MCP Scanner
ScanLeaderboardDocsSign in
Home/jlowin/fastmcp/Results
0F

fastmcp

jlowin/fastmcp

776 files · 2275 findings

Share GitHub SARIF JSON
225 critical1659 high391 medium
Tool Poisoning1 issue
Command Injection2 issues
Path Traversal56 issues
SSRF627 issues
Credential Theft2 issues
Excessive Permissionsclean
Missing Auth239 issues
Missing Auth239

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

.github/actions/run-claude/action.yml:10
#       claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Supply Chain51

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/actions/run-claude/action.yml:81
uses: anthropics/claude-code-action@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

SSRF627

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/apps/approvals/approvals_server.py:159
req = _find_request(request_id)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Shadow MCP Server533

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/approvals/approvals_server.py:6
- @app.tool(model=True) for tools accessible from both model and UI
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Runtime Tool Poisoning582

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:58
result = await client.call_tool("search", {"query": "Bluesky", "limit": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Data Exfiltration18

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/fastmcp_config_demo/server.py:20
def take_screenshot() -> Image:
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Excessive Data Exposure11

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

examples/providers/sqlite/server.py:81
async with db.execute("SELECT * FROM tools WHERE enabled = 1") as cursor:
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Path Traversal56

Windows-style path traversal patterns

high

Backslash-based directory traversal patterns targeting Windows file systems.

examples/skills/client.py:50
print(result[0].text[:500] + "...\n")
How to fix

Normalize path separators and apply traversal checks for both forward and backslashes.

Logging Deficiency137

Empty catch blocks swallowing errors

medium

Detected catch blocks with empty bodies. Empty catch blocks silently swallow errors, making it impossible to diagnose failures, detect attacks, or audit security-relevant events.

src/fastmcp/cli/apps_dev.py:883
.catch(function() {})
How to fix

Always handle or log errors in catch blocks. At minimum, log the error for debugging and auditing purposes.

Rug Pull12

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

src/fastmcp/client/mixins/tools.py:383
# avoid a circular import (client.client -> mixins.tools -> client.client),
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Credential Theft2

Hardcoded API key or token literal

critical

String literals matching known API key prefixes (sk-, ghp_, AKIA, xoxb-, etc.) or long base64-like strings may expose secrets in source code.

tests/conformance/server.py:26
"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR4"
How to fix

Remove hardcoded secrets from source code. Use environment variables or a secrets manager.

Insecure Communication4

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

tests/conformance/test_conformance.py:26
s.listen(1)
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Tool Poisoning1

Cross-tool shadowing of system commands

high

Tool names mimicking built-in system tools (e.g., 'bash', 'shell', 'terminal') can trick the LLM into routing actions to a malicious handler.

tests/experimental/transforms/test_code_mode.py:456
discovery_tools=[Search(name="execute")],
How to fix

Rename the tool to avoid colliding with system commands (bash, shell, exec, etc.).

Command Injection2

Python exec() call

critical

Python's exec() function executes arbitrary code strings and is a vector for code injection.

tests/experimental/transforms/test_code_mode.py:85
exec(wrapped, namespace, namespace)
How to fix

Remove exec() calls. Use ast.literal_eval for safe expression evaluation.

Supply Chain
51 issues
Rug Pull12 issues
Data Exfiltration18 issues
Insecure Communication4 issues
Excessive Data Exposure11 issues
Logging Deficiency137 issues
Runtime Tool Poisoning582 issues
Shadow MCP Server533 issues

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

.github/actions/run-claude/action.yml:27
claude-oauth-token:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

.github/actions/run-claude/action.yml:28
description: "Claude Code OAuth token for authentication"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

.github/actions/run-claude/action.yml:84
claude_code_oauth_token: ${{ inputs.claude-oauth-token }}
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

.github/workflows/martian-test-failure.yml:159
"GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

.github/workflows/martian-triage-issue.yml:50
claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

.github/workflows/marvin-comment-on-issue.yml:55
claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

.github/workflows/marvin-comment-on-pr.yml:76
claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/authkit_dcr/client.py:1
"""OAuth client example for connecting to FastMCP servers.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/authkit_dcr/client.py:3
This example demonstrates how to connect to an OAuth-protected FastMCP server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/authkit_dcr/client.py:12
from fastmcp.client.auth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/authkit_dcr/client.py:21
auth = OAuth(additional_client_metadata={"token_endpoint_auth_method": "none"})
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/aws_oauth/client.py:1
"""OAuth client example for connecting to FastMCP servers.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/aws_oauth/client.py:3
This example demonstrates how to connect to an OAuth-protected FastMCP server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/aws_oauth/client.py:18
async with Client(SERVER_URL, auth="oauth") as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/aws_oauth/server.py:1
"""AWS Cognito OAuth server example for FastMCP.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/aws_oauth/server.py:22
from fastmcp.server.dependencies import get_access_token
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/aws_oauth/server.py:38
mcp = FastMCP("AWS Cognito OAuth Example Server", auth=auth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/aws_oauth/server.py:50
token = get_access_token()
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/azure_oauth/client.py:1
"""OAuth client example for connecting to FastMCP servers.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/azure_oauth/client.py:3
This example demonstrates how to connect to an OAuth-protected FastMCP server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/azure_oauth/client.py:18
async with Client(SERVER_URL, auth="oauth") as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/clerk_oauth/client.py:1
"""OAuth client example for connecting to a Clerk-protected FastMCP server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/clerk_oauth/client.py:3
This example demonstrates how to connect to an OAuth-protected FastMCP server
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/clerk_oauth/client.py:19
async with Client(SERVER_URL, auth="oauth") as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/discord_oauth/client.py:1
"""Discord OAuth client example for connecting to FastMCP servers.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/discord_oauth/client.py:3
This example demonstrates how to connect to a Discord OAuth-protected FastMCP server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/discord_oauth/client.py:18
async with Client(SERVER_URL, auth="oauth") as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/discord_oauth/server.py:1
"""Discord OAuth server example for FastMCP.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/discord_oauth/server.py:3
This example demonstrates how to protect a FastMCP server with Discord OAuth.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/discord_oauth/server.py:6
- FASTMCP_SERVER_AUTH_DISCORD_CLIENT_ID: Your Discord OAuth app client ID
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/discord_oauth/server.py:7
- FASTMCP_SERVER_AUTH_DISCORD_CLIENT_SECRET: Your Discord OAuth app client secret
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/discord_oauth/server.py:25
mcp = FastMCP("Discord OAuth Example Server", auth=auth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/github_oauth/client.py:1
"""OAuth client example for connecting to FastMCP servers.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/github_oauth/client.py:3
This example demonstrates how to connect to an OAuth-protected FastMCP server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/github_oauth/client.py:11
from fastmcp.client import Client, OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/github_oauth/client.py:18
async with Client(SERVER_URL, auth=OAuth()) as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/github_oauth/server.py:1
"""GitHub OAuth server example for FastMCP.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/github_oauth/server.py:3
This example demonstrates how to protect a FastMCP server with GitHub OAuth.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/github_oauth/server.py:6
- FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID: Your GitHub OAuth app client ID
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/github_oauth/server.py:7
- FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET: Your GitHub OAuth app client secret
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/github_oauth/server.py:25
mcp = FastMCP("GitHub OAuth Example Server", auth=auth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/google_oauth/client.py:1
"""OAuth client example for connecting to FastMCP servers.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/google_oauth/client.py:3
This example demonstrates how to connect to an OAuth-protected FastMCP server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/google_oauth/client.py:18
async with Client(SERVER_URL, auth="oauth") as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/client.py:1
"""Mounted OAuth servers client example for FastMCP.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/client.py:3
This example demonstrates connecting to multiple mounted OAuth-protected MCP servers.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/client.py:21
async with Client(GITHUB_URL, auth="oauth") as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/client.py:36
async with Client(GOOGLE_URL, auth="oauth") as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:1
"""Mounted OAuth servers example for FastMCP.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:3
This example demonstrates mounting multiple OAuth-protected MCP servers in a single
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:10
- GitHub discovery: http://localhost:8000/.well-known/oauth-authorization-server/api/mcp/github
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:11
- Google discovery: http://localhost:8000/.well-known/oauth-authorization-server/api/mcp/google
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:14
- FASTMCP_SERVER_AUTH_GITHUB_CLIENT_ID: Your GitHub OAuth app client ID
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:15
- FASTMCP_SERVER_AUTH_GITHUB_CLIENT_SECRET: Your GitHub OAuth app client secret
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:16
- FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_ID: Your Google OAuth client ID
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:17
- FASTMCP_SERVER_AUTH_GOOGLE_CLIENT_SECRET: Your Google OAuth client secret
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:37
# --- GitHub OAuth Server ---
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:57
return "This is the GitHub OAuth protected MCP server"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:60
# --- Google OAuth Server ---
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:80
return "This is the Google OAuth protected MCP server"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:93
# - /.well-known/oauth-authorization-server/api/mcp/github
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:94
# - /.well-known/oauth-authorization-server/api/mcp/google
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:109
print("Starting mounted OAuth servers...")
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:115
f"  GitHub:  {ROOT_URL}/.well-known/oauth-authorization-server{API_PREFIX}/github"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/mounted/server.py:118
f"  Google:  {ROOT_URL}/.well-known/oauth-authorization-server{API_PREFIX}/google"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/propelauth_oauth/client.py:1
"""OAuth client example for connecting to PropelAuth-protected FastMCP servers.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/propelauth_oauth/client.py:3
This example demonstrates how to connect to a PropelAuth OAuth-protected FastMCP server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/propelauth_oauth/client.py:18
async with Client(SERVER_URL, auth="oauth") as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/scalekit_oauth/client.py:1
"""OAuth client example for connecting to Scalekit-protected FastMCP servers.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/scalekit_oauth/client.py:3
This example demonstrates how to connect to a Scalekit OAuth-protected FastMCP server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/scalekit_oauth/client.py:18
async with Client(SERVER_URL, auth="oauth") as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/workos_oauth/client.py:1
"""OAuth client example for connecting to FastMCP servers.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/workos_oauth/client.py:3
This example demonstrates how to connect to an OAuth-protected FastMCP server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/workos_oauth/client.py:18
async with Client(SERVER_URL, auth="oauth") as client:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/workos_oauth/server.py:1
"""WorkOS OAuth server example for FastMCP.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/workos_oauth/server.py:3
This example demonstrates how to protect a FastMCP server with WorkOS OAuth.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/auth/workos_oauth/server.py:27
mcp = FastMCP("WorkOS OAuth Example Server", auth=auth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/tags_example.py:19
@app.get("/users", tags=["users", "public"])
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/tags_example.py:25
@app.post("/users", tags=["users", "admin"])
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/tags_example.py:31
@app.get("/admin/stats", tags=["admin", "internal"])
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/tags_example.py:37
@app.get("/health", tags=["public"])
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/tags_example.py:43
@app.get("/metrics")
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/tags_example.py:25
@app.post("/users", tags=["users", "admin"])
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/text_me.py:56
"Authorization": f"Bearer {surge_settings.api_key}",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/cli/client.py:236
Applies ``auth='oauth'`` automatically for HTTP-based targets unless
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/cli/client.py:247
effective_auth = "oauth"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/cli/client.py:691
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/cli/client.py:691
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/cli/client.py:847
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/cli/client.py:847
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/cli/generate.py:701
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/cli/generate.py:701
help="Auth method: 'oauth', a bearer token string, or 'none' to disable",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/__init__.py:1
from .auth import OAuth, BearerAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/__init__.py:23
"OAuth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/auth/__init__.py:1
from .bearer import BearerAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/auth/__init__.py:2
from .oauth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/auth/__init__.py:2
from .oauth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/auth/__init__.py:4
__all__ = ["BearerAuth", "OAuth"]
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/auth/bearer.py:16
request.headers["Authorization"] = f"Bearer {self.token.get_secret_value()}"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:2
OAuth callback server for handling authorization code flows.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:4
This module provides a reusable callback server that can handle OAuth redirects
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:37
title: str = "FastMCP OAuth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:40
"""Create a styled HTML response for OAuth callbacks."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:96
"""Container for OAuth callback results, used with anyio.Event for async coordination."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:111
Create an OAuth callback server.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:115
callback_path: The path to listen for OAuth redirects on
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:140
"""Handle OAuth callback requests with proper HTML responses."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:178
# Check for missing state parameter (indicates OAuth flow issue)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:181
"The OAuth server did not return the expected state parameter."
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/oauth_callback.py:226
print("🎭 OAuth Callback Test Server")
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:19
from fastmcp.client.auth.bearer import BearerAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:20
from fastmcp.client.auth.oauth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:20
from fastmcp.client.auth.oauth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:34
auth: httpx.Auth | Literal["oauth"] | str | None = None,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:44
auth: Authentication method - httpx.Auth, "oauth" for OAuth flow,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:44
auth: Authentication method - httpx.Auth, "oauth" for OAuth flow,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:45
or a bearer token string.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:99
def _set_auth(self, auth: httpx.Auth | Literal["oauth"] | str | None):
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:101
if auth == "oauth":
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:102
resolved = OAuth(
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:107
elif isinstance(auth, OAuth):
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:109
# Only inject the transport's factory into OAuth if OAuth still
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/http.py:109
# Only inject the transport's factory into OAuth if OAuth still
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/sse.py:18
from fastmcp.client.auth.bearer import BearerAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/sse.py:19
from fastmcp.client.auth.oauth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/sse.py:19
from fastmcp.client.auth.oauth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/sse.py:32
auth: httpx.Auth | Literal["oauth"] | str | None = None,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/sse.py:66
def _set_auth(self, auth: httpx.Auth | Literal["oauth"] | str | None):
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/sse.py:68
if auth == "oauth":
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/sse.py:69
resolved = OAuth(
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/sse.py:74
elif isinstance(auth, OAuth):
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/sse.py:76
# Only inject the transport's factory into OAuth if OAuth still
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/client/transports/sse.py:76
# Only inject the transport's factory into OAuth if OAuth still
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/dependencies.py:14
CurrentAccessToken,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/dependencies.py:27
"CurrentAccessToken",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/mcp_config.py:219
str | Literal["oauth"] | httpx.Auth | None,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/mcp_config.py:221
description='Either a string representing a Bearer token, the literal "oauth" to use OAuth authentication, or an httpx.Auth instance for custom authentication.',
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/mcp_config.py:221
description='Either a string representing a Bearer token, the literal "oauth" to use OAuth authentication, or an httpx.Auth instance for custom authentication.',
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/mcp_config.py:221
description='Either a string representing a Bearer token, the literal "oauth" to use OAuth authentication, or an httpx.Auth instance for custom authentication.',
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/handlers/authorize.py:54
discovery_endpoint: URL of the OAuth metadata discovery endpoint
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/handlers/authorize.py:76
<p>Your MCP client opened this page to complete OAuth authorization,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/handlers/authorize.py:92
OAuth 2.0 requires clients to register before authorization.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/handlers/authorize.py:96
In browser-delegated OAuth flows, your application cannot
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/handlers/authorize.py:172
This maintains OAuth 2.1 compliance (returns 400 for invalid client_id)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/handlers/authorize.py:186
provider: OAuth authorization server provider
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/handlers/authorize.py:259
discovery_endpoint = f"{self._base_url}/.well-known/oauth-authorization-server"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/handlers/authorize.py:317
f'<{registration_endpoint}>; rel="http://oauth.net/core/2.1/#registration"'
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/oauth_proxy/__init__.py:1
"""OAuth Proxy Provider for FastMCP.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/oauth_proxy/__init__.py:3
This package provides OAuth proxy functionality split across multiple modules:
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/auth/redirect_validation.py:1
"""Utilities for validating client redirect URIs in OAuth flows.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/event_store.py:80
# PydanticAdapter for type-safe storage (following OAuth proxy pattern)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/server/mixins/transport.py:114
which can be useful for OAuth callbacks, health checks, or admin APIs.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/utilities/tests.py:16
from fastmcp.client.auth.oauth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/utilities/tests.py:16
from fastmcp.client.auth.oauth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/utilities/tests.py:225
class HeadlessOAuth(OAuth):
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/utilities/tests.py:225
class HeadlessOAuth(OAuth):
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/utilities/tests.py:227
OAuth provider that bypasses browser interaction for testing.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/utilities/tests.py:229
This simulates the complete OAuth flow programmatically by making HTTP requests
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/utilities/tests.py:234
"""Initialize HeadlessOAuth with stored response tracking."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/utilities/tests.py:263
f"OAuth authorization failed: {error} - {error_desc}"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/utilities/ui.py:4
This module provides reusable HTML/CSS components for OAuth callbacks,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/fastmcp/utilities/ui.py:304
# Redirect section styles (for OAuth redirect URI box)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/client/test_auth.py:7
from fastmcp.client.auth.bearer import BearerAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/client/test_auth.py:22
Client(transport=StdioTransport("echo", ["hello"]), auth="oauth")
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/client/test_auth.py:26
transport=StreamableHttpTransport("http://localhost:8000"), auth="oauth"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/client/test_auth.py:33
transport=StreamableHttpTransport("http://localhost:8000", auth="oauth"),
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/client/test_auth.py:39
client = Client(transport=SSETransport("http://localhost:8000"), auth="oauth")
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/client/test_auth.py:44
client = Client(transport=SSETransport("http://localhost:8000", auth="oauth"))
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/client/test_transport.py:71
"headers": {"Authorization": "Bearer 123"},
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/client/test_transport.py:79
assert transport.transport.headers == {"Authorization": "Bearer 123"}
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/client/test_transport.py:117
"headers": {"Authorization": "Bearer 123"},
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/test_oauth_callback_xss.py:1
"""Comprehensive XSS protection tests for OAuth callback HTML rendering."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tests/client/test_openapi.py:17
@app.get("/headers")
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tests/client/test_openapi.py:21
@app.get("/headers/{header_name}")
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

