.oauth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
class HeadlessOAuth(OAuth):
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
class HeadlessOAuth(OAuth):
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
OAuth provider that bypasses browser interaction for testing.
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This simulates the complete OAuth flow programmatically by making HTTP requests
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Initialize HeadlessOAuth with stored response tracking."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
f"OAuth authorization failed: {error} - {error_desc}"Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
This module provides reusable HTML/CSS components for OAuth callbacks,
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# Redirect section styles (for OAuth redirect URI box)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.bearer import BearerAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
Client(transport=StdioTransport("echo", ["hello"]), auth="oauth")Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
transport=StreamableHttpTransport("http://localhost:8000"), auth="oauth"Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
transport=StreamableHttpTransport("http://localhost:8000", auth="oauth"),Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
client = Client(transport=SSETransport("http://localhost:8000"), auth="oauth")Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
client = Client(transport=SSETransport("http://localhost:8000", auth="oauth"))Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"headers": {"Authorization": "Bearer 123"},Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert transport.transport.headers == {"Authorization": "Bearer 123"}Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"headers": {"Authorization": "Bearer 123"},Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Comprehensive XSS protection tests for OAuth callback HTML rendering."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
API endpoints without rate limiting are vulnerable to brute force and denial of service.
@app.get("/headers")Add rate limiting middleware to all public API endpoints.
API endpoints without rate limiting are vulnerable to brute force and denial of service.
@app.get("/headers/{header_name}")Add rate limiting middleware to all public API endpoints.
API endpoints without rate limiting are vulnerable to brute force and denial of service.
@app.post("/headers")Add rate limiting middleware to all public API endpoints.
POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.
@app.post("/headers")Implement CSRF protection using tokens or SameSite cookies.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
headers={"Authorization": "Bearer secret-token"},Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
headers={"Authorization": "Bearer secret-token"},Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert received_headers.get("authorization") == "Bearer secret-token"Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"Bearer my-secret-token",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
headers={"Authorization": "Bearer secret"},Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.oauth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.oauth import OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth="oauth",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth="oauth",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async def test_streamable_http_verify_propagates_to_oauth(self):
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth="oauth",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async def test_sse_verify_propagates_to_oauth(self):
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth="oauth",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async def test_client_verify_propagates_to_oauth(self):
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth="oauth",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(client.transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth=OAuth(),
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth="oauth",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# OAuth was created without verify — factory should be default
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# Now wrap in Client with verify=False — should resync OAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(client.transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
async def test_client_verify_overrides_transport_verify_in_oauth(self):
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth="oauth",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# OAuth should initially have verify=False
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
# Client overrides verify to True — OAuth should update
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(client.transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
auth = OAuth(httpx_client_factory=custom_factory)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert isinstance(transport.auth, OAuth)
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.bearer import BearerAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Tests for OAuth proxy client registration (DCR)."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Tests for OAuth proxy client registration (DCR)."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Tests for redirect URI validation in OAuth flows."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"Authorization": "Bearer tenant-token",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"authorization": "Bearer tenant-token",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"Authorization": "Bearer secret-token",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Tests for authentication dependencies (CurrentAccessToken, TokenClaim)."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Test that CurrentAccessToken can be imported."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.server.dependencies import CurrentAccessToken
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert CurrentAccessToken is not None
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Test that CurrentAccessToken is a Dependency instance."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.server.dependencies import _CurrentAccessToken
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
dep = _CurrentAccessToken()
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Test that CurrentAccessToken raises when no token is available."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.server.dependencies import _CurrentAccessToken
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
dep = _CurrentAccessToken()
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Test that CurrentAccessToken dependency is excluded from tool schema."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.server.auth import AccessToken
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.server.dependencies import CurrentAccessToken
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
token: AccessToken = CurrentAccessToken(),
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
token: AccessToken = CurrentAccessToken(),
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"""Test that CurrentAccessToken is exported from __all__."""
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
assert "CurrentAccessToken" in dependencies.__all__
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.bearer import BearerAuth
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
from fastmcp.client.auth.oauth import OAuthClientProvider
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.
"auth": "oauth",
Validate OAuth scopes on every endpoint. Check that the token has required permissions.
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: astral-sh/setup-uv@v7
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/create-github-app-token@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: astral-sh/setup-uv@v7
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/create-github-app-token@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: astral-sh/setup-uv@v7
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/create-github-app-token@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/setup-python@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: astral-sh/setup-uv@v7
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: anthropics/claude-code-action@v1
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/create-github-app-token@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: astral-sh/setup-uv@v7
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/create-github-app-token@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: astral-sh/setup-uv@v7
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/create-github-app-token@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/create-github-app-token@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: anthropics/claude-code-action@v1
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/create-github-app-token@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: anthropics/claude-code-action@v1
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: strawgate/minimize-resolved-pr-reviews@v0
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: astral-sh/setup-uv@v7
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
- uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: j178/prek-action@v2
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
- uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
- uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
- uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/setup-node@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
- uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
- uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: j178/prek-action@v2
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
- uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
- uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: jayqi/failed-build-issue-action@v1
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/create-github-app-token@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
- uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: astral-sh/setup-uv@v7
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: peter-evans/create-pull-request@v8
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: actions/create-github-app-token@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
- uses: actions/checkout@v6
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: astral-sh/setup-uv@v7
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: extractions/setup-just@v3
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.
uses: peter-evans/create-pull-request@v8
Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
req = _find_request(request_id)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
req = _find_request(request_id)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
req = _find_request(request_id)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
SERVER_URL = "http://127.0.0.1:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
SERVER_URL = "http://localhost:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
SERVER_URL = "http://127.0.0.1:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
SERVER_URL = "http://127.0.0.1:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
SERVER_URL = "http://127.0.0.1:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
SERVER_URL = "http://localhost:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
SERVER_URL = "http://127.0.0.1:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
GITHUB_URL = "http://127.0.0.1:8000/api/mcp/github/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
GOOGLE_URL = "http://127.0.0.1:8000/api/mcp/google/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
ROOT_URL = "http://localhost:8000"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
SERVER_URL = "http://127.0.0.1:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
- BASE_URL: Public URL where the FastMCP server is exposed (defaults to `http://localhost:8000/`)
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url=os.getenv("BASE_URL", "http://localhost:8000/"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
SERVER_URL = "http://127.0.0.1:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
- BASE_URL: Public URL where the FastMCP server is exposed (defaults to `http://localhost:8000/`)
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url=os.getenv("BASE_URL", "http://localhost:8000/"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
SERVER_URL = "http://127.0.0.1:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
endpoint = os.environ.get("OTEL_EXPORTER_OTLP_ENDPOINT", "http://localhost:4317")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
server_url = os.environ.get("DIAGNOSTICS_SERVER_URL", "http://localhost:8001/sse")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
ECHO_SERVER_URL = f"http://localhost:{ECHO_SERVER_PORT}/sse"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
f"http://localhost:{ECHO_SERVER_PORT}/sse", timeout=0.1Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
URL = "http://127.0.0.1:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://{directory}/{filename}")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
endpoint = os.environ.get("OTEL_EXPORTER_OTLP_ENDPOINT", "http://localhost:4317")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
def log_request(self, body: dict[str, Any]) -> None:
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
message_log.log_request(item)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
message_log.log_request(req_json)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
mcp_url = f"http://localhost:{mcp_port}/mcp"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
dev_url = f"http://localhost:{dev_port}"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
doc = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
fastmcp cimd create --name "My App" -r "http://localhost:*/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri = f"http://localhost:{self.redirect_port}/callback"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client = Client("http://localhost:8080")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await self.on_request(message) # type: ignore[arg-type] # ty:ignore[invalid-argument-type]
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
meta: Optional metadata to pass with the request (e.g., version info)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
webbrowser.open(f"http://localhost:{port}/callback?code=test123&state=xyz")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource_as_task("file://data.txt")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
return await super().authenticate_request(request)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
return await super().authenticate_request(request)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def fetch(self, client_id_url: str) -> CIMDDocument:
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
cimd_doc = await self._fetcher.fetch(client_id_url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
Patterns support wildcards (e.g., "http://localhost:*", "https://*.example.com/*").
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=client_info.redirect_uris or [AnyUrl("http://localhost")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
Patterns support wildcards (e.g., "http://localhost:*", "https://*.example.com/*").