tests/client/test_openapi.py:25
@app.post("/headers")
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

tests/client/test_openapi.py:25
@app.post("/headers")
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_no_redirect.py:50
headers={"Authorization": "Bearer secret-token"},
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_no_redirect.py:85
headers={"Authorization": "Bearer secret-token"},
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_no_redirect.py:89
assert received_headers.get("authorization") == "Bearer secret-token"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_no_redirect.py:94
"Bearer my-secret-token",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_no_redirect.py:164
headers={"Authorization": "Bearer secret"},
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:10
from fastmcp.client.auth.oauth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:10
from fastmcp.client.auth.oauth import OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:20
auth="oauth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:23
assert isinstance(transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:38
auth="oauth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:41
assert isinstance(transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:135
async def test_streamable_http_verify_propagates_to_oauth(self):
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:139
auth="oauth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:141
assert isinstance(transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:148
async def test_sse_verify_propagates_to_oauth(self):
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:152
auth="oauth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:154
assert isinstance(transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:161
async def test_client_verify_propagates_to_oauth(self):
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:165
auth="oauth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:168
assert isinstance(client.transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:179
auth=OAuth(),
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:181
assert isinstance(transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:191
auth="oauth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:193
assert isinstance(transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:194
# OAuth was created without verify — factory should be default
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:201
# Now wrap in Client with verify=False — should resync OAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:203
assert isinstance(client.transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:210
async def test_client_verify_overrides_transport_verify_in_oauth(self):
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:214
auth="oauth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:216
assert isinstance(transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:217
# OAuth should initially have verify=False
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:224
# Client overrides verify to True — OAuth should update
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:226
assert isinstance(client.transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:238
auth = OAuth(httpx_client_factory=custom_factory)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/client/transports/test_transports.py:244
assert isinstance(transport.auth, OAuth)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/integration_tests/test_github_mcp_remote.py:10
from fastmcp.client.auth.bearer import BearerAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/auth/oauth_proxy/test_client_registration.py:1
"""Tests for OAuth proxy client registration (DCR)."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/auth/oauth_proxy/test_client_registration.py:8
"""Tests for OAuth proxy client registration (DCR)."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/auth/test_redirect_validation.py:1
"""Tests for redirect URI validation in OAuth flows."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/http/test_http_dependencies.py:209
"Authorization": "Bearer tenant-token",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/http/test_http_dependencies.py:217
"authorization": "Bearer tenant-token",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/providers/openapi/test_openapi_features.py:996
"Authorization": "Bearer secret-token",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:817
"""Tests for authentication dependencies (CurrentAccessToken, TokenClaim)."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:820
"""Test that CurrentAccessToken can be imported."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:821
from fastmcp.server.dependencies import CurrentAccessToken
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:823
assert CurrentAccessToken is not None
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:832
"""Test that CurrentAccessToken is a Dependency instance."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:834
from fastmcp.server.dependencies import _CurrentAccessToken
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:836
dep = _CurrentAccessToken()
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:850
"""Test that CurrentAccessToken raises when no token is available."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:851
from fastmcp.server.dependencies import _CurrentAccessToken
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:853
dep = _CurrentAccessToken()
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:866
"""Test that CurrentAccessToken dependency is excluded from tool schema."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:869
from fastmcp.server.auth import AccessToken
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:870
from fastmcp.server.dependencies import CurrentAccessToken
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:875
token: AccessToken = CurrentAccessToken(),
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:875
token: AccessToken = CurrentAccessToken(),
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:905
"""Test that CurrentAccessToken is exported from __all__."""
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/server/test_dependencies.py:908
assert "CurrentAccessToken" in dependencies.__all__
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/test_mcp_config.py:20
from fastmcp.client.auth.bearer import BearerAuth
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/test_mcp_config.py:21
from fastmcp.client.auth.oauth import OAuthClientProvider
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