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
Azure only allows ONE resource per token request (AADSTS28000), so we only
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
scopes: Scopes from the authorization request (unprefixed)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
token request (AADSTS28000). We include scopes for this API plus OIDC scopes.
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:*",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://127.0.0.1:*",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def on_request(self, context, call_next):
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await self.session_manager.handle_request(scope, receive, send)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await super(MiddlewareServerSession, self)._received_request(responder)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
return await super()._received_request(responder)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def on_request(self, context: MiddlewareContext, call_next: CallNext) -> Any:
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def on_request(self, context: MiddlewareContext, call_next: CallNext) -> Any:
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def on_request(self, context: MiddlewareContext, call_next: CallNext) -> Any:
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def on_request(self, context: MiddlewareContext, call_next: CallNext) -> Any:
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url = str(self._client.base_url) or "http://localhost"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
proxy = ProxyProvider(lambda: ProxyClient("http://localhost:8000/mcp"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
proxy = create_proxy("http://localhost:8000/mcp")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
proxy = FastMCPProxy(client_factory=lambda: ProxyClient("http://localhost:8000/mcp"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"uri": f"file://{path}",Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
>>> build_task_key("session123", "task456", "resource", "file://data.txt")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
`{'session_id': 'session123', 'client_task_id': 'task456', 'task_type': 'resource', 'component_identifier': 'file://data.txt'}`Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
# Resource "file://data.txt" becomes "file://math/data.txt"
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
# Resource "file://data.txt" becomes "file://math/data.txt"
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
meta: The meta dict from an MCP request (ctx.request_context.meta)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
(``http://``, ``https://``, ``file://``, or any other URI scheme) are
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
Remote URIs (``http://``, ``file://``, etc.) are stripped before
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url: str = "http://localhost",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri_str = f"file:///{self._name}.{self._mime_type.split('/')[1]}"Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri_str = f"file:///resource.{self._mime_type.split('/')[1]}"Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert doc["redirect_uris"] == ["http://localhost:*/callback"]
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:*/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
resolve_server_spec("http://localhost:8000/mcp")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
== "http://localhost:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
config = {"mcpServers": {"test": {"url": "http://localhost:8000"}}}Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
resolve_server_spec("http://localhost:8000", command="npx server")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
result = resolve_server_spec("http://localhost:8000/mcp", transport="sse")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert result == "http://localhost:8000/mcp/sse"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
result = resolve_server_spec("http://localhost:8000/sse", transport="sse")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert result == "http://localhost:8000/sse"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
result = resolve_server_spec("http://localhost:8000/mcp/", transport="sse")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert result == "http://localhost:8000/mcp/sse"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
result = resolve_server_spec("http://localhost:8000/mcp", transport="http")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert result == "http://localhost:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert _is_http_target("http://localhost:8000") is TrueBlock requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client = _build_client("http://localhost:8000/mcp")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client = _build_client("http://localhost:8000/mcp", auth="none")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client = _build_client({"mcpServers": {"test": {"url": "http://localhost"}}})Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
result = open_deeplink("file:///etc/passwd")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000/mcp",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
config=RemoteMCPServer(url="http://localhost:8000/mcp"),
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
config=RemoteMCPServer(url="http://localhost:8000/sse", transport="sse"),
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert servers[0].config.url == "http://localhost:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
entry = {"url": "http://localhost:8000/sse", "type": "sse"}Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
entry = {"url": "http://localhost:8000/mcp", "transport": "http"}Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
project_servers={"api": {"url": "http://localhost:8000/mcp"}},Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000/sse",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
result = resolve_server_spec("http://localhost:8000/mcp")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert result == "http://localhost:8000/mcp"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport = StreamableHttpTransport("http://localhost:8000/mcp")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport = SSETransport("http://localhost:8000/sse")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert _is_http_target("http://localhost:8000") is TrueBlock requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
code, imports = serialize_transport("http://localhost:8000/mcp")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert code == "'http://localhost:8000/mcp'"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
d: dict[str, Any] = {"mcpServers": {"test": {"url": "http://localhost"}}}Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert _derive_server_name("http://localhost:8000/mcp") == "localhost"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport_code='"http://localhost:8000/mcp"',
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport_code='"http://localhost:8000/mcp"',
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport_code='"http://localhost:8000/mcp"',
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport_code='"http://localhost"',
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport_code='"http://localhost"',
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport_code='"http://localhost:8000/mcp"',
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert is_url("http://localhost:8080")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert is_url("http://127.0.0.1:3000/path")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert is_url("https://localhost:8443")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
assert not is_url("ftp://example.com") # Not http/httpsOnly allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
assert not is_url("file:///path/to/file")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
server = fastmcp_server(f"http://127.0.0.1:{port}")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
issuer_url = f"http://127.0.0.1:{port}"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl(f"http://localhost:{callback_port}/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
issuer_url = f"http://127.0.0.1:{port}"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl(f"http://localhost:{callback_port}/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client = Client(transport=StreamableHttpTransport("http://localhost:8000"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport=StreamableHttpTransport("http://localhost:8000"), auth="oauth"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport=StreamableHttpTransport("http://localhost:8000", auth="oauth"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client = Client(transport=SSETransport("http://localhost:8000"), auth="oauth")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client = Client(transport=SSETransport("http://localhost:8000", auth="oauth"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport=StreamableHttpTransport("http://localhost:8000"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:8000", auth="test_token"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport=SSETransport("http://localhost:8000"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport=SSETransport("http://localhost:8000", auth="test_token"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"https://localhost:8080/mcp/sse/endpoint",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"https://localhost:8080/mcp/sse/",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"https://localhost:8080/mcp/sse/?param=value",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"https://localhost:8000/mcp/sse?x=1&y=2",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"https://localhost:8080/mcp/",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"https://localhost:8080/sservice/endpoint",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000/sse/",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert transport.transport.url == "http://localhost:8000/sse/"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000/sse/",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://document.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://data/{id}.json", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://document.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://document.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://document.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://document.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://data/999.json", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://document.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://background.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://background.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://counter.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://counter.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://immediate.txt", task=False)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
await client.read_resource("file://immediate.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
f"http://127.0.0.1:{port}/callback?code=good&state=s1"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
f"http://127.0.0.1:{port}/callback?code=evil&state=s2"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@pytest.mark.parametrize("roots", [["file://x/y/z", "file://x/y/z"]])Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@pytest.mark.parametrize("roots", [["file://x/y/z", "file://x/y/z"]])Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"file://x/y/z",
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"file://x/y/z",
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
yield f"http://127.0.0.1:{port}/nest-outer/nest-inner/mcp/sse/"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
yield f"http://127.0.0.1:{port}/nest-outer/nest-inner/final/mcp"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=AnyUrl("file:///test.bin"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://config.txt")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://data.json")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"uri": "file://config.txt/",
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"uri": "file://data.json/",
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
name="read_resource", arguments={"uri": "file://config.txt"}Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url = f"http://127.0.0.1:{port}"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url = f"http://127.0.0.1:{port}"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:12345/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uri": "http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file://file.txt"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file://file.txt"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file://file.txt"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file://file.txt"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file://file.txt"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file://file.txt"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl(f"file://{temp_file}"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl(f"file://{temp_file}"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl(f"file://{temp_file}"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file:///test.txt"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file:///missing.txt"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file:///test/utf8"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file:///test/default"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file:///test/binary"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=FileUrl("file:///test/latin1"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
("file://abc/xyz.py", {"path": "xyz"}),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
("file://abc/x/y/z.py", {"path": "x/y/z"}),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
("file://abc/x/y/z/.py", {"path": "x/y/z/"}),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
("file://abc/x/y/z.md", None),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
("file://x/y/z.txt", None),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri_template = "file://abc/{path*}.py"Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
self.base_url = f"http://localhost:{port}"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
self.base_url = f"http://localhost:{self.port}"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:54321/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:54321/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:8080/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
allowed_client_redirect_uris=["http://localhost:*"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
Azure only allows ONE resource per token request (AADSTS28000), so
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
config_url="http://localhost:8080/v1/apps/agentic/P2abc123/M123/.well-known/openid-configuration",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert str(provider2.descope_base_url) == "http://localhost:8080"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:4321",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:4321",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:4321",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:4321",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
authkit_domain="http://localhost:8080",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:4321",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
doc = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
first = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
second = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
first = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
second = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
first = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
second = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
first = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
second = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
first = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
second = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
first = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
second = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
first = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
second = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
third = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
first = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
second = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
third = await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await fetcher.fetch(url)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert fetcher.validate_redirect_uri(doc, "http://localhost:3000/callback")
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert not fetcher.validate_redirect_uri(doc, "http://localhost:4000/callback")
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert fetcher.validate_redirect_uri(doc, "http://localhost:3000/callback")
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert fetcher.validate_redirect_uri(doc, "http://localhost:8080/callback")
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert not fetcher.validate_redirect_uri(doc, "http://localhost:3000/other")
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost/callback", "http://127.0.0.1/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost/callback", "http://127.0.0.1/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert fetcher.validate_redirect_uri(doc, "http://localhost:51353/callback")
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert fetcher.validate_redirect_uri(doc, "http://127.0.0.1:3000/callback")
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert not fetcher.validate_redirect_uri(doc, "http://localhost:51353/other")
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
patterns = ["http://localhost:*", "https://app.example.com/*"]
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
allowed_redirect_uri_patterns=["http://localhost:*"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
AnyUrl("http://localhost:3000/callback")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert str(validated) == "http://localhost:3000/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client.validate_redirect_uri(AnyUrl("http://localhost:4000/callback"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
allowed_redirect_uri_patterns=["http://localhost:*"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
AnyUrl("http://localhost:3000/callback")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert str(validated) == "http://localhost:3000/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uri": "http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uri": "http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uri": "http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uri": "http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uri": "http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uri": "http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uri": "http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:54321/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:54321/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert transaction["client_redirect_uri"] == "http://localhost:54321/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:54321/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:54321/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:12345/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:8080/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:8080/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:9090/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:9090/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:7070/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:7070/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:6060/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:6060/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:9090/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:5050/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:5050/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:4040/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uri=AnyUrl("http://localhost:4040/callback"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
oauth_proxy_https, "client-a", "http://localhost:5001/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client_redirect = "http://localhost:5002/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
oauth_proxy_https, "client-c", "http://localhost:5003/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
oauth_proxy_https, "client-d", "http://localhost:5004/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect = "http://localhost:5005/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client_redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client_redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client_redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client_redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client_redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:12345/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client_redirect_uri="http://localhost:12345/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
oauth_proxy_https, "client-binding", "http://localhost:6001/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect = "http://localhost:6002/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
oauth_proxy_https, "client-par-a", "http://localhost:6010/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
oauth_proxy_https, "client-par-b", "http://localhost:6011/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
oauth_proxy_https, "client-nocd", "http://localhost:6003/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
oauth_proxy_https, "client-wrongcd", "http://localhost:6004/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
oauth_proxy_https, "client-notxntoken", "http://localhost:6005/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect = "http://localhost:6006/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:3000")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert client.validate_redirect_uri(AnyUrl("http://localhost:3000")) == AnyUrl(Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert client.validate_redirect_uri(AnyUrl("http://localhost:8080")) == AnyUrl(Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:8080"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert client.validate_redirect_uri(AnyUrl("http://127.0.0.1:3000")) == AnyUrl(Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://127.0.0.1:3000"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:3000")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:*",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert client.validate_redirect_uri(AnyUrl("http://localhost:3000"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client.validate_redirect_uri(AnyUrl("http://127.0.0.1:3000"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:3000")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client.validate_redirect_uri(AnyUrl("http://localhost:3000"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client.validate_redirect_uri(AnyUrl("http://127.0.0.1:3000"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:3000")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert client.validate_redirect_uri(AnyUrl("http://localhost:3000"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client.validate_redirect_uri(AnyUrl("http://localhost:5000"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:3000")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert result == AnyUrl("http://localhost:3000")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert result == AnyUrl("http://localhost:3000/callback")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
allowed_redirect_uri_patterns=["http://localhost:*"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://127.0.0.1/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert client.validate_redirect_uri(AnyUrl("http://localhost:51353/callback"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert client.validate_redirect_uri(AnyUrl("http://127.0.0.1:3000/callback"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client.validate_redirect_uri(AnyUrl("http://localhost:51353/other"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=["http://localhost:3000/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client.validate_redirect_uri(AnyUrl("http://localhost:3000/callback"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
custom_patterns = ["http://localhost:*", "https://*.myapp.com/*"]
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
custom_patterns = ["http://localhost:*", "http://127.0.0.1:*"]
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
custom_patterns = ["http://localhost:*", "http://127.0.0.1:*"]
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:*/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000/callback",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
base_url="http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
allowed_client_redirect_uris=["http://localhost:*"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert client.validate_redirect_uri(AnyUrl("http://localhost:3000/callback"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
client.validate_redirect_uri(AnyUrl("http://localhost:9999/other"))Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:8080/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:9999/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
allowed_client_redirect_uris=["http://localhost:*"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:8080/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
AnyUrl("http://localhost:12345/callback")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:8080/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
redirect_uris=[AnyUrl("http://localhost:8080/callback")],Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"redirect_uris": ["http://localhost:8080/callback"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
allowed_client_redirect_uris=["http://localhost:*"],
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert proxy._allowed_client_redirect_uris == ["http://localhost:*"]
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000/callback", "http://localhost:3000/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000/callback", "http://localhost:3000/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000/callback", "http://localhost:3001/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000/callback", "http://localhost:3001/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost:*/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:3000/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:54321/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost:3000/*"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:3000/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:3000/auth/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert not matches_allowed_pattern("http://localhost:3001/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert validate_redirect_uri(None, ["http://localhost:*"])
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert validate_redirect_uri("http://localhost:3000", None)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert validate_redirect_uri("http://127.0.0.1:8080", None)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert not validate_redirect_uri("http://localhost:3000", [])Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:*",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert validate_redirect_uri("http://localhost:3000", patterns)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert not validate_redirect_uri("http://127.0.0.1:3000", patterns)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
patterns = ["http://localhost:*"]
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
uri = AnyUrl("http://localhost:3000/callback")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost:*"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost@evil.com/callback", pattern
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000@malicious.io/callback", pattern
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost:*"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:3000/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:8080/auth", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000/callback", "https://localhost:*"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000/callback", "https://localhost:*"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"https://localhost:3000/callback", "http://localhost:*"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"https://localhost:3000/callback", "http://localhost:*"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost:*"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert not matches_allowed_pattern("http://127.0.0.1:3000/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:51353/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:3000/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:80/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:51353", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:3000/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://127.0.0.1/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://127.0.0.1:51353/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://127.0.0.1:3000/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://[::1]/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://[::1]:51353/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://[::1]:3000/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost:8080/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert matches_allowed_pattern("http://localhost:8080/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert not matches_allowed_pattern("http://localhost:3000/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert not matches_allowed_pattern("https://localhost:3000/callback", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
pattern = "http://localhost/callback"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert not matches_allowed_pattern("http://localhost:3000/other", pattern)Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert "http://localhost:*" in DEFAULT_LOCALHOST_PATTERNS
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert "http://127.0.0.1:*" in DEFAULT_LOCALHOST_PATTERNS
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://localhost:3000", DEFAULT_LOCALHOST_PATTERNS
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"http://127.0.0.1:8080", DEFAULT_LOCALHOST_PATTERNS
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
jwks_uri="https://localhost/.well-known/jwks.json",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests to 169.254.169.254 or cloud metadata services can leak cloud credentials.