tests/test_mcp_config.py:516
"auth": "oauth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/actions/setup-uv/action.yml:18
uses: astral-sh/setup-uv@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/auto-close-duplicates.yml:19
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/auto-close-duplicates.yml:23
uses: actions/create-github-app-token@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/auto-close-duplicates.yml:29
uses: astral-sh/setup-uv@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/auto-close-needs-mre.yml:19
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/auto-close-needs-mre.yml:23
uses: actions/create-github-app-token@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/auto-close-needs-mre.yml:29
uses: astral-sh/setup-uv@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/martian-test-failure.yml:26
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/martian-test-failure.yml:32
uses: actions/create-github-app-token@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/martian-test-failure.yml:38
uses: actions/setup-python@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/martian-test-failure.yml:44
uses: astral-sh/setup-uv@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/martian-test-failure.yml:171
uses: anthropics/claude-code-action@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/martian-triage-issue.yml:29
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/martian-triage-issue.yml:36
uses: actions/create-github-app-token@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-comment-on-issue.yml:28
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-comment-on-issue.yml:31
uses: astral-sh/setup-uv@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-comment-on-issue.yml:41
uses: actions/create-github-app-token@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-comment-on-pr.yml:27
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-comment-on-pr.yml:33
uses: astral-sh/setup-uv@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-comment-on-pr.yml:43
uses: actions/create-github-app-token@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-dedupe-issues.yml:24
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-dedupe-issues.yml:28
uses: actions/create-github-app-token@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-dedupe-issues.yml:80
uses: anthropics/claude-code-action@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-label-triage.yml:32
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-label-triage.yml:39
uses: actions/create-github-app-token@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/marvin-label-triage.yml:138
uses: anthropics/claude-code-action@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/minimize-resolved-reviews.yml:41
uses: strawgate/minimize-resolved-pr-reviews@v0
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/publish.yml:15
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/publish.yml:20
uses: astral-sh/setup-uv@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-static.yml:30
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-static.yml:38
uses: j178/prek-action@v2
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-tests.yml:39
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-tests.yml:61
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-tests.yml:82
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-tests.yml:90
uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-tests.yml:105
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-upgrade-checks.yml:33
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-upgrade-checks.yml:41
uses: j178/prek-action@v2
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-upgrade-checks.yml:59
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-upgrade-checks.yml:81
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/run-upgrade-checks.yml:105
uses: jayqi/failed-build-issue-action@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-config-schema.yml:26
uses: actions/create-github-app-token@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-config-schema.yml:31
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-config-schema.yml:36
uses: astral-sh/setup-uv@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-config-schema.yml:54
uses: peter-evans/create-pull-request@v8
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-sdk-docs.yml:26
uses: actions/create-github-app-token@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-sdk-docs.yml:31
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-sdk-docs.yml:36
uses: astral-sh/setup-uv@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-sdk-docs.yml:45
uses: extractions/setup-just@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-sdk-docs.yml:51
uses: peter-evans/create-pull-request@v8
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/apps/approvals/approvals_server.py:171
req = _find_request(request_id)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/apps/approvals/approvals_server.py:183
req = _find_request(request_id)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/apps/approvals/approvals_server.py:194
req = _find_request(request_id)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/authkit_dcr/client.py:14
SERVER_URL = "http://127.0.0.1:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/authkit_dcr/server.py:19
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/aws_oauth/client.py:13
SERVER_URL = "http://localhost:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/aws_oauth/server.py:34
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/azure_oauth/client.py:13
SERVER_URL = "http://127.0.0.1:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/azure_oauth/server.py:27
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/clerk_oauth/client.py:14
SERVER_URL = "http://127.0.0.1:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/clerk_oauth/server.py:24
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/discord_oauth/client.py:13
SERVER_URL = "http://127.0.0.1:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/discord_oauth/server.py:21
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/github_oauth/client.py:13
SERVER_URL = "http://localhost:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/github_oauth/server.py:21
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/google_oauth/client.py:13
SERVER_URL = "http://127.0.0.1:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/google_oauth/server.py:21
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/mounted/client.py:13
GITHUB_URL = "http://127.0.0.1:8000/api/mcp/github/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/mounted/client.py:14
GOOGLE_URL = "http://127.0.0.1:8000/api/mcp/google/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/mounted/server.py:34
ROOT_URL = "http://localhost:8000"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/propelauth_oauth/client.py:13
SERVER_URL = "http://127.0.0.1:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/propelauth_oauth/server.py:12
- BASE_URL: Public URL where the FastMCP server is exposed (defaults to `http://localhost:8000/`)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/propelauth_oauth/server.py:32
base_url=os.getenv("BASE_URL", "http://localhost:8000/"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/scalekit_oauth/client.py:13
SERVER_URL = "http://127.0.0.1:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/scalekit_oauth/server.py:11
- BASE_URL: Public URL where the FastMCP server is exposed (defaults to `http://localhost:8000/`)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/scalekit_oauth/server.py:33
base_url=os.getenv("BASE_URL", "http://localhost:8000/"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/workos_oauth/client.py:13
SERVER_URL = "http://127.0.0.1:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/auth/workos_oauth/server.py:23
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/diagnostics/client_with_tracing.py:34
endpoint = os.environ.get("OTEL_EXPORTER_OTLP_ENDPOINT", "http://localhost:4317")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/diagnostics/client_with_tracing.py:53
server_url = os.environ.get("DIAGNOSTICS_SERVER_URL", "http://localhost:8001/sse")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/diagnostics/server.py:16
ECHO_SERVER_URL = f"http://localhost:{ECHO_SERVER_PORT}/sse"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/diagnostics/server.py:51
f"http://localhost:{ECHO_SERVER_PORT}/sse", timeout=0.1
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/persistent_state/client.py:17
URL = "http://127.0.0.1:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/resources_as_tools/server.py:54
@mcp.resource("file://{directory}/{filename}")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/run_with_tracing.py:34
endpoint = os.environ.get("OTEL_EXPORTER_OTLP_ENDPOINT", "http://localhost:4317")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/cli/apps_dev.py:71
def log_request(self, body: dict[str, Any]) -> None:
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/cli/apps_dev.py:1503
message_log.log_request(item)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/cli/apps_dev.py:1505
message_log.log_request(req_json)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/cli/apps_dev.py:1703
mcp_url = f"http://localhost:{mcp_port}/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/cli/apps_dev.py:1704
dev_url = f"http://localhost:{dev_port}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/cli/cimd.py:185
doc = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/cli/cimd.py:93
fastmcp cimd create --name "My App" -r "http://localhost:*/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/client/auth/oauth.py:239
redirect_uri = f"http://localhost:{self.redirect_port}/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/client/client.py:179
client = Client("http://localhost:8080")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/client/messages.py:39
await self.on_request(message)  # type: ignore[arg-type]  # ty:ignore[invalid-argument-type]
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/client/mixins/resources.py:323
meta: Optional metadata to pass with the request (e.g., version info)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/client/oauth_callback.py:242
webbrowser.open(f"http://localhost:{port}/callback?code=test123&state=xyz")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

src/fastmcp/client/tasks.py:471
task = await client.read_resource_as_task("file://data.txt")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/auth/auth.py:171
return await super().authenticate_request(request)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/auth/auth.py:204
return await super().authenticate_request(request)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/auth/cimd.py:287
async def fetch(self, client_id_url: str) -> CIMDDocument:
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/auth/cimd.py:737
cimd_doc = await self._fetcher.fetch(client_id_url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/oauth_proxy/proxy.py:288
Patterns support wildcards (e.g., "http://localhost:*", "https://*.example.com/*").
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/oauth_proxy/proxy.py:717
redirect_uris=client_info.redirect_uris or [AnyUrl("http://localhost")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/oidc_proxy.py:262
Patterns support wildcards (e.g., "http://localhost:*", "https://*.example.com/*").
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/providers/auth0.py:17
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/providers/auth0.py:53
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/auth/providers/azure.py:369
Azure only allows ONE resource per token request (AADSTS28000), so we only
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/auth/providers/azure.py:373
scopes: Scopes from the authorization request (unprefixed)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/auth/providers/azure.py:395
token request (AADSTS28000). We include scopes for this API plus OIDC scopes.
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/providers/azure.py:80
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/providers/azure.py:91
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/providers/oci.py:40
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/providers/oci.py:110
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/providers/workos.py:153
base_url="http://localhost:8000"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/redirect_validation.py:222
"http://localhost:*",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/auth/redirect_validation.py:223
"http://127.0.0.1:*",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/context.py:333
async def on_request(self, context, call_next):
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/http.py:40
await self.session_manager.handle_request(scope, receive, send)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/low_level.py:113
await super(MiddlewareServerSession, self)._received_request(responder)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/low_level.py:152
return await super()._received_request(responder)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/middleware/error_handling.py:192
async def on_request(self, context: MiddlewareContext, call_next: CallNext) -> Any:
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/middleware/rate_limiting.py:152
async def on_request(self, context: MiddlewareContext, call_next: CallNext) -> Any:
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/middleware/rate_limiting.py:219
async def on_request(self, context: MiddlewareContext, call_next: CallNext) -> Any:
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/server/middleware/timing.py:39
async def on_request(self, context: MiddlewareContext, call_next: CallNext) -> Any:
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/providers/openapi/components.py:185
base_url = str(self._client.base_url) or "http://localhost"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/providers/proxy.py:524
proxy = ProxyProvider(lambda: ProxyClient("http://localhost:8000/mcp"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/providers/proxy.py:808
proxy = create_proxy("http://localhost:8000/mcp")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/server/providers/proxy.py:811
proxy = FastMCPProxy(client_factory=lambda: ProxyClient("http://localhost:8000/mcp"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

src/fastmcp/server/server.py:1879
"uri": f"file://{path}",
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

src/fastmcp/server/tasks/keys.py:40
>>> build_task_key("session123", "task456", "resource", "file://data.txt")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

src/fastmcp/server/tasks/keys.py:61
`{'session_id': 'session123', 'client_task_id': 'task456', 'task_type': 'resource', 'component_identifier': 'file://data.txt'}`
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

src/fastmcp/server/transforms/namespace.py:40
# Resource "file://data.txt" becomes "file://math/data.txt"
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

src/fastmcp/server/transforms/namespace.py:40
# Resource "file://data.txt" becomes "file://math/data.txt"
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/fastmcp/telemetry.py:89
meta: The meta dict from an MCP request (ctx.request_context.meta)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

src/fastmcp/utilities/json_schema.py:60
(``http://``, ``https://``, ``file://``, or any other URI scheme) are
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

src/fastmcp/utilities/json_schema.py:118
Remote URIs (``http://``, ``file://``, etc.) are stripped before
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

src/fastmcp/utilities/openapi/director.py:39
base_url: str = "http://localhost",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

src/fastmcp/utilities/types.py:419
uri_str = f"file:///{self._name}.{self._mime_type.split('/')[1]}"
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