assert is_ip_allowed("169.254.169.254") is FalseBlock requests to cloud metadata endpoints. Use IMDSv2 with hop limit of 1.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
def test_get_access_token_falls_back_to_context_var_when_no_request(self):
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=AnyUrl("file:///tmp/../../etc/shadow?token=abcd")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
result = await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
result = await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
result = await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
result = await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
result = await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
await middleware.on_request(mock_context, mock_call_next)
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
transport=SSETransport("http://127.0.0.1:9999/sse/"),Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert str(request.url).startswith("http://localhost")Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def test_forward_list_roots_request(self, proxy_server: FastMCP):
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def test_forward_sampling_request(self, proxy_server: FastMCP):
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def test_elicit_request(self, proxy_server: FastMCP):
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def test_log_request(self, proxy_server: FastMCP):
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def test_report_progress_request(self, proxy_server: FastMCP):
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
async with Client(proxy_server, roots=["file://x/y/z"]) as client:
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
assert result.data == ["file://x/y/z"]
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
url = f"http://127.0.0.1:{port}/mcp/"Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://data.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://data.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://data.txt")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://large.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://user/{user_id}/data.json", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
result = await client.read_resource("file://data.txt")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://large.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://large.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
task = await client.read_resource("file://user/123/data.json", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"file://sync.txt/", task=False
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
await client.read_resource("file://sync.txt", task=True)Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://test_dir/example.py")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://test_dir/readme.md")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://test_dir/config.json")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"file://test_dir/example.py",
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"file://test_dir/readme.md",
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"file://test_dir/config.json",
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
res_result = await mcp._read_resource_mcp("file://test_dir/example.py")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
res_result = await mcp._read_resource_mcp("file://test_dir/example.py")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
async with httpx.AsyncClient(base_url="http://localhost") as http_client:
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://{path}")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
assert resources[0]["uri_template"] == "file://{path}"Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file://{path}")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
assert templates == ["file://{path}"]Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file:///config", version="1.0")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file:///config")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
async def test_unversioned_returned_for_exact_version_request(self):
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file:///config", version="1.0")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file:///config", version="2.0")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file:///unversioned")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file:///included_versioned", version="1.0")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file:///excluded_versioned", version="5.0")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"file:///included_versioned"
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@child.resource("file://data/", version="2.0")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
resource = await provider.get_resource("file://data/")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"file://data/", version=VersionSpec(lt="2.0")
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@child.resource("file:///config", version="1.5")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file:///config", version="1.0")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
@mcp.resource("file:///config", version="2.0")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
resource = await mcp.get_resource("file:///config")Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert transport.url == "http://localhost:8000"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert transport.url == "http://localhost:8000"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000/sse/",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
assert transport.url == "http://localhost:8000/sse/"
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000/sse/",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000/sse/",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
"url": "http://localhost:8000",
Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
uri=AnyUrl("file:///resource.octet-stream"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"uri": AnyUrl("file:///resource.octet-stream"),Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
def test_build_basic_request(self, director, basic_route):
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
def test_build_complex_request(self, director, complex_route):
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
assert Resource.make_key("file://test.txt") == "resource:file://test.txt"Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Requests to RFC 1918 private IP ranges (10.x, 172.16-31.x, 192.168.x) or link-local (169.254.x) can reach internal infrastructure.
"evil": {"$ref": "http://169.254.169.254/latest/meta-data/"},Block requests to private IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x). Validate URLs before fetching.
Requests to RFC 1918 private IP ranges (10.x, 172.16-31.x, 192.168.x) or link-local (169.254.x) can reach internal infrastructure.
"$ref": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
Block requests to private IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x). Validate URLs before fetching.
Requests to 169.254.169.254 or cloud metadata services can leak cloud credentials.
"evil": {"$ref": "http://169.254.169.254/latest/meta-data/"},Block requests to cloud metadata endpoints. Use IMDSv2 with hop limit of 1.
Requests to 169.254.169.254 or cloud metadata services can leak cloud credentials.
"$ref": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
Block requests to cloud metadata endpoints. Use IMDSv2 with hop limit of 1.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
schema = {"$ref": "file:///etc/passwd"}Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
{"$ref": "file:///etc/credentials.json"},Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
"secret": {"$ref": "file:///etc/passwd"},Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.
assert str(resource.resource.uri) == "file:///resource.pdf"
Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=AppConfig(resource_uri=VIEW_URI))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
echo_proxy = create_proxy(ECHO_SERVER_URL, name="Echo Proxy")
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
2. Create a proxy FastMCP server using ``FastMCP.as_proxy(original_server)``.
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy_server = FastMCP.as_proxy(original_server, name="InMemoryProxy")
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(tags={"namespace:finance"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(tags={"namespace:finance"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(tags={"namespace:finance"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(tags={"namespace:admin"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(tags={"namespace:admin"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@hub_mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, openWorldHint=True))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, openWorldHint=True))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=False, openWorldHint=True))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=False, openWorldHint=True))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, openWorldHint=True))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, openWorldHint=True))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=False, openWorldHint=True))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=False, openWorldHint=True))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=False, openWorldHint=True))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, openWorldHint=True))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(name="textme", description="Send a text message to me")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.1")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@components.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@components.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@components.tool(version="3.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=PrefabAppConfig()) # same as app=True
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=PrefabAppConfig(
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@self.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@self.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
server = create_proxy(mcp_config)
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected MCP transport or endpoint URL being resolved from environment variables, configuration objects, or remote fetch calls. Dynamic resolution enables an attacker to redirect MCP traffic to a shadow server by manipulating the configuration source.
transport = config.to_transport()
Use hardcoded or compile-time endpoint URLs for MCP server connections. If dynamic configuration is necessary, validate endpoints against an allowlist.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("write"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("admin"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("read", "write"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
- @provider.tool (without parentheses)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
- @provider.tool(name="custom_name") (with name as keyword argument)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
- provider.tool(function, name="custom_name") (direct function call)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
class FastMCPProxy(FastMCP):
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = create_proxy("http://localhost:8000/mcp")Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = FastMCPProxy(client_factory=lambda: ProxyClient("http://localhost:8000/mcp"))Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
lifespan=_lifespan_proxy(fastmcp_server=self),
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
server = FastMCP.as_proxy(server)
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = create_proxy("http://remote-server/mcp")Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = create_proxy(other_server)
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
- @server.tool (without parentheses)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
- @server.tool (with empty parentheses)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
- @server.tool(name="custom_name") (with name as keyword argument)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
- server.tool(function, name="custom_name") (direct function call)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="custom_name")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
server.tool(my_function, name="custom_name")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="required"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="optional"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = FastMCP.as_proxy(StreamableHttpTransport(shttp_server))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
async def test_client_headers_proxy(proxy_server: str):
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_simple_text")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_image_content")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_audio_content")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_embedded_resource")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_multiple_content_types")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_error_handling")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_tool_with_logging")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_tool_with_progress")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_sampling")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_elicitation")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_elicitation_sep1034_defaults")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name="test_elicitation_sep1330_enums")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(output_schema=None)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(output_schema=None)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(output_schema=None)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(exclude_args=["state"])
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(exclude_args=["state"])
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@first_app.tool(name="shared_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@second_app.tool(name="shared_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@first_app.tool(name="shared_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@second_app.tool(name="shared_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
provider.tool(my_tool, serializer=custom_serializer)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@provider.tool(serializer=custom_serializer)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
provider.tool(my_tool, serializer=custom_serializer)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=lambda _ctx: False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=lambda _ctx: False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"text"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"text"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math", "core"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"text"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"text"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"math"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("test"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("test"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("admin"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("admin"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("test"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("test"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"admin"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("test"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("test"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=check_claims)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=check_claims)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("test"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("test"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=require_scopes("test"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"add-tool"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(tags={"private"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy_server = FastMCP.as_proxy(mcp_server, name="Proxy Server")
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy_server = FastMCP.as_proxy(mcp_server, name="Proxy Server")
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"add-tool"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@main_app.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mounted.tool(tags={"allowed"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mounted.tool(tags={"blocked"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mounted.tool(tags={"production"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mounted.tool(tags={"blocked"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@first_app.tool(name="shared_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@second_app.tool(name="shared_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@first_app.tool(name="shared_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@second_app.tool(name="shared_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy_server = FastMCP.as_proxy(FastMCPTransport(original_server))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy_server = FastMCP.as_proxy(FastMCPTransport(original_server))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy_server = FastMCP.as_proxy(FastMCPTransport(original_server))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy_server = FastMCP.as_proxy(FastMCPTransport(original_server))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
sub_proxy = FastMCP.as_proxy(FastMCPTransport(sub))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
sub_proxy = FastMCP.as_proxy(FastMCPTransport(sub))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
sub_proxy = FastMCP.as_proxy(FastMCPTransport(sub))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"example", "test-tag"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(name="custom-add")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(description="Add two numbers")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"example", "test-tag"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
result_fn = mcp.tool(standalone_function, name="direct_call_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(output_schema={"type": "integer"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(meta=meta_data)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(output_schema=None)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(output_schema=None)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"a", "b"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"b", "c"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
return FastMCP.as_proxy(ProxyClient(fastmcp_server))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy_server = FastMCP.as_proxy(ProxyClient(fastmcp_server))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"echo"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
return create_proxy(ProxyClient(transport=FastMCPTransport(fastmcp_server)))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = create_proxy(fastmcp_server)
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = create_proxy(FastMCPTransport(fastmcp_server))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = create_proxy("http://example.com/mcp/")Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = FastMCP.as_proxy(fastmcp_server)
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = FastMCP.as_proxy("http://example.com/mcp/")Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = create_proxy(server)
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = create_proxy(server)
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = create_proxy(fastmcp_server)
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
async def test_stateful_proxy(self, stateful_proxy_server: FastMCP):
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
async def test_stateless_proxy(self, stateless_server: str):
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@provider.tool(name="custom_name")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
"""provider.tool(fn) should register the function."""