src/fastmcp/utilities/types.py:421
uri_str = f"file:///resource.{self._mime_type.split('/')[1]}"
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:21
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:25
assert doc["redirect_uris"] == ["http://localhost:*/callback"]
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:35
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:45
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:58
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:69
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:78
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:87
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:97
"http://localhost:*/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:107
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:120
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:132
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:144
redirect_uri=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_cimd_cli.py:171
redirect_uris=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:235
resolve_server_spec("http://localhost:8000/mcp")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:236
== "http://localhost:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:254
config = {"mcpServers": {"test": {"url": "http://localhost:8000"}}}
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:293
resolve_server_spec("http://localhost:8000", command="npx server")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:300
result = resolve_server_spec("http://localhost:8000/mcp", transport="sse")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:301
assert result == "http://localhost:8000/mcp/sse"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:304
result = resolve_server_spec("http://localhost:8000/sse", transport="sse")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:305
assert result == "http://localhost:8000/sse"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:308
result = resolve_server_spec("http://localhost:8000/mcp/", transport="sse")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:309
assert result == "http://localhost:8000/mcp/sse"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:312
result = resolve_server_spec("http://localhost:8000/mcp", transport="http")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:313
assert result == "http://localhost:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:348
assert _is_http_target("http://localhost:8000") is True
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:371
client = _build_client("http://localhost:8000/mcp")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:382
client = _build_client("http://localhost:8000/mcp", auth="none")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_client_commands.py:388
client = _build_client({"mcpServers": {"test": {"url": "http://localhost"}}})
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/cli/test_cursor.py:235
result = open_deeplink("file:///etc/passwd")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:50
"url": "http://localhost:8000/mcp",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:89
config=RemoteMCPServer(url="http://localhost:8000/mcp"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:98
config=RemoteMCPServer(url="http://localhost:8000/sse", transport="sse"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:149
assert servers[0].config.url == "http://localhost:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:191
entry = {"url": "http://localhost:8000/sse", "type": "sse"}
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:197
entry = {"url": "http://localhost:8000/mcp", "transport": "http"}
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:260
project_servers={"api": {"url": "http://localhost:8000/mcp"}},
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:298
"url": "http://localhost:8000/sse",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:639
result = resolve_server_spec("http://localhost:8000/mcp")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:640
assert result == "http://localhost:8000/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:650
transport = StreamableHttpTransport("http://localhost:8000/mcp")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:654
transport = SSETransport("http://localhost:8000/sse")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_discovery.py:662
assert _is_http_target("http://localhost:8000") is True
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_generate_cli.py:118
code, imports = serialize_transport("http://localhost:8000/mcp")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_generate_cli.py:119
assert code == "'http://localhost:8000/mcp'"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_generate_cli.py:138
d: dict[str, Any] = {"mcpServers": {"test": {"url": "http://localhost"}}}
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_generate_cli.py:400
assert _derive_server_name("http://localhost:8000/mcp") == "localhost"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_generate_cli.py:441
transport_code='"http://localhost:8000/mcp"',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_generate_cli.py:451
transport_code='"http://localhost:8000/mcp"',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_generate_cli.py:462
transport_code='"http://localhost:8000/mcp"',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_generate_cli.py:487
transport_code='"http://localhost"',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_generate_cli.py:499
transport_code='"http://localhost"',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_generate_cli.py:524
transport_code='"http://localhost:8000/mcp"',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_run.py:30
assert is_url("http://localhost:8080")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_run.py:31
assert is_url("http://127.0.0.1:3000/path")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/cli/test_run.py:37
assert is_url("https://localhost:8443")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/cli/test_run.py:44
assert not is_url("ftp://example.com")  # Not http/https
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/cli/test_run.py:45
assert not is_url("file:///path/to/file")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/auth/test_oauth_client.py:48
server = fastmcp_server(f"http://127.0.0.1:{port}")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/auth/test_oauth_static_client.py:183
issuer_url = f"http://127.0.0.1:{port}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/auth/test_oauth_static_client.py:204
redirect_uris=[AnyUrl(f"http://localhost:{callback_port}/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/auth/test_oauth_static_client.py:233
issuer_url = f"http://127.0.0.1:{port}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/auth/test_oauth_static_client.py:252
redirect_uris=[AnyUrl(f"http://localhost:{callback_port}/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_auth.py:17
client = Client(transport=StreamableHttpTransport("http://localhost:8000"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_auth.py:26
transport=StreamableHttpTransport("http://localhost:8000"), auth="oauth"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_auth.py:33
transport=StreamableHttpTransport("http://localhost:8000", auth="oauth"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_auth.py:39
client = Client(transport=SSETransport("http://localhost:8000"), auth="oauth")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_auth.py:44
client = Client(transport=SSETransport("http://localhost:8000", auth="oauth"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_auth.py:50
transport=StreamableHttpTransport("http://localhost:8000"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_auth.py:60
"http://localhost:8000", auth="test_token"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_auth.py:69
transport=SSETransport("http://localhost:8000"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_auth.py:78
transport=SSETransport("http://localhost:8000", auth="test_token"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_transport.py:22
"https://localhost:8080/mcp/sse/endpoint",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_transport.py:25
"https://localhost:8080/mcp/sse/",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_transport.py:27
"https://localhost:8080/mcp/sse/?param=value",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_transport.py:28
"https://localhost:8000/mcp/sse?x=1&y=2",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_transport.py:49
"https://localhost:8080/mcp/",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_transport.py:51
"https://localhost:8080/sservice/endpoint",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_transport.py:70
"url": "http://localhost:8000/sse/",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_transport.py:78
assert transport.transport.url == "http://localhost:8000/sse/"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/client/test_transport.py:116
"url": "http://localhost:8000/sse/",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_client_resource_tasks.py:19
@mcp.resource("file://document.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_client_resource_tasks.py:24
@mcp.resource("file://data/{id}.json", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_client_resource_tasks.py:35
task = await client.read_resource("file://document.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_client_resource_tasks.py:44
task = await client.read_resource("file://document.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_client_resource_tasks.py:56
task = await client.read_resource("file://document.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_client_resource_tasks.py:73
task = await client.read_resource("file://document.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_client_resource_tasks.py:83
task = await client.read_resource("file://data/999.json", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_client_resource_tasks.py:96
task = await client.read_resource("file://document.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_task_context_validation.py:29
@mcp.resource("file://background.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_task_context_validation.py:127
task = await client.read_resource("file://background.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_task_result_caching.py:71
@mcp.resource("file://counter.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_task_result_caching.py:78
task = await client.read_resource("file://counter.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_task_result_caching.py:186
@mcp.resource("file://immediate.txt", task=False)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/tasks/test_task_result_caching.py:193
await client.read_resource("file://immediate.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/test_oauth_callback_race.py:29
f"http://127.0.0.1:{port}/callback?code=good&state=s1"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/test_oauth_callback_race.py:36
f"http://127.0.0.1:{port}/callback?code=evil&state=s2"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/test_roots.py:37
@pytest.mark.parametrize("roots", [["file://x/y/z", "file://x/y/z"]])
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/test_roots.py:37
@pytest.mark.parametrize("roots", [["file://x/y/z", "file://x/y/z"]])
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/test_roots.py:42
"file://x/y/z",
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/client/test_roots.py:43
"file://x/y/z",
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/test_sse.py:133
yield f"http://127.0.0.1:{port}/nest-outer/nest-inner/mcp/sse/"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/client/test_streamable_http.py:142
yield f"http://127.0.0.1:{port}/nest-outer/nest-inner/final/mcp"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/conftest.py:248
uri=AnyUrl("file:///test.bin"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/deprecated/test_tool_injection_middleware.py:155
@mcp.resource("file://config.txt")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/deprecated/test_tool_injection_middleware.py:160
@mcp.resource("file://data.json")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/deprecated/test_tool_injection_middleware.py:198
"uri": "file://config.txt/",
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/deprecated/test_tool_injection_middleware.py:209
"uri": "file://data.json/",
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/deprecated/test_tool_injection_middleware.py:227
name="read_resource", arguments={"uri": "file://config.txt"}
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/integration_tests/auth/test_github_provider_integration.py:163
base_url = f"http://127.0.0.1:{port}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/integration_tests/auth/test_github_provider_integration.py:175
base_url = f"http://127.0.0.1:{port}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/integration_tests/auth/test_github_provider_integration.py:225
"redirect_uris": ["http://localhost:12345/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/integration_tests/auth/test_github_provider_integration.py:245
"redirect_uri": "http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/prompts/test_prompt.py:115
uri=FileUrl("file://file.txt"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/prompts/test_prompt.py:131
uri=FileUrl("file://file.txt"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/prompts/test_prompt.py:150
uri=FileUrl("file://file.txt"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/prompts/test_prompt.py:168
uri=FileUrl("file://file.txt"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/prompts/test_prompt.py:187
uri=FileUrl("file://file.txt"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/prompts/test_prompt.py:203
uri=FileUrl("file://file.txt"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_file_resources.py:51
uri=FileUrl(f"file://{temp_file}"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_file_resources.py:61
uri=FileUrl(f"file://{temp_file}"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_file_resources.py:74
uri=FileUrl(f"file://{temp_file}"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_file_resources.py:88
uri=FileUrl("file:///test.txt"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_file_resources.py:98
uri=FileUrl("file:///missing.txt"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_file_resources.py:132
uri=FileUrl("file:///test/utf8"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_file_resources.py:147
uri=FileUrl("file:///test/default"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_file_resources.py:161
uri=FileUrl("file:///test/binary"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_file_resources.py:176
uri=FileUrl("file:///test/latin1"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_resource_template.py:558
("file://abc/xyz.py", {"path": "xyz"}),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_resource_template.py:559
("file://abc/x/y/z.py", {"path": "x/y/z"}),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_resource_template.py:560
("file://abc/x/y/z/.py", {"path": "x/y/z/"}),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_resource_template.py:561
("file://abc/x/y/z.md", None),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_resource_template.py:562
("file://x/y/z.txt", None),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/resources/test_resource_template.py:568
uri_template = "file://abc/{path*}.py"
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/conftest.py:31
self.base_url = f"http://localhost:{port}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/conftest.py:227
self.base_url = f"http://localhost:{self.port}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_authorization.py:22
redirect_uris=[AnyUrl("http://localhost:54321/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_authorization.py:30
redirect_uri=AnyUrl("http://localhost:54321/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_authorization.py:95
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_authorization.py:102
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_authorization.py:131
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_authorization.py:138
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_authorization.py:184
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_authorization.py:190
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_client_registration.py:15
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_client_registration.py:32
redirect_uris=[AnyUrl("http://localhost:8080/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:92
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:99
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:118
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:125
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:145
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:152
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:171
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:178
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:202
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:209
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:228
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:235
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:275
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:281
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:315
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:321
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:353
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_config.py:359
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_e2e.py:32
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_e2e.py:48
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_e2e.py:55
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_e2e.py:87
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_e2e.py:98
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_e2e.py:145
redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_e2e.py:167
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_e2e.py:204
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_e2e.py:213
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_e2e.py:220
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_oauth_proxy.py:51
allowed_client_redirect_uris=["http://localhost:*"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:94
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:131
redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:153
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:304
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:323
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:374
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:382
redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:405
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:454
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:462
redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:485
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:521
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:528
redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_tokens.py:550
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/oauth_proxy/test_ui.py:78
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/providers/test_azure.py:518
Azure only allows ONE resource per token request (AADSTS28000), so
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_azure.py:238
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_azure.py:245
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_azure.py:249
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_azure.py:309
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_azure.py:316
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_azure.py:320
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_descope.py:55
config_url="http://localhost:8080/v1/apps/agentic/P2abc123/M123/.well-known/openid-configuration",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_descope.py:58
assert str(provider2.descope_base_url) == "http://localhost:8080"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_descope.py:202
base_url="http://localhost:4321",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_propelauth.py:258
base_url="http://localhost:4321",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_scalekit.py:133
base_url="http://localhost:4321",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_supabase.py:167
base_url="http://localhost:4321",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_workos.py:80
authkit_domain="http://localhost:8080",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/providers/test_workos.py:135
base_url="http://localhost:4321",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:234
doc = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:252
first = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:253
second = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:274
first = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:275
second = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:308
first = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:309
second = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:342
first = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:343
second = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:371
first = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:372
second = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:405
first = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:406
second = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:443
first = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:444
second = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:445
third = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:479
first = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:485
second = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:486
third = await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:511
await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:520
await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:532
await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/auth/test_cimd.py:551
await fetcher.fetch(url)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:29
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:43
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:56
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:67
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:78
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:88
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:167
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:169
assert fetcher.validate_redirect_uri(doc, "http://localhost:3000/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:170
assert not fetcher.validate_redirect_uri(doc, "http://localhost:4000/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:176
redirect_uris=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:178
assert fetcher.validate_redirect_uri(doc, "http://localhost:3000/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:179
assert fetcher.validate_redirect_uri(doc, "http://localhost:8080/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:180
assert not fetcher.validate_redirect_uri(doc, "http://localhost:3000/other")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:186
redirect_uris=["http://localhost/callback", "http://127.0.0.1/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:186
redirect_uris=["http://localhost/callback", "http://127.0.0.1/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:188
assert fetcher.validate_redirect_uri(doc, "http://localhost:51353/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:189
assert fetcher.validate_redirect_uri(doc, "http://127.0.0.1:3000/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:190
assert not fetcher.validate_redirect_uri(doc, "http://localhost:51353/other")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:221
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:244
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:266
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:288
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:325
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:359
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:385
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:422
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:463
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:503
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd.py:542
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:82
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:92
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:366
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:418
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:442
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:468
"redirect_uris": ["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:476
patterns = ["http://localhost:*", "https://app.example.com/*"]
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:492
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:536
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:557
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:615
"redirect_uris": ["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:626
allowed_redirect_uri_patterns=["http://localhost:*"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:633
AnyUrl("http://localhost:3000/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:635
assert str(validated) == "http://localhost:3000/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:639
client.validate_redirect_uri(AnyUrl("http://localhost:4000/callback"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:656
"http://localhost:3000/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:669
allowed_redirect_uri_patterns=["http://localhost:*"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:676
AnyUrl("http://localhost:3000/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_cimd_validators.py:678
assert str(validated) == "http://localhost:3000/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_enhanced_error_responses.py:59
"redirect_uri": "http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_enhanced_error_responses.py:92
"redirect_uri": "http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_enhanced_error_responses.py:127
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_enhanced_error_responses.py:140
"redirect_uri": "http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_enhanced_error_responses.py:173
"redirect_uri": "http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_enhanced_error_responses.py:323
"redirect_uri": "http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_enhanced_error_responses.py:343
"redirect_uri": "http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_enhanced_error_responses.py:362
"redirect_uri": "http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_multi_auth.py:295
base_url="http://localhost",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_multi_auth.py:362
base_url="http://localhost",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:145
redirect_uris=[AnyUrl("http://localhost:54321/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:151
redirect_uri=AnyUrl("http://localhost:54321/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:180
assert transaction["client_redirect_uri"] == "http://localhost:54321/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:193
redirect_uris=[AnyUrl("http://localhost:54321/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:203
redirect_uri=AnyUrl("http://localhost:54321/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:276
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:282
redirect_uri=AnyUrl("http://localhost:12345/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:319
redirect_uris=[AnyUrl("http://localhost:8080/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:324
redirect_uri=AnyUrl("http://localhost:8080/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:343
redirect_uris=[AnyUrl("http://localhost:9090/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:348
redirect_uri=AnyUrl("http://localhost:9090/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:387
redirect_uris=[AnyUrl("http://localhost:7070/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:392
redirect_uri=AnyUrl("http://localhost:7070/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:430
redirect_uris=[AnyUrl("http://localhost:6060/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:435
redirect_uri=AnyUrl("http://localhost:6060/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:477
"http://localhost:9090/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:512
redirect_uris=[AnyUrl("http://localhost:5050/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:517
redirect_uri=AnyUrl("http://localhost:5050/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:547
redirect_uris=[AnyUrl("http://localhost:4040/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:552
redirect_uri=AnyUrl("http://localhost:4040/callback"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:582
oauth_proxy_https, "client-a", "http://localhost:5001/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:592
client_redirect = "http://localhost:5002/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:624
oauth_proxy_https, "client-c", "http://localhost:5003/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:649
oauth_proxy_https, "client-d", "http://localhost:5004/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_flow.py:666
redirect = "http://localhost:5005/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:126
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:136
client_redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:188
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:198
client_redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:254
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:264
client_redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:317
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:325
client_redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:368
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:376
client_redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:419
redirect_uris=[AnyUrl("http://localhost:12345/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:427
client_redirect_uri="http://localhost:12345/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:461
oauth_proxy_https, "client-binding", "http://localhost:6001/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:482
redirect = "http://localhost:6002/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:520
oauth_proxy_https, "client-par-a", "http://localhost:6010/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:523
oauth_proxy_https, "client-par-b", "http://localhost:6011/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:578
oauth_proxy_https, "client-nocd", "http://localhost:6003/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:603
oauth_proxy_https, "client-wrongcd", "http://localhost:6004/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:627
oauth_proxy_https, "client-notxntoken", "http://localhost:6005/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_consent_page.py:652
redirect = "http://localhost:6006/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:37
redirect_uris=[AnyUrl("http://localhost:3000")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:41
assert client.validate_redirect_uri(AnyUrl("http://localhost:3000")) == AnyUrl(
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:42
"http://localhost:3000"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:44
assert client.validate_redirect_uri(AnyUrl("http://localhost:8080")) == AnyUrl(
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:45
"http://localhost:8080"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:47
assert client.validate_redirect_uri(AnyUrl("http://127.0.0.1:3000")) == AnyUrl(
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:48
"http://127.0.0.1:3000"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:62
redirect_uris=[AnyUrl("http://localhost:3000")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:64
"http://localhost:*",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:70
assert client.validate_redirect_uri(AnyUrl("http://localhost:3000"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:75
client.validate_redirect_uri(AnyUrl("http://127.0.0.1:3000"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:91
redirect_uris=[AnyUrl("http://localhost:3000")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:103
client.validate_redirect_uri(AnyUrl("http://localhost:3000"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:105
client.validate_redirect_uri(AnyUrl("http://127.0.0.1:3000"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:114
redirect_uris=[AnyUrl("http://localhost:3000")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:120
assert client.validate_redirect_uri(AnyUrl("http://localhost:3000"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:128
client.validate_redirect_uri(AnyUrl("http://localhost:5000"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:135
redirect_uris=[AnyUrl("http://localhost:3000")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:140
assert result == AnyUrl("http://localhost:3000")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:146
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:156
assert result == AnyUrl("http://localhost:3000/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:169
allowed_redirect_uri_patterns=["http://localhost:*"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:179
redirect_uris=["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:196
"http://localhost/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:197
"http://127.0.0.1/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:208
assert client.validate_redirect_uri(AnyUrl("http://localhost:51353/callback"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:209
assert client.validate_redirect_uri(AnyUrl("http://127.0.0.1:3000/callback"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:213
client.validate_redirect_uri(AnyUrl("http://localhost:51353/other"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:219
redirect_uris=["http://localhost:3000/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:230
client.validate_redirect_uri(AnyUrl("http://localhost:3000/callback"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:244
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:254
custom_patterns = ["http://localhost:*", "https://*.myapp.com/*"]
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:262
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:278
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:296
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:322
custom_patterns = ["http://localhost:*", "http://127.0.0.1:*"]
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:322
custom_patterns = ["http://localhost:*", "http://127.0.0.1:*"]
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:330
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:359
"redirect_uris": ["http://localhost:*/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:373
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:391
"http://localhost:3000/callback",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:407
base_url="http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:408
allowed_client_redirect_uris=["http://localhost:*"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:417
assert client.validate_redirect_uri(AnyUrl("http://localhost:3000/callback"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_redirect_validation.py:425
client.validate_redirect_uri(AnyUrl("http://localhost:9999/other"))
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_storage.py:69
redirect_uris=[AnyUrl("http://localhost:8080/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_storage.py:92
redirect_uris=[AnyUrl("http://localhost:9999/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_storage.py:124
allowed_client_redirect_uris=["http://localhost:*"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_storage.py:132
redirect_uris=[AnyUrl("http://localhost:8080/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_storage.py:142
AnyUrl("http://localhost:12345/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_storage.py:154
redirect_uris=[AnyUrl("http://localhost:8080/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_storage.py:178
redirect_uris=[AnyUrl("http://localhost:8080/callback")],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oauth_proxy_storage.py:189
"redirect_uris": ["http://localhost:8080/callback"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oidc_proxy.py:563
allowed_client_redirect_uris=["http://localhost:*"],
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_oidc_proxy.py:571
assert proxy._allowed_client_redirect_uris == ["http://localhost:*"]
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:18
"http://localhost:3000/callback", "http://localhost:3000/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:18
"http://localhost:3000/callback", "http://localhost:3000/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:21
"http://localhost:3000/callback", "http://localhost:3001/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:21
"http://localhost:3000/callback", "http://localhost:3001/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:26
pattern = "http://localhost:*/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:27
assert matches_allowed_pattern("http://localhost:3000/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:28
assert matches_allowed_pattern("http://localhost:54321/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:33
pattern = "http://localhost:3000/*"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:34
assert matches_allowed_pattern("http://localhost:3000/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:35
assert matches_allowed_pattern("http://localhost:3000/auth/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:36
assert not matches_allowed_pattern("http://localhost:3001/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:67
assert validate_redirect_uri(None, ["http://localhost:*"])
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:72
assert validate_redirect_uri("http://localhost:3000", None)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:73
assert validate_redirect_uri("http://127.0.0.1:8080", None)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:80
assert not validate_redirect_uri("http://localhost:3000", [])
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:87
"http://localhost:*",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:93
assert validate_redirect_uri("http://localhost:3000", patterns)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:98
assert not validate_redirect_uri("http://127.0.0.1:3000", patterns)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:104
patterns = ["http://localhost:*"]
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:105
uri = AnyUrl("http://localhost:3000/callback")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:121
pattern = "http://localhost:*"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:125
"http://localhost@evil.com/callback", pattern
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:128
"http://localhost:3000@malicious.io/callback", pattern
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:148
pattern = "http://localhost:*"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:149
assert matches_allowed_pattern("http://localhost:3000/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:150
assert matches_allowed_pattern("http://localhost:8080/auth", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:158
"http://localhost:3000/callback", "https://localhost:*"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:158
"http://localhost:3000/callback", "https://localhost:*"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:161
"https://localhost:3000/callback", "http://localhost:*"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:161
"https://localhost:3000/callback", "http://localhost:*"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:166
pattern = "http://localhost:*"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:167
assert not matches_allowed_pattern("http://127.0.0.1:3000/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:176
pattern = "http://localhost/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:177
assert matches_allowed_pattern("http://localhost:51353/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:178
assert matches_allowed_pattern("http://localhost:3000/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:179
assert matches_allowed_pattern("http://localhost:80/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:183
pattern = "http://localhost"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:184
assert matches_allowed_pattern("http://localhost:51353", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:185
assert matches_allowed_pattern("http://localhost:3000/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:189
pattern = "http://127.0.0.1/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:190
assert matches_allowed_pattern("http://127.0.0.1:51353/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:191
assert matches_allowed_pattern("http://127.0.0.1:3000/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:195
pattern = "http://[::1]/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:196
assert matches_allowed_pattern("http://[::1]:51353/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:197
assert matches_allowed_pattern("http://[::1]:3000/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:209
pattern = "http://localhost:8080/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:210
assert matches_allowed_pattern("http://localhost:8080/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:211
assert not matches_allowed_pattern("http://localhost:3000/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:215
pattern = "http://localhost/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:216
assert not matches_allowed_pattern("https://localhost:3000/callback", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:220
pattern = "http://localhost/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:225
pattern = "http://localhost/callback"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:226
assert not matches_allowed_pattern("http://localhost:3000/other", pattern)
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:239
assert "http://localhost:*" in DEFAULT_LOCALHOST_PATTERNS
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:240
assert "http://127.0.0.1:*" in DEFAULT_LOCALHOST_PATTERNS
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:246
"http://localhost:3000", DEFAULT_LOCALHOST_PATTERNS
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_redirect_validation.py:249
"http://127.0.0.1:8080", DEFAULT_LOCALHOST_PATTERNS
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/auth/test_ssrf_protection.py:299
jwks_uri="https://localhost/.well-known/jwks.json",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to cloud metadata endpoint