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
provider.tool(my_tool, name="direct_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@provider.tool(enabled=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@provider.tool(enabled=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@provider.tool(enabled=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@provider.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@provider.tool(task=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
mcp.tool(my_function, name="custom-tool-name")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=False) # Explicitly disable
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="required"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="required"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="forbidden"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="optional"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="optional"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="required"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="forbidden"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="required"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="optional"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="forbidden"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="optional", poll_interval=timedelta(seconds=2)))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True) # Enable background execution
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True) # Enable background execution
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True) # Enable background execution
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@endpoint_server.tool(task=True) # Enable background execution
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@endpoint_server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@parent.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@grandchild.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child1.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child2.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child1.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child2.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child1.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child2.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@grandchild.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="optional"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="required"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=TaskConfig(mode="forbidden"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@grandchild.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@grandchild.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@task_enabled_server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@task_enabled_server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
return create_proxy(FastMCPTransport(backend_server))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True) # Enable background execution
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@tool_server.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(icons=icons)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(icons=icons)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name=f"tool_{i}")Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name=f"tool_{i}")Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name=f"tool_{i}")Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name=f"tool_{i}")Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(name=f"tool_{i}")Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"tool-example", "test-tool-tag"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"finance"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"internal"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"finance"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"finance"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"finance"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"finance"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"finance"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"admin"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"test"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"finance"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"premium"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"system"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"env"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"env"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"system"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"env"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"env"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"system"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"system"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(annotations=annotations)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(annotations=annotations)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(auth=lambda _ctx: False)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="3.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0@beta")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="3.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="3.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.5")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="3.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="5.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="5.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2025-01-01")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2025-06-01")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2025-12-01")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="5.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="0.5")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="5.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="3.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="3.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="5.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="10")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.2.3")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.2.10")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.10.1")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="v1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="v2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="3.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@child.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@level3.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@level3.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version=2)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version=0)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="3.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0", auth=require_scopes("admin"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0", auth=require_scopes("admin"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="1.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="2.0", auth=require_scopes("admin"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(version="3.0")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(app=AppConfig(resource_uri="ui://my-app/view.html"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(app={"resourceUri": "ui://foo", "visibility": ["app"]})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(meta={"custom": "data"}, app=AppConfig(resource_uri="ui://app"))Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(app=AppConfig(resource_uri="ui://app", visibility=["app"]))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(app=AppConfig(resource_uri="ui://app"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server.tool(app=PrefabAppConfig())
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server1.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@server2.tool(app=PrefabAppConfig())
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=AppConfig(resource_uri="ui://custom/app.html"))
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(app=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(name="my_tool")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(description="Save a contact")
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(auth=check)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(timeout=30.0)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
"""@app.tool(model=True) has app visibility and IS findable."""
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(auth=deny_all)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
"""@app.tool(model=True) (visibility=["app","model"]) appears in list_tools."""
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@app.tool(model=True)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"keep"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(timeout=5.0)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(timeout=5.0)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(timeout=0.2)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(timeout=0.1)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(timeout=0.0)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(task=True, timeout=1.0)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(timeout=1.0)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(timeout=5.0)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(timeout=0.1)
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
proxy = FastMCP.as_proxy(FastMCPTransport(mcp_server))
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.
async def test_transform_proxy(self, proxy_server: FastMCP):
Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(tags={"fetch"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mounted.tool(tags={"allowed"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mounted.tool(tags={"blocked"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mounted.tool(tags={"production"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mounted.tool(tags={"development"})Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.
@mcp.tool(icons=[Icon(src=data_uri, mimeType="image/png")])
Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("like", {"uri": save_uri})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("repost", {"uri": save_uri})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_access_token_claims")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("echo", {"message": "Hello from Scalekit!"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("search", {"query": "add multiply numbers"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("execute", {"code": code})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("ping", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await final_client.call_tool("echo", {"message": message_to_echo})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("activate_finance", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_market_data", {"symbol": "AAPL"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("activate_admin", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("deactivate_all", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await alice.call_tool("list_session_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await alice.call_tool("get_value", {"key": "user"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await alice.call_tool("get_value", {"key": "secret"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await bob.call_tool("list_session_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await alice_again.call_tool("list_session_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await alice.call_tool("list_session_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await bob.call_tool("list_session_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await alice_again.call_tool("list_session_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_prompts", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("add_numbers", {"a": 10, "b": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("multiply_numbers", {"a": 7, "b": 6})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_resources", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("read_resource", {"uri": "config://app"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("read_resource", {"uri": "user://42/profile"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("analyze_sentiment", {"text": text})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("write_haiku", {"topic": "Python programming"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("ask_assistant", {"question": question})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("search_tools", {"query": "work with numbers"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("search_tools", {"pattern": "text|string|word"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("process", {"data": "Hello"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(tool_name, parsed_args, raise_on_error=False)
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(tool_name, filtered, raise_on_error=False)
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {"param": "value"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await self._call_tool(tool_call.tool, tool_call.arguments)
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await self._call_tool(tool, tool_call_arguments)
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await ctx.fastmcp.call_tool(tool.name, params)
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await self._server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("Files___store_files", {"files": files})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("list_files", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("read_file", {"name": "test.txt"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("read_file", {"name": "image.png"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("list_files", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("read_file", {"name": "test.txt"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("Uploads___store_files", {"files": files})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("read_file", {"name": "test.txt"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("hello", {"name": "FastMCP"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client_with_headless_oauth.call_tool("add", {"a": 5, "b": 3})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("add", {"a": 3, "b": 4})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert result.description == "Example greeting prompt."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert result.description == "Example greeting prompt."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert resource.description == "A tagged resource"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert template.description == "A tagged template"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("check_meta", {}, meta=test_meta)Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("dict_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "Test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert result1.description == "Prompt that runs in background."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert result2.description == "Prompt that runs in background."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("ask_for_name")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("ask_for_name")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("ask_for_optional_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("failing_elicit", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("multi_step_form", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_user_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_data", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("pattern_match_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("pattern_match_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("pattern_match_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("ask_for_name")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("post_headers_headers_post")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("post_headers_headers_post")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("post_headers_headers_post")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("post_headers_headers_post")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_roots", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert tool.description == "Search the web for results."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("simple_sample", {"message": "Hello, world!"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
call_tool_result = await client.call_tool("sample_with_fallback")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("sample_with_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("math_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("research", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("validate_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("check_result", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_step", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_step", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_step", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_step", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("multi_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_unknown", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_exception", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("pid")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("pid")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("pid")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await proxy.call_tool("pid")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await proxy.call_tool("pid")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("pid")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet_with_progress", {"name": "Alice"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("elicit")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("short", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert result.description == "Example greeting prompt."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("api_get_data", {"query": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("service_provider_compute", {"input": 21})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("api_get_data", {"query": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
tool_result = await client.call_tool("sub_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("shared_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("api_shared_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert by_name["execute"].description == "Custom execute description"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "square number"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "get_schema", {"tools": ["square"], "detail": "full"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "get_schema", {"tools": ["square"]})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "get_schema", {"tools": ["nonexistent"]})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "get_schema", {"tools": ["square", "nonexistent"]})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "list_all", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "square", "detail": "detailed"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "square"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "secret"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "protected"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "tags", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "tags", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "tags", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "tags", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "tags", {"detail": "full"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "tags", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "add hello", "tags": ["math"]})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "add", "tags": ["nonexistent"]})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "add hello"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "ping add", "tags": ["untagged"]})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "square"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "get_schema", {"tools": []})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "add numbers"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "add numbers"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "numbers", "limit": 1})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "search", {"query": "tool"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "list_tools", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "list_tools", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "list_tools", {"detail": "full"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await _run_tool(mcp, "list_tools", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await github_client_with_mock.call_tool("get_protected_data", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await github_client_with_mock.call_tool("get_user_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await streamable_http_client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("slow_tool", {"duration": 6})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert result.description == "A greeting prompt"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert mcp_result.description == "Test"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert decorated.__fastmcp__.description == "Analyzes topics"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert resource.description == "test file"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert resource.description == "test function"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert decorated.__fastmcp__.description == "Gets app configuration"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("admin_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_headers_tool")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_headers_tool")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("check_excluded_headers")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("child_add", {"a": 5, "b": 3})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {"x": 42})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("add", {"a": 1, "b": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("add", {"a": 1, "b": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("add", {"a": 1, "b": 2}, run_middleware=False)Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("allowed_tool", {"x": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("public_tool", {"x": 10})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("read_it")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("hello")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("quick_action", {"message": "after_wait"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("small_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("large_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("limited_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("unlimited_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("any_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("large_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("multi_block", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("binary_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp_server.call_tool("big_answer", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await middleware.on_call_tool(context, mock_call_next)
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert multiply_tool.description == "Multiply two numbers."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
power_result = await client.call_tool("power", {"a": 2, "b": 3})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
modulo_result = await client.call_tool("modulo", {"a": 10, "b": 3})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await main_app.call_tool("sub_dynamic_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await root.call_tool("middle_multiply", {"a": 3, "b": 4})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await root.call_tool("middle_leaf_add", {"a": 5, "b": 7})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await root.call_tool("l1_l2_l3_deep_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await main.call_tool("prefix_renamed", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("sub_my_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await parent.call_tool("allowed_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await main_app.call_tool("sub_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await main_app.call_tool("sub_greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await main_app.call_tool("sub_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
tool_result = await main_app.call_tool("sub_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("working_working_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await main_app.call_tool("shared_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await main_app.call_tool("api_shared_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await main_app.call_tool("proxy_get_data", {"query": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await main_app.call_tool("proxy_dynamic_data", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("tool_with_context", {"x": 42})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("async_tool", {"x": 42})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("no_context", {"x": 21})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("tool_with_resource", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("MyTool", {"x": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("decorated_tool", {"query": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert tool.description == "Add two numbers"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add", {"x": 1, "y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add", {"x": 1, "y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("custom-add", {"x": 1, "y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add", {"y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add", {"y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add", {"x": 1, "y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add", {"x": 1, "y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add", {"y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add", {"x": 1, "y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add_v1", {"x": 1, "y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("custom_multiply", {"a": 5, "b": 3})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("direct_call_tool", {"x": 5, "y": 3})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("string_named_tool", {"x": 42})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("string_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("bytes_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("uuid_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("path_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("datetime_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("image_tool", {"path": str(image_path)})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("audio_tool", {"path": str(audio_path)})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("file_tool", {"path": str(file_path)})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await tool_server.call_tool("mixed_content_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await tool_server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await tool_server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await tool_server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("f", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("f", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("simple_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("explicit_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("primitive_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("complex_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("dataclass_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("mixed_output", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("list_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("dict_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("edge_case_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("alias_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("process_image", {"image": b"fake png data"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add_one", {"x": "42"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("toggle", {"flag": "true"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("toggle", {"flag": "false"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("analyze", {"x": "a"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("analyze", {"x": "red"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("analyze", {"x": 1})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("analyze", {"x": 1.0})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("send_path", {"path": str(test_path)})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("send_uuid", {"x": test_uuid})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("send_datetime", {"x": dt})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("send_datetime", {"x": "2021-01-01T00:00:00"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("send_date", {"x": datetime.date.today()})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("send_date", {"x": "2021-01-01"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("send_timedelta", {"x": 1000})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp_client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp_client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp_client.call_tool("get_user", {"id": 1})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp_client.call_tool("get_user", {"id": 1})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_roots", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("sampling", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("elicit", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("elicit", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("elicit_with_defaults", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "Test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "Test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "Test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("add_transformed", {"a": 1, "b": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
proxy_result = await client.call_tool("add", {"a": 1, "b": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("tool_with_meta", {"value": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "Marvin", "extra": "abc"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await proxy.call_tool("greet", {"name": "Alice"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("stateful_get", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("c_gc_compute", {"x": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert tool.description == "New description"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("add", {"a": 2, "b": 3})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("duplicate_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert prompt.description == "A custom description"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert resources[0].description == "Data resource"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert templates[0].description == "Template description"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert provider.skill_info.description == "A test skill"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert simple_skill.description == "A simple test skill"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert main_resource.description == "My Skill Title"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert main_resource.description == "First occurrence"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("renamed", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("short", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert result[0].description == "Search the web."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert tool.description == "Search the web."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert tool.description == "Search the internet"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert tool.description == "Async search."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert sdk_tool.description == "Search the web."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert sampling_tool.description == "Search the web."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert sampling_tool.description == "Search the internet"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert sampling_tool.description == "Original tool."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("custom_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("custom_forbidden", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("count_to_ten", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("forbidden_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("optional_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("simple_tool", {"x": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("task_enabled_tool", {"x": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("auto_key_tool", {}, task=True)Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("immediate_tool", {"x": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer_tool", {"x": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("inner_tool", {"x": x})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer_tool", {"x": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer_tool", {"x": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("child_optional_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("child_forbidden_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await parent.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await parent.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("outer", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("add_numbers", {"a": 5, "b": 3})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("sync_only_tool", {"message": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
immediate_result = await client.call_tool(tool_name)
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("simple_tool", {"message": "hello"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await parent.call_tool("child_child_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_transport", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_transport", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_transport", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("fetch_data", {"query": "users"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("greet_user", {"name": "Alice"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("query_db", {"sql": "SELECT * FROM users"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("call_api", {"endpoint": "users"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("use_context", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("use_both_contexts", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_request_id", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("process_data", {"value": 100})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("tool_with_cached_dep", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("mixed_deps", {"value": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("query_data", {"query": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("validated_tool", {"age": 25})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("query_sync", {"query": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("check_permission", {"action": "read"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("my_tool", {}, raise_on_error=False)Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("tool_with_optional_context", {"name": "x"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("tool_with_context", {"name": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("tool_with_annotated_ctx", {"name": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("static_tool", {"name": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("CallableTool", {"x": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("add_numbers", {"a": "10", "b": "20"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("multiply", {"x": "5", "y": "3"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("create_user", {"profile": stringified})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("process_optional", {"value": None})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("toggle", {"enabled": "true"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("toggle", {"enabled": "false"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("sum_numbers", {"numbers": ["1", "2", "3"]})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await base_server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await base_server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await base_server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await base_server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await base_server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("test_tool", {"a": 1, "b": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("hello_world", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("regular_tool", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("check_docket", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("check_worker", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("schedule_work", {"task_name": "test-task"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("check_both", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_db_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_info", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_both", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_all", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_context", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_context", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_context", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("activate_finance", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("deactivate_internal", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("check_rules", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert tool.description == "My endpoint"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("transformed_tool", {"message": "test"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("count_tools", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("read_catalog", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("read_catalog", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("read_catalog", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("read_catalog", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_prompts", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_prompts", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_prompts", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_prompt", {"name": "simple_prompt"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_prompts", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_resources", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_resources", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_resources", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_resources", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("read_resource", {"uri": "config://app"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("read_resource", {"uri": "data://binary"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_resources", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_resources", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("read_resource", {"uri": "test://open"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("list_resources", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
tool_a.description = "find records in the database"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
tool_b.description = "send an email to a recipient"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": "delete"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("search_tools", {"pattern": "delete"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("search_tools", {"pattern": "delete"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("search_tools", {"pattern": "delete"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": "add"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": "email"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": "record_id"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": "recipient"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": "add|multiply"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": "ADD"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": "[invalid"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": ".*"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": "zzz_nonexistent"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"pattern": "add"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"query": "database"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"query": "number"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"query": "zzz_nonexistent_xyz"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"query": "weather forecast"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"query": "weather forecast"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"query": ""})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("search_tools", {"query": "add numbers"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("calculate", {"x": 3, "y": 4})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("calc", {"x": 5}, version=version)Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("count", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await parent.call_tool("child_double", {"x": 5})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("add", {"x": 1, "y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("calc", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "Alice"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "Alice"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "Alice"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert tools[0].description == "Shows data"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("contacts___save", {"name": "alice"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("save", {"name": "bob"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("crm___save_contact", {"name": "alice"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("crm_save_contact", {"name": "bob"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await outer.call_tool("deep___hidden", {"x": "found"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await server.call_tool("contacts___save", {"name": "alice"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
backend_result = await server.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_server_log_test", {"message": "test 42"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_server_elicit_test", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert decorated.__fastmcp__.description == "Greets people"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("simple_with_context", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("optional_context", {"name": "World"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("union_with_context", {"value": 42})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("returns_image", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("async_with_context", {})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("literal_with_context", {"mode": "fast"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("modern_union_tool", {"value": "hello"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("modern_union_tool", {"value": 42})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("modern_union_tool", {"value": None})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("quick_async_tool")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("quick_sync_tool")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("fast_async_tool")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await mcp.call_tool("fast_sync_tool")Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_user_info", {"user_id": "123"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("get_profile", {"user_id": "456"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("test_tool", {"unstructured": "test data"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool(
Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert tool.description == "Custom description"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert tool.description == "Add two numbers."