critical

Requests to 169.254.169.254 or cloud metadata services can leak cloud credentials.

tests/server/auth/test_ssrf_protection.py:42
assert is_ip_allowed("169.254.169.254") is False
How to fix

Block requests to cloud metadata endpoints. Use IMDSv2 with hop limit of 1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/http/test_stale_access_token.py:92
def test_get_access_token_falls_back_to_context_var_when_no_request(self):
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/middleware/test_caching.py:654
uri=AnyUrl("file:///tmp/../../etc/shadow?token=abcd")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_error_handling.py:314
result = await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_error_handling.py:333
result = await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_error_handling.py:348
await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_error_handling.py:359
await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_rate_limiting.py:170
result = await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_rate_limiting.py:182
await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_rate_limiting.py:186
await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_rate_limiting.py:195
await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_rate_limiting.py:199
await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_rate_limiting.py:229
result = await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_rate_limiting.py:239
await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_rate_limiting.py:243
await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_timing.py:50
result = await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/middleware/test_timing.py:63
await middleware.on_request(mock_context, mock_call_next)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/mount/test_mount.py:270
transport=SSETransport("http://127.0.0.1:9999/sse/"),
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/providers/openapi/test_comprehensive.py:545
assert str(request.url).startswith("http://localhost")
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/providers/proxy/test_proxy_client.py:112
async def test_forward_list_roots_request(self, proxy_server: FastMCP):
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/providers/proxy/test_proxy_client.py:136
async def test_forward_sampling_request(self, proxy_server: FastMCP):
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/providers/proxy/test_proxy_client.py:178
async def test_elicit_request(self, proxy_server: FastMCP):
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/providers/proxy/test_proxy_client.py:240
async def test_log_request(self, proxy_server: FastMCP):
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/providers/proxy/test_proxy_client.py:260
async def test_report_progress_request(self, proxy_server: FastMCP):
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/providers/proxy/test_proxy_client.py:132
async with Client(proxy_server, roots=["file://x/y/z"]) as client:
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/providers/proxy/test_proxy_client.py:134
assert result.data == ["file://x/y/z"]
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/providers/proxy/test_stateful_proxy_client.py:57
url = f"http://127.0.0.1:{port}/mcp/"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_dependencies.py:64
@mcp.resource("file://data.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_dependencies.py:188
task = await client.read_resource("file://data.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_resources.py:19
@mcp.resource("file://data.txt")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_resources.py:24
@mcp.resource("file://large.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_resources.py:29
@mcp.resource("file://user/{user_id}/data.json", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_resources.py:41
result = await client.read_resource("file://data.txt")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_resources.py:51
task = await client.read_resource("file://large.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_resources.py:62
task = await client.read_resource("file://large.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_resources.py:76
task = await client.read_resource("file://user/123/data.json", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_resources.py:93
"file://sync.txt/", task=False
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/tasks/test_task_resources.py:101
await client.read_resource("file://sync.txt", task=True)
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/test_file_server.py:38
@mcp.resource("file://test_dir/example.py")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/test_file_server.py:46
@mcp.resource("file://test_dir/readme.md")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/test_file_server.py:54
@mcp.resource("file://test_dir/config.json")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/test_file_server.py:84
"file://test_dir/example.py",
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/test_file_server.py:85
"file://test_dir/readme.md",
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/test_file_server.py:86
"file://test_dir/config.json",
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/test_file_server.py:110
res_result = await mcp._read_resource_mcp("file://test_dir/example.py")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/test_file_server.py:129
res_result = await mcp._read_resource_mcp("file://test_dir/example.py")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/server/test_tool_transformation.py:256
async with httpx.AsyncClient(base_url="http://localhost") as http_client:
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/transforms/test_resources_as_tools.py:81
@mcp.resource("file://{path}")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/transforms/test_resources_as_tools.py:92
assert resources[0]["uri_template"] == "file://{path}"
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/transforms/test_resources_as_tools.py:103
@mcp.resource("file://{path}")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/transforms/test_resources_as_tools.py:120
assert templates == ["file://{path}"]
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_calls.py:23
@mcp.resource("file:///config", version="1.0")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_calls.py:29
@mcp.resource("file:///config")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/server/versioning/test_filtering.py:588
async def test_unversioned_returned_for_exact_version_request(self):
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_filtering.py:231
@mcp.resource("file:///config", version="1.0")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_filtering.py:235
@mcp.resource("file:///config", version="2.0")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_filtering.py:250
@mcp.resource("file:///unversioned")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_filtering.py:254
@mcp.resource("file:///included_versioned", version="1.0")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_filtering.py:258
@mcp.resource("file:///excluded_versioned", version="5.0")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_filtering.py:266
"file:///included_versioned"
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_filtering.py:394
@child.resource("file://data/", version="2.0")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_filtering.py:401
resource = await provider.get_resource("file://data/")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_filtering.py:407
"file://data/", version=VersionSpec(lt="2.0")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_mounting.py:124
@child.resource("file:///config", version="1.5")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_versioning.py:222
@mcp.resource("file:///config", version="1.0")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_versioning.py:226
@mcp.resource("file:///config", version="2.0")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/server/versioning/test_versioning.py:237
resource = await mcp.get_resource("file:///config")
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:195
"url": "http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:202
assert transport.url == "http://localhost:8000"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:209
"url": "http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:217
assert transport.url == "http://localhost:8000"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:224
"url": "http://localhost:8000/sse/",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:231
assert transport.url == "http://localhost:8000/sse/"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:238
"url": "http://localhost:8000/sse/",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:472
"url": "http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:485
"url": "http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:500
"url": "http://localhost:8000/sse/",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tests/test_mcp_config.py:515
"url": "http://localhost:8000",
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/tools/tool/test_content.py:161
uri=AnyUrl("file:///resource.octet-stream"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/tools/tool/test_tool.py:263
"uri": AnyUrl("file:///resource.octet-stream"),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/utilities/openapi/test_director.py:165
def test_build_basic_request(self, director, basic_route):
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tests/utilities/openapi/test_director.py:177
def test_build_complex_request(self, director, complex_route):
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/utilities/test_components.py:210
assert Resource.make_key("file://test.txt") == "resource:file://test.txt"
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to private network IP range

high

Requests to RFC 1918 private IP ranges (10.x, 172.16-31.x, 192.168.x) or link-local (169.254.x) can reach internal infrastructure.

tests/utilities/test_json_schema.py:760
"evil": {"$ref": "http://169.254.169.254/latest/meta-data/"},
How to fix

Block requests to private IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x). Validate URLs before fetching.

Request to private network IP range

high

Requests to RFC 1918 private IP ranges (10.x, 172.16-31.x, 192.168.x) or link-local (169.254.x) can reach internal infrastructure.

tests/utilities/test_json_schema.py:827
"$ref": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
How to fix

Block requests to private IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x). Validate URLs before fetching.

Request to cloud metadata endpoint

critical

Requests to 169.254.169.254 or cloud metadata services can leak cloud credentials.

tests/utilities/test_json_schema.py:760
"evil": {"$ref": "http://169.254.169.254/latest/meta-data/"},
How to fix

Block requests to cloud metadata endpoints. Use IMDSv2 with hop limit of 1.

Request to cloud metadata endpoint

critical

Requests to 169.254.169.254 or cloud metadata services can leak cloud credentials.

tests/utilities/test_json_schema.py:827
"$ref": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
How to fix

Block requests to cloud metadata endpoints. Use IMDSv2 with hop limit of 1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/utilities/test_json_schema.py:744
schema = {"$ref": "file:///etc/passwd"}
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/utilities/test_json_schema.py:771
{"$ref": "file:///etc/credentials.json"},
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/utilities/test_json_schema.py:816
"secret": {"$ref": "file:///etc/passwd"},
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

tests/utilities/test_types.py:460
assert str(resource.resource.uri) == "file:///resource.pdf"
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/approvals/approvals_server.py:191
@app.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/chart_server.py:18
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/contacts/contacts_server.py:96
@app.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/datatable_server.py:59
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/explorer/explorer_server.py:348
@app.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/greet_server.py:26
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/greet_server.py:49
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/inspector_demo.py:30
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/map/map_server.py:96
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/patterns_server.py:230
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/patterns_server.py:248
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/patterns_server.py:264
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/patterns_server.py:285
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/patterns_server.py:311
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/patterns_server.py:365
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/patterns_server.py:401
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/patterns_server.py:429
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/patterns_server.py:465
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/qr_server/qr_server.py:107
@mcp.tool(app=AppConfig(resource_uri=VIEW_URI))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/sales_dashboard/sales_dashboard_server.py:116
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/apps/showcase_server.py:19
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

examples/diagnostics/server.py:58
echo_proxy = create_proxy(ECHO_SERVER_URL, name="Echo Proxy")
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

examples/in_memory_proxy_example.py:6
2. Create a proxy FastMCP server using ``FastMCP.as_proxy(original_server)``.
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

examples/in_memory_proxy_example.py:43
proxy_server = FastMCP.as_proxy(original_server, name="InMemoryProxy")
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/namespace_activation/server.py:15
@server.tool(tags={"namespace:finance"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/namespace_activation/server.py:21
@server.tool(tags={"namespace:finance"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/namespace_activation/server.py:27
@server.tool(tags={"namespace:finance"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/namespace_activation/server.py:34
@server.tool(tags={"namespace:admin"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/namespace_activation/server.py:40
@server.tool(tags={"namespace:admin"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/smart_home/src/smart_home/hub.py:15
@hub_mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, openWorldHint=True))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/smart_home/src/smart_home/lights/server.py:60
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, openWorldHint=True))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/smart_home/src/smart_home/lights/server.py:76
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=False, openWorldHint=True))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/smart_home/src/smart_home/lights/server.py:93
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=False, openWorldHint=True))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/smart_home/src/smart_home/lights/server.py:117
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, openWorldHint=True))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/smart_home/src/smart_home/lights/server.py:130
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, openWorldHint=True))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/smart_home/src/smart_home/lights/server.py:171
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=False, openWorldHint=True))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/smart_home/src/smart_home/lights/server.py:232
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=False, openWorldHint=True))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/smart_home/src/smart_home/lights/server.py:259
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=False, openWorldHint=True))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/smart_home/src/smart_home/lights/server.py:284
@lights_mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, openWorldHint=True))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/task_elicitation.py:40
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/tasks/server.py:32
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/text_me.py:49
@mcp.tool(name="textme", description="Send a text message to me")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/versioning/client_version_selection.py:20
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/versioning/client_version_selection.py:26
@mcp.tool(version="1.1")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/versioning/client_version_selection.py:34
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/versioning/version_filters.py:23
@components.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/versioning/version_filters.py:29
@components.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/versioning/version_filters.py:35
@components.tool(version="3.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/versioning/versioned_components.py:24
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

examples/versioning/versioned_components.py:30
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/apps/config.py:126
@mcp.tool(app=PrefabAppConfig())  # same as app=True
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/apps/config.py:128
@mcp.tool(app=PrefabAppConfig(
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/apps/file_upload.py:285
@self.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/apps/file_upload.py:290
@self.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

src/fastmcp/cli/run.py:114
server = create_proxy(mcp_config)
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Dynamic server endpoint resolution

high

Detected MCP transport or endpoint URL being resolved from environment variables, configuration objects, or remote fetch calls. Dynamic resolution enables an attacker to redirect MCP traffic to a shadow server by manipulating the configuration source.

src/fastmcp/client/transports/config.py:169
transport = config.to_transport()
How to fix

Use hardcoded or compile-time endpoint URLs for MCP server connections. If dynamic configuration is necessary, validate endpoints against an allowlist.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/auth/authorization.py:18
@mcp.tool(auth=require_scopes("write"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/auth/authorization.py:89
@mcp.tool(auth=require_scopes("admin"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/auth/authorization.py:92
@mcp.tool(auth=require_scopes("read", "write"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/context.py:216
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/providers/local_provider/decorators/tools.py:277
- @provider.tool (without parentheses)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/providers/local_provider/decorators/tools.py:280
- @provider.tool(name="custom_name") (with name as keyword argument)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/providers/local_provider/decorators/tools.py:281
- provider.tool(function, name="custom_name") (direct function call)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

src/fastmcp/server/providers/proxy.py:796
class FastMCPProxy(FastMCP):
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

src/fastmcp/server/providers/proxy.py:808
proxy = create_proxy("http://localhost:8000/mcp")
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

src/fastmcp/server/providers/proxy.py:811
proxy = FastMCPProxy(client_factory=lambda: ProxyClient("http://localhost:8000/mcp"))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

src/fastmcp/server/server.py:360
lifespan=_lifespan_proxy(fastmcp_server=self),
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

src/fastmcp/server/server.py:1985
server = FastMCP.as_proxy(server)
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

src/fastmcp/server/server.py:2296
proxy = create_proxy("http://remote-server/mcp")
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

src/fastmcp/server/server.py:2299
proxy = create_proxy(other_server)
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/server.py:1553
- @server.tool (without parentheses)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/server.py:1554
- @server.tool (with empty parentheses)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/server.py:1556
- @server.tool(name="custom_name") (with name as keyword argument)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/server.py:1557
- server.tool(function, name="custom_name") (direct function call)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/server.py:1586
@server.tool(name="custom_name")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/server.py:1591
server.tool(my_function, name="custom_name")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/tasks/config.py:69
@mcp.tool(task=TaskConfig(mode="required"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