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("new_add", {"x": 1, "y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert transformed.description == "Original description"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert transformed.description == "New description"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert transformed.description == "Added description"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert new_tool.description == add_tool.description
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert transformed.parent_tool.description == "Custom description"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("find_items", {"query": "hello", "limit": 3})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("add_transformed", {"new_x": 1, "old_y": 2})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert param.description == "Filter criteria"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert request_body.description == "User data"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert response.description == "Success response"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert response.description == "User created"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert route.description == "Update user by ID"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert reconstructed_param.description == original_param.description
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.
result = await client.call_tool("greet", {"name": "world"})Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert component.description == "A fully configured component"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert new_component.description == component.description
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert updated_component.description == "New Description" # Updated
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert component.description == "Original Description"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert by_name["pdf-processing"].description == "Process PDF documents"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.
assert by_name["code-review"].description == "Review code for quality"
Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
Take a screenshot of the user's screen and return it as an image.
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
# Capture and compress the screenshot to stay under size limits
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
screenshot = pyautogui.screenshot()
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
screenshot = pyautogui.screenshot()
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
screenshot.convert("RGB").save(buffer, format="JPEG", quality=60, optimize=True)Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
screenshot = pyautogui.screenshot()
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
screenshot = pyautogui.screenshot()
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
small = screenshot.resize((100, 100), PILImage.Resampling.LANCZOS)
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
"entrypoint": "screenshot.py",
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
Give Claude a tool to capture and view screenshots.
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
# Dependencies are configured in screenshot.fastmcp.json
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
def take_screenshot() -> Image:
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
Take a screenshot of the user's screen and return it as an image. Use
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
screenshot = pyautogui.screenshot()
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
screenshot = pyautogui.screenshot()
Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.
screenshot.convert("RGB").save(buffer, format="JPEG", quality=60, optimize=True)Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.
Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.
await snapshot.save(docket, session_id, server_task_id, ttl_seconds)
Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.
Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.
"SELECT * FROM tools WHERE name = ? AND enabled = 1", (name,)
Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.
Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.
rows = await self.db.fetch("SELECT * FROM tools")Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.
Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.
row = await self.db.fetchone("SELECT * FROM tools WHERE name = ?", name)Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.
Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.
rows = await self.db.fetch("SELECT * FROM tools")Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.
Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.
row = await self.db.fetchone("SELECT * FROM tools WHERE name = ?", name)Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.
Detected DEBUG=true or similar debug flags that may be active in production. Debug mode often enables verbose logging, detailed error messages, and development-only endpoints.
return "debug=true"
Ensure debug mode is disabled in production. Use environment-based configuration to control debug settings.
Detected DEBUG=true or similar debug flags that may be active in production. Debug mode often enables verbose logging, detailed error messages, and development-only endpoints.
text='{"contents":[{"content":"debug=true","mime_type":"text/plain","meta":null}],"meta":null}',Ensure debug mode is disabled in production. Use environment-based configuration to control debug settings.
Detected DEBUG=true or similar debug flags that may be active in production. Debug mode often enables verbose logging, detailed error messages, and development-only endpoints.
{"content": "debug=true", "mime_type": "text/plain", "meta": None}Ensure debug mode is disabled in production. Use environment-based configuration to control debug settings.
Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.
result = await mcp.call_tool("query_db", {"sql": "SELECT * FROM users"})Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.
Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.
"Executing 'SELECT * FROM users' on db_connection"
Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.
Backslash-based directory traversal patterns targeting Windows file systems.
print(result[0].text[:500] + "...\n")
Normalize path separators and apply traversal checks for both forward and backslashes.
Using Python's open() with variable paths without validation enables path traversal.
webbrowser.open(f"http://localhost:{port}/callback?code=test123&state=xyz")Validate and sanitize file paths using os.path.realpath() and check against allowed directories.
Backslash-based directory traversal patterns targeting Windows file systems.
f" ...\n\n"
Normalize path separators and apply traversal checks for both forward and backslashes.
Backslash-based directory traversal patterns targeting Windows file systems.
f" ...\n\n"
Normalize path separators and apply traversal checks for both forward and backslashes.
Backslash-based directory traversal patterns targeting Windows file systems.
f" ...\n\n"
Normalize path separators and apply traversal checks for both forward and backslashes.
Null bytes in file paths can truncate path validation and access unintended files.
data = base64.b64encode(b"\x00\x01\x02\xff").decode()
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
data = b"\x00\x01\x02\xff"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
content=b"\x00\x01\x02",
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
assert result.content == b"\x00\x01\x02"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
content=b"\x00\x01\x02",
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
assert mcp_content.blob == "AAEC" # base64 of \x00\x01\x02
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
content = ResourceContent(b"\x00\x01\x02")
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
assert content.content == b"\x00\x01\x02"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
content=b"\x00\x01\x02", mime_type="application/octet-stream"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
assert mcp_content.blob == "AAEC" # base64 of \x00\x01\x02
Strip null bytes from all file path inputs before processing.
Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.
arguments={"password": "secret", "path": "../../etc/passwd"},Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.
Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.
assert "../../etc/passwd" not in key
Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.
Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.
uri=AnyUrl("file:///tmp/../../etc/shadow?token=abcd")Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.
Null bytes in file paths can truncate path validation and access unintended files.
content=b"\x00\x01\x02",
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
assert result.contents[0].content == b"\x00\x01\x02"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
return b"\x00\x01\x02\x03"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
assert decoded == b"\x00\x01\x02\x03"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Null bytes in file paths can truncate path validation and access unintended files.
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
Strip null bytes from all file path inputs before processing.
Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.
"../../../etc/passwd",
Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.
Direct access to sensitive files like /etc/passwd, /etc/shadow, or SSH keys indicates potential data exfiltration.
assert "/etc/passwd" not in url
Remove direct references to sensitive system files. Use a restricted file access layer.
URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.
"..%2F..%2Fadmin",
URL-decode paths before validation. Apply path traversal checks after full decoding.
URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.
"..%2F..%2Fadmin",
URL-decode paths before validation. Apply path traversal checks after full decoding.
URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.
"..%2f..%2fadmin",
URL-decode paths before validation. Apply path traversal checks after full decoding.
URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.
"..%2f..%2fadmin",
URL-decode paths before validation. Apply path traversal checks after full decoding.
URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.
assert "%2E%2E%2Fadmin" in url or "%2e%2e%2fadmin" in url
URL-decode paths before validation. Apply path traversal checks after full decoding.
URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.
assert "%2E%2E%2Fadmin" in url or "%2e%2e%2fadmin" in url
URL-decode paths before validation. Apply path traversal checks after full decoding.
URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.
{"id": "..%2F..%2Fadmin"},URL-decode paths before validation. Apply path traversal checks after full decoding.
URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.
{"id": "..%2F..%2Fadmin"},URL-decode paths before validation. Apply path traversal checks after full decoding.
Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.
"../../../etc/passwd",
Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.