src/fastmcp/server/tasks/config.py:73
@mcp.tool(task=TaskConfig(mode="optional"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_client_task_notifications.py:23
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_client_task_notifications.py:29
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_client_task_notifications.py:35
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_client_task_protocol.py:20
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_client_task_protocol.py:52
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_client_task_protocol.py:73
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_client_tool_tasks.py:20
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_client_tool_tasks.py:25
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_task_context_validation.py:19
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_task_result_caching.py:17
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_task_result_caching.py:97
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_task_result_caching.py:117
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_task_result_caching.py:139
@mcp.tool(task=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_task_result_caching.py:202
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_task_result_caching.py:230
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_task_result_caching.py:251
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_task_result_caching.py:281
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/tasks/test_task_result_caching.py:307
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/client/test_openapi.py:66
proxy = FastMCP.as_proxy(StreamableHttpTransport(shttp_server))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/client/test_openapi.py:194
async def test_client_headers_proxy(proxy_server: str):
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/client/transports/test_memory_transport.py:37
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:55
@server.tool(name="test_simple_text")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:61
@server.tool(name="test_image_content")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:67
@server.tool(name="test_audio_content")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:73
@server.tool(name="test_embedded_resource")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:88
@server.tool(name="test_multiple_content_types")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:109
@server.tool(name="test_error_handling")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:115
@server.tool(name="test_tool_with_logging")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:126
@server.tool(name="test_tool_with_progress")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:137
@server.tool(name="test_sampling")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:152
@server.tool(name="test_elicitation")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:173
@server.tool(name="test_elicitation_sep1034_defaults")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conformance/server.py:183
@server.tool(name="test_elicitation_sep1330_enums")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conftest.py:253
@mcp.tool(output_schema=None)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conftest.py:262
@mcp.tool(output_schema=None)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/conftest.py:271
@mcp.tool(output_schema=None)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/deprecated/test_exclude_args.py:14
@mcp.tool(exclude_args=["state"])
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/deprecated/test_exclude_args.py:33
@mcp.tool(exclude_args=["state"])
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/deprecated/test_import_server.py:484
@first_app.tool(name="shared_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/deprecated/test_import_server.py:488
@second_app.tool(name="shared_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/deprecated/test_import_server.py:606
@first_app.tool(name="shared_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/deprecated/test_import_server.py:610
@second_app.tool(name="shared_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/deprecated/test_tool_serializer.py:111
provider.tool(my_tool, serializer=custom_serializer)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/deprecated/test_tool_serializer.py:123
@provider.tool(serializer=custom_serializer)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/deprecated/test_tool_serializer.py:141
provider.tool(my_tool, serializer=custom_serializer)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode.py:539
@mcp.tool(auth=lambda _ctx: False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode.py:554
@mcp.tool(auth=lambda _ctx: False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:94
@mcp.tool(tags={"math"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:98
@mcp.tool(tags={"math"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:102
@mcp.tool(tags={"text"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:122
@mcp.tool(tags={"math"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:127
@mcp.tool(tags={"text"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:150
@mcp.tool(tags={"math"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:174
@mcp.tool(tags={"math", "core"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:197
@mcp.tool(tags={"math"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:241
@mcp.tool(tags={"math"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:246
@mcp.tool(tags={"text"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:262
@mcp.tool(tags={"math"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:278
@mcp.tool(tags={"math"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:283
@mcp.tool(tags={"text"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:300
@mcp.tool(tags={"math"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/experimental/transforms/test_code_mode_discovery.py:345
@mcp.tool(tags={"math"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:281
@mcp.tool(auth=require_scopes("test"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:292
@mcp.tool(auth=require_scopes("test"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:309
@mcp.tool(auth=require_scopes("admin"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:325
@mcp.tool(auth=require_scopes("admin"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:343
@mcp.tool(auth=require_scopes("test"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:354
@mcp.tool(auth=require_scopes("test"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:440
@mcp.tool(tags={"admin"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:554
@mcp.tool(auth=require_scopes("test"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:571
@mcp.tool(auth=require_scopes("test"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:602
@mcp.tool(auth=check_claims)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:632
@mcp.tool(auth=check_claims)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:684
@mcp.tool(auth=require_scopes("test"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:707
@mcp.tool(auth=require_scopes("test"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/auth/test_authorization.py:726
@mcp.tool(auth=require_scopes("test"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/http/test_http_dependencies.py:176
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/http/test_http_dependencies.py:194
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/middleware/test_middleware.py:125
@mcp.tool(tags={"add-tool"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/middleware/test_middleware.py:322
@server.tool(tags={"private"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/middleware/test_middleware_nested.py:474
proxy_server = FastMCP.as_proxy(mcp_server, name="Proxy Server")
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/middleware/test_middleware_nested.py:491
proxy_server = FastMCP.as_proxy(mcp_server, name="Proxy Server")
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/middleware/test_middleware_nested.py:126
@mcp.tool(tags={"add-tool"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/mount/test_advanced.py:482
@main_app.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/mount/test_filtering.py:18
@mounted.tool(tags={"allowed"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/mount/test_filtering.py:22
@mounted.tool(tags={"blocked"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/mount/test_filtering.py:46
@mounted.tool(tags={"production"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/mount/test_filtering.py:50
@mounted.tool(tags={"blocked"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/mount/test_mount.py:330
@first_app.tool(name="shared_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/mount/test_mount.py:334
@second_app.tool(name="shared_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/mount/test_mount.py:357
@first_app.tool(name="shared_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/mount/test_mount.py:361
@second_app.tool(name="shared_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/mount/test_proxy.py:28
proxy_server = FastMCP.as_proxy(FastMCPTransport(original_server))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/mount/test_proxy.py:48
proxy_server = FastMCP.as_proxy(FastMCPTransport(original_server))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/mount/test_proxy.py:77
proxy_server = FastMCP.as_proxy(FastMCPTransport(original_server))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/mount/test_proxy.py:99
proxy_server = FastMCP.as_proxy(FastMCPTransport(original_server))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/mount/test_proxy.py:220
sub_proxy = FastMCP.as_proxy(FastMCPTransport(sub))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/mount/test_proxy.py:237
sub_proxy = FastMCP.as_proxy(FastMCPTransport(sub))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/mount/test_proxy.py:254
sub_proxy = FastMCP.as_proxy(FastMCPTransport(sub))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_context.py:117
@mcp.tool(tags={"example", "test-tag"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_decorator.py:77
@mcp.tool(name="custom-add")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_decorator.py:87
@mcp.tool(description="Add two numbers")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_decorator.py:201
@mcp.tool(tags={"example", "test-tag"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_decorator.py:271
result_fn = mcp.tool(standalone_function, name="direct_call_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_decorator.py:323
@mcp.tool(output_schema={"type": "integer"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_decorator.py:333
@mcp.tool(meta=meta_data)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_output_schema.py:93
@mcp.tool(output_schema=None)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_output_schema.py:133
@mcp.tool(output_schema=None)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_tags.py:45
@mcp.tool(tags={"a", "b"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/local_provider_tools/test_tags.py:49
@mcp.tool(tags={"b", "c"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_client.py:91
return FastMCP.as_proxy(ProxyClient(fastmcp_server))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_client.py:380
proxy_server = FastMCP.as_proxy(ProxyClient(fastmcp_server))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/proxy/test_proxy_client.py:27
@mcp.tool(tags={"echo"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_server.py:161
return create_proxy(ProxyClient(transport=FastMCPTransport(fastmcp_server)))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_server.py:176
proxy = create_proxy(fastmcp_server)
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_server.py:184
proxy = create_proxy(FastMCPTransport(fastmcp_server))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_server.py:192
proxy = create_proxy("http://example.com/mcp/")
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_server.py:208
proxy = FastMCP.as_proxy(fastmcp_server)
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_server.py:224
proxy = FastMCP.as_proxy("http://example.com/mcp/")
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_server.py:279
proxy = create_proxy(server)
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_server.py:300
proxy = create_proxy(server)
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_proxy_server.py:873
proxy = create_proxy(fastmcp_server)
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_stateful_proxy_client.py:105
async def test_stateful_proxy(self, stateful_proxy_server: FastMCP):
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/providers/proxy/test_stateful_proxy_client.py:115
async def test_stateless_proxy(self, stateless_server: str):
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/test_local_provider.py:320
@provider.tool(name="custom_name")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/test_local_provider.py:328
"""provider.tool(fn) should register the function."""
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/test_local_provider.py:334
provider.tool(my_tool, name="direct_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/test_local_provider.py:342
@provider.tool(enabled=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/test_local_provider.py:361
@provider.tool(enabled=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/test_local_provider.py:380
@provider.tool(enabled=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/test_local_provider.py:710
@provider.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/providers/test_local_provider.py:722
@provider.tool(task=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_concurrent_dependencies.py:78
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_concurrent_dependencies.py:100
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_concurrent_dependencies.py:185
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_concurrent_dependencies.py:200
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_context_background_task.py:141
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_context_background_task.py:204
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_context_background_task.py:225
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_context_background_task.py:253
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_context_background_task.py:285
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_context_background_task.py:305
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_context_background_task.py:332
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_context_background_task.py:353
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_context_background_task.py:386
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_context_background_task.py:410
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_notifications.py:61
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_notifications.py:120
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_progress_dependency.py:31
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_progress_dependency.py:73
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_server_tasks_parameter.py:111
@mcp.tool(task=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_server_tasks_parameter.py:144
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_server_tasks_parameter.py:181
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_server_tasks_parameter.py:185
@mcp.tool(task=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_server_tasks_parameter.py:302
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_server_tasks_parameter.py:331
mcp.tool(my_function, name="custom-tool-name")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_sync_function_task_disabled.py:24
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_sync_function_task_disabled.py:104
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_sync_function_task_disabled.py:149
@mcp.tool(task=False)  # Explicitly disable
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:29
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:41
@mcp.tool(task=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:53
@mcp.tool(task=TaskConfig(mode="required"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:94
@mcp.tool(task=TaskConfig(mode="required"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:99
@mcp.tool(task=TaskConfig(mode="forbidden"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:104
@mcp.tool(task=TaskConfig(mode="optional"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:272
@mcp.tool(task=TaskConfig(mode="optional"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:287
@mcp.tool(task=TaskConfig(mode="required"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:302
@mcp.tool(task=TaskConfig(mode="forbidden"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:321
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:331
@mcp.tool(task=TaskConfig(mode="required"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:341
@mcp.tool(task=TaskConfig(mode="optional"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:349
@mcp.tool(task=TaskConfig(mode="forbidden"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:375
@mcp.tool(task=TaskConfig(mode="optional", poll_interval=timedelta(seconds=2)))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_config.py:387
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_dependencies.py:27
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_dependencies.py:33
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_dependencies.py:39
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_dependencies.py:47
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_dependencies.py:232
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_dependencies.py:255
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_elicitation_relay.py:36
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_elicitation_relay.py:56
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_elicitation_relay.py:77
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_elicitation_relay.py:101
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_elicitation_relay.py:125
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_elicitation_relay.py:147
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_elicitation_relay.py:179
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:40
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:55
@server.tool(task=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:69
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:102
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:124
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:166
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:192
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:213
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:228
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:255
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:278
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_meta_parameter.py:299
@server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_metadata.py:19
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_methods.py:21
@mcp.tool(task=True)  # Enable background execution
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_methods.py:26
@mcp.tool(task=True)  # Enable background execution
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_methods.py:31
@mcp.tool(task=True)  # Enable background execution
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_methods.py:84
@endpoint_server.tool(task=True)  # Enable background execution
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_methods.py:191
@endpoint_server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:49
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:54
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:60
@mcp.tool(task=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:88
@parent.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:309
@child.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:330
@child.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:354
@child.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:377
@child.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:398
@grandchild.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:426
@child1.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:430
@child2.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:459
@child1.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:463
@child2.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:487
@child1.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:491
@child2.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:511
@grandchild.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:556
@child.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:601
@mcp.tool(task=TaskConfig(mode="optional"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:606
@mcp.tool(task=TaskConfig(mode="required"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:611
@mcp.tool(task=TaskConfig(mode="forbidden"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:752
@grandchild.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:913
@child.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_mount.py:986
@grandchild.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_protocol.py:19
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_protocol.py:24
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_protocol.py:53
@task_enabled_server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_protocol.py:70
@task_enabled_server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/server/tasks/test_task_proxy.py:63
return create_proxy(FastMCPTransport(backend_server))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_proxy.py:32
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_proxy.py:37
@mcp.tool(task=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:38
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:43
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:48
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:53
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:58
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:63
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:68
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:73
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:237
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:241
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:245
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:249
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:305
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:309
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:313
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:317
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:377
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:381
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:385
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:389
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:458
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:462
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:466
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:470
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:474
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:478
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:573
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:577
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:585
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:594
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_return_types.py:600
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_security.py:19
@mcp.tool(task=True)  # Enable background execution
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_status_notifications.py:25
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_status_notifications.py:30
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_status_notifications.py:36
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_tools.py:22
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_tools.py:27
@mcp.tool(task=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_tools.py:63
@tool_server.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_ttl.py:21
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/tasks/test_task_ttl.py:25
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_icons.py:64
@mcp.tool(icons=icons)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_icons.py:306
@mcp.tool(icons=icons)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_pagination.py:117
@server.tool(name=f"tool_{i}")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_pagination.py:161
@server.tool(name=f"tool_{i}")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_pagination.py:200
@server.tool(name=f"tool_{i}")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_pagination.py:215
@server.tool(name=f"tool_{i}")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_pagination.py:519
@server.tool(name=f"tool_{i}")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_server.py:320
@mcp.tool(tags={"tool-example", "test-tool-tag"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_server_docket.py:39
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_server_docket.py:58
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_server_docket.py:82
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_server_docket.py:115
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_server_docket.py:134
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_server_docket.py:153
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_server_docket.py:173
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_server_docket.py:211
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:58
@mcp.tool(tags={"finance"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:82
@mcp.tool(tags={"internal"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:106
@mcp.tool(tags={"finance"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:136
@mcp.tool(tags={"finance"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:171
@mcp.tool(tags={"finance"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:201
@mcp.tool(version="1.0.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:205
@mcp.tool(version="2.0.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:237
@mcp.tool(tags={"finance"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:275
@mcp.tool(tags={"finance"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:279
@mcp.tool(tags={"admin"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:309
@mcp.tool(tags={"test"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:520
@mcp.tool(tags={"finance"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:577
@mcp.tool(tags={"premium"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:632
@mcp.tool(tags={"system"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:636
@mcp.tool(tags={"env"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:641
@mcp.tool(tags={"env"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:669
@mcp.tool(tags={"system"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:673
@mcp.tool(tags={"env"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:678
@mcp.tool(tags={"env"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:707
@mcp.tool(tags={"system"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_session_visibility.py:748
@mcp.tool(tags={"system"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_tool_annotations.py:123
@mcp.tool(annotations=annotations)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_tool_annotations.py:151
@mcp.tool(annotations=annotations)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_tool_annotations.py:227
@mcp.tool(task=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/test_tool_annotations.py:245
@mcp.tool(task=False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/transforms/test_catalog.py:236
@mcp.tool(auth=lambda _ctx: False)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:53
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:57
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:61
@mcp.tool(version="3.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:89
@mcp.tool(version="1.0@beta")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:101
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:105
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:183
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:187
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:260
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:292
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_calls.py:296
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:22
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:26
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:30
@mcp.tool(version="3.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:56
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:60
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:64
@mcp.tool(version="3.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:94
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:98
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:102
@mcp.tool(version="2.5")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:106
@mcp.tool(version="3.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:141
@mcp.tool(version="5.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:162
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:166
@mcp.tool(version="5.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:181
@mcp.tool(version="2025-01-01")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:185
@mcp.tool(version="2025-06-01")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:189
@mcp.tool(version="2025-12-01")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:207
@mcp.tool(version="5.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:367
@child.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:462
@child.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:466
@child.tool(version="0.5")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:485
@child.tool(version="5.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:510
@child.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:514
@child.tool(version="3.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:534
@child.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:538
@child.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:542
@child.tool(version="3.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_filtering.py:573
@mcp.tool(version="5.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:22
@mcp.tool(version="1")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:26
@mcp.tool(version="10")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:30
@mcp.tool(version="2")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:54
@mcp.tool(version="1.2.3")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:58
@mcp.tool(version="1.2.10")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:62
@mcp.tool(version="1.10.1")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:81
@mcp.tool(version="v1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:85
@mcp.tool(version="v2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:108
@child.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:155
@child.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:159
@child.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:180
@child.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:184
@child.tool(version="3.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:188
@child.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:210
@child.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:214
@child.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:230
@child.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:234
@child.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:316
@level3.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_mounting.py:320
@level3.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_versioning.py:94
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_versioning.py:122
@mcp.tool(version=2)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_versioning.py:135
@mcp.tool(version=0)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_versioning.py:148
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_versioning.py:152
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_versioning.py:171
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_versioning.py:175
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_versioning.py:197
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_versioning.py:207
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:45
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:49
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:64
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:68
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:82
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:86
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:101
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:105
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:118
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:122
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:135
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:139
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:143
@mcp.tool(version="3.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:267
@mcp.tool(version="1.0", auth=require_scopes("admin"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:271
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:285
@mcp.tool(version="1.0", auth=require_scopes("admin"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:289
@mcp.tool(version="2.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:359
@mcp.tool(version="1.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:363
@mcp.tool(version="2.0", auth=require_scopes("admin"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/server/versioning/test_visibility_version_fallback.py:367
@mcp.tool(version="3.0")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps.py:212
@server.tool(app=AppConfig(resource_uri="ui://my-app/view.html"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps.py:224
@server.tool(app={"resourceUri": "ui://foo", "visibility": ["app"]})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps.py:242
@server.tool(meta={"custom": "data"}, app=AppConfig(resource_uri="ui://app"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps.py:255
@server.tool(app=AppConfig(resource_uri="ui://app", visibility=["app"]))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps.py:470
@server.tool(app=AppConfig(resource_uri="ui://app"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps.py:593
@server.tool(app=PrefabAppConfig())
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps.py:608
@server1.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps.py:612
@server2.tool(app=PrefabAppConfig())
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:108
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:125
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:135
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:147
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:160
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:164
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:176
@mcp.tool(app=AppConfig(resource_uri="ui://custom/app.html"))
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:377
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:394
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:414
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_apps_prefab.py:429
@mcp.tool(app=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:73
@app.tool(name="my_tool")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:137
@app.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:149
@app.tool(description="Save a contact")
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:157
@app.tool(auth=check)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:164
@app.tool(timeout=30.0)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:447
"""@app.tool(model=True) has app visibility and IS findable."""
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:450
@app.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:512
@app.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:540
@app.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:558
@app.tool(auth=deny_all)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:637
"""@app.tool(model=True) (visibility=["app","model"]) appears in list_tools."""
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:640
@app.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_fastmcp_app.py:740
@app.tool(model=True)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/test_mcp_config.py:767
@mcp.tool(tags={"keep"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/tools/test_tool_timeout.py:47
@mcp.tool(timeout=5.0)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/tools/test_tool_timeout.py:60
@mcp.tool(timeout=5.0)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/tools/test_tool_timeout.py:73
@mcp.tool(timeout=0.2)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/tools/test_tool_timeout.py:98
@mcp.tool(timeout=0.1)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/tools/test_tool_timeout.py:126
@mcp.tool(timeout=0.0)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/tools/test_tool_timeout.py:138
@mcp.tool(task=True, timeout=1.0)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/tools/test_tool_timeout.py:154
@mcp.tool(timeout=1.0)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/tools/test_tool_timeout.py:159
@mcp.tool(timeout=5.0)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/tools/test_tool_timeout.py:185
@mcp.tool(timeout=0.1)
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/tools/tool_transform/test_tool_transform.py:601
proxy = FastMCP.as_proxy(FastMCPTransport(mcp_server))
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Proxy/relay pattern forwarding MCP requests

high

Detected proxy, relay, or forwarding patterns targeting MCP, tool, or server endpoints. A relay server can silently intercept, modify, or exfiltrate MCP tool requests and responses.

tests/tools/tool_transform/test_tool_transform.py:604
async def test_transform_proxy(self, proxy_server: FastMCP):
How to fix

Remove unauthorized proxy or relay layers from the MCP pipeline. If proxying is required, ensure it is explicitly documented and uses authenticated, encrypted channels.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/utilities/test_inspect.py:284
@mcp.tool(tags={"fetch"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/utilities/test_inspect.py:364
@mounted.tool(tags={"allowed"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/utilities/test_inspect.py:368
@mounted.tool(tags={"blocked"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/utilities/test_inspect.py:433
@mounted.tool(tags={"production"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/utilities/test_inspect.py:437
@mounted.tool(tags={"development"})
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Undocumented dynamic tool registration

high

Detected server.tool() being called with a variable instead of a string literal for the tool name. Dynamic tool registration can be used to inject tools at runtime that were not part of the original server definition.

tests/utilities/test_inspect_icons.py:248
@mcp.tool(icons=[Icon(src=data_uri, mimeType="image/png")])
How to fix

Always use static string literals for tool names when calling server.tool(). Avoid registering tools from variables, configuration, or user input.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:86
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:100
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:124
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:133
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:145
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:159
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:176
result = await client.call_tool("like", {"uri": save_uri})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:181
result = await client.call_tool("repost", {"uri": save_uri})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:186
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/atproto_mcp/demo.py:194
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/auth/aws_oauth/client.py:29
result = await client.call_tool("get_access_token_claims")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/auth/propelauth_oauth/client.py:28
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/auth/scalekit_oauth/client.py:28
result = await client.call_tool("echo", {"message": "Hello from Scalekit!"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/code_mode/client.py:97
result = await client.call_tool("search", {"query": "add multiply numbers"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/code_mode/client.py:125
result = await client.call_tool("execute", {"code": code})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/diagnostics/client_with_tracing.py:73
result = await client.call_tool("ping", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/diagnostics/client_with_tracing.py:92
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/in_memory_proxy_example.py:67
result = await final_client.call_tool("echo", {"message": message_to_echo})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/namespace_activation/client.py:47
result = await client.call_tool("activate_finance", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/namespace_activation/client.py:55
result = await client.call_tool("get_market_data", {"symbol": "AAPL"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/namespace_activation/client.py:60
result = await client.call_tool("activate_admin", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/namespace_activation/client.py:68
result = await client.call_tool("deactivate_all", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/persistent_state/client.py:31
result = await alice.call_tool("list_session_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/persistent_state/client.py:40
result = await alice.call_tool("get_value", {"key": "user"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/persistent_state/client.py:43
result = await alice.call_tool("get_value", {"key": "secret"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/persistent_state/client.py:53
result = await bob.call_tool("list_session_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/persistent_state/client.py:75
result = await alice_again.call_tool("list_session_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/persistent_state/client_stdio.py:36
result = await alice.call_tool("list_session_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/persistent_state/client_stdio.py:57
result = await bob.call_tool("list_session_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/persistent_state/client_stdio.py:78
result = await alice_again.call_tool("list_session_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/prompts_as_tools/client.py:28
result = await client.call_tool("list_prompts", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/prompts_as_tools/client.py:45
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/prompts_as_tools/client.py:58
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/providers/sqlite/server.py:127
result = await client.call_tool("add_numbers", {"a": 10, "b": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/providers/sqlite/server.py:132
result = await client.call_tool("multiply_numbers", {"a": 7, "b": 6})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/resources_as_tools/client.py:28
result = await client.call_tool("list_resources", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/resources_as_tools/client.py:41
result = await client.call_tool("read_resource", {"uri": "config://app"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/resources_as_tools/client.py:47
result = await client.call_tool("read_resource", {"uri": "user://42/profile"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/sampling/structured_output.py:84
result = await client.call_tool("analyze_sentiment", {"text": text})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/sampling/text.py:70
result = await client.call_tool("write_haiku", {"topic": "Python programming"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/sampling/tool_use.py:113
result = await client.call_tool("ask_assistant", {"question": question})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/search/client_bm25.py:98
result = await client.call_tool("search_tools", {"query": "work with numbers"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/search/client_bm25.py:112