Detected a catch block that returns, continues, or breaks without logging the error or rethrowing. Silently discarding errors hinders incident response and forensic analysis.
try { data = JSON.parse(data); } catch(e) { return; }Add error logging before returning, continuing, or breaking inside catch blocks. Ensure all errors are recorded for audit and debugging.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def log_request(self, body: dict[str, Any]) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def log_response(self, body: dict[str, Any]) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def log_bridge(self, body: dict[str, Any]) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def _log_response_bytes(log: _MessageLog, raw: bytes, content_type: str) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
#mcp-log-panel.hidden { display: none; }Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
.log-seg button:last-child { border-right: none; }Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
<script>if (window.location.pathname === "/") document.getElementById("mcp-log-reset").style.display = "none";</script>Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_level: LogLevelType | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_handler: LogHandler | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
if log_handler is None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def set_logging_level(self, level: mcp.types.LoggingLevel) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
LogHandler: TypeAlias = Callable[[LogMessage], Awaitable[None]]
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def default_log_handler(message: LogMessage) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def create_log_callback(handler: LogHandler | None = None) -> LoggingFnT:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def log_callback(params: LoggingMessageNotificationParams) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
access_log=False,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logging_callback: LoggingFnT | None
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_file: Path | TextIO | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_file: Path | TextIO | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
if log_file is None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_file: Path | TextIO | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_file: Path | TextIO | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_file: Path | TextIO | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logo_uri: AnyHttpUrl | None = Field(
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger.debug("Token validation failed: callable returned False")Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
self.logger.debug("Token introspection returned active=false")Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
level: LoggingLevel | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger_name: str | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger_name: str | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger_name: str | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger_name: str | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger_name: str | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger_name: str | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback: TracebackType | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
self._minimum_logging_level: LoggingLevel | None = None
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: logging.Logger | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
include_traceback: bool = False,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: Logger instance for error logging. If None, uses 'fastmcp.errors'
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def _log_error(self, error: Exception, context: MiddlewareContext) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: logging.Logger | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
self, message: dict[str, str | int | float], log_level: int | None = None
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: logging.Logger | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: Logger instance to use. If None, creates a logger named 'fastmcp.requests'
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
methods: List of methods to log. If None, logs all methods.
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
self.structured_logging: bool = False
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: logging.Logger | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: Logger instance to use. If None, creates a logger named 'fastmcp.structured'
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
methods: List of methods to log. If None, logs all methods.
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
self, logger: logging.Logger | None = None, log_level: int = logging.INFO
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: Logger instance to use. If None, creates a logger named 'fastmcp.timing'
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
self, logger: logging.Logger | None = None, log_level: int = logging.INFO
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: Logger instance to use. If None, creates a logger named 'fastmcp.timing.detailed'
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def _set_logging_level_mcp(self, level: mcp.types.LoggingLevel) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_level: str | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_level: str | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def default_proxy_log_handler(message: LogMessage) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def __aexit__(self, exc_type, exc_value, traceback) -> None: # type: ignore[override] # ty:ignore[invalid-method-override]
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
class _SuppressUnlistedToolWarning(logging.Filter):
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
client_log_level: mcp.types.LoggingLevel | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
self.client_log_level: mcp.types.LoggingLevel | None = (
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
if client_log_level is not None
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def _get_parent_trace_context() -> Context | None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
f"_catalog_bypass_{self._instance_id}", default=FalseEnsure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
If True, will use rich formatting for log output. If False,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
MCP_LOG_LEVEL | None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def get_tracer(version: str | None = None) -> Tracer:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
or None if no trace context to inject and meta was None
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def extract_trace_context(meta: dict[str, Any] | None) -> Context:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def log_server_banner(server: FastMCP[Any]) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: logging.Logger | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
enable_rich_tracebacks: bool | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
# Check if logging is disabled in settings
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
if enable_rich_tracebacks is None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
if logger is None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger.propagate = False
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
# Use standard logging handlers if rich logging is disabled
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
traceback_handler.addFilter(lambda record: record.exc_info is not None)
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: logging.Logger | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
enable_rich_tracebacks: bool | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def _unclamp_logger(logger: logging.Logger) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_level: Literal["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"] | None = Field(
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger.error(f"Failed to extract schema as dict: {e}", exc_info=False)Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger.error(f"Failed to extract schema as dict: {e}", exc_info=False)Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def create_logo(icon_url: str | None = None, alt_text: str = "FastMCP") -> str:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
"trace_id": getattr(meta, "trace_id", None),
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
assert result_no_meta.data.get("trace_id") is NoneEnsure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def handle_log(self, message: LogMessage) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def log(context: Context) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
level: LoggingLevel | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger: str | None = None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
message: str, context: Context, level: LoggingLevel | None = None
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
message: str, context: Context, level: LoggingLevel | None = None
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
"""Test that default_log_handler works when logger name is None."""
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger=None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
logger=None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def test_log_file_none_uses_default_behavior(
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
"""Test that log_file=None uses default stderr handling"""
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
script_path=stdio_script_with_stderr, log_file=None
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
FastMCP loggers have propagate=False by default, which prevents messages from
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
tuple[TracerProvider, InMemorySpanExporter], None, None
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def test_get_tags_empty_catalog() -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def test_search_shows_catalog_size_when_results_are_subset() -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def test_list_tools_empty_catalog() -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
"logo_uri": None,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
assert middleware.include_traceback is False
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
caplog: pytest.LogCaptureFixture, module: str | None = None
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def log_tool(context: Context) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def log_tool(context: Context) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def log_tool(context: Context) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_handler_called = False
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def log_handler(message: LogMessage) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def log_handler_a(message: LogMessage) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def log_handler_b(message: LogMessage) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def log_handler_a(message: LogMessage) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def log_handler_b(message: LogMessage) -> None:
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
server.run_stdio_async(log_level="DEBUG", show_banner=False),
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
log_level="INFO", show_banner=False, host="127.0.0.1", port=8000
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
"disable_existing_loggers": False,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
"disable_existing_loggers": False,
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
async def read_catalog(ctx: Context = None) -> list[str]: # type: ignore[assignment] # ty:ignore[invalid-parameter-default]
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
"""get_tool_catalog() respects visibility (disabled tools are excluded)."""
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
ctx = extract_trace_context(None)
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
def test_configure_logging_with_rich_disabled():
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
fastmcp.settings.enable_rich_logging = False
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.
# Should only have one handler when rich logging is disabled
Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.
Dynamic imports with variable URLs can load malicious code at runtime.
result = discover_and_import(self._root)
Use static imports only. Do not dynamically import modules from variable paths.
Dynamic imports with variable URLs can load malicious code at runtime.
def discover_and_import(root: Path) -> DiscoveryResult:
Use static imports only. Do not dynamically import modules from variable paths.
Registering a tool with a name that collides with common system commands (bash, shell, exec, eval, etc.) can shadow built-in tools and intercept agent operations.
name="run",
Rename the tool to a unique, descriptive name that does not collide with system commands.
Dynamic imports with variable URLs can load malicious code at runtime.
def test_import_with_relative_import(self, tmp_path: Path):
Use static imports only. Do not dynamically import modules from variable paths.
Dynamic imports with variable URLs can load malicious code at runtime.
# Create package with relative import (use unique name to avoid module caching)
Use static imports only. Do not dynamically import modules from variable paths.
Dynamic imports with variable URLs can load malicious code at runtime.
result = discover_and_import(tmp_path)
Use static imports only. Do not dynamically import modules from variable paths.
Dynamic imports with variable URLs can load malicious code at runtime.
result = discover_and_import(tmp_path)
Use static imports only. Do not dynamically import modules from variable paths.
Dynamic imports with variable URLs can load malicious code at runtime.
result = discover_and_import(tmp_path)
Use static imports only. Do not dynamically import modules from variable paths.
Dynamic imports with variable URLs can load malicious code at runtime.
def test_syspath_not_polluted_after_import(self, tmp_path: Path):
Use static imports only. Do not dynamically import modules from variable paths.
Dynamic imports with variable URLs can load malicious code at runtime.
def test_syspath_not_polluted_after_package_import(self, tmp_path: Path):
Use static imports only. Do not dynamically import modules from variable paths.
Dynamic imports with variable URLs can load malicious code at runtime.
def test_icon_import(self):
Use static imports only. Do not dynamically import modules from variable paths.
String literals matching known API key prefixes (sk-, ghp_, AKIA, xoxb-, etc.) or long base64-like strings may expose secrets in source code.
"nGP4z8BQDwAEgAF/pooBPQAAAABJRU5ErkJggg=="
Remove hardcoded secrets from source code. Use environment variables or a secrets manager.
An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.
s.listen(1)
Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.
An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.
s.listen(1)
Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.
An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.
s.listen(1)
Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.
Python's exec() function executes arbitrary code strings and is a vector for code injection.
exec(wrapped, namespace, namespace)
Remove exec() calls. Use ast.literal_eval for safe expression evaluation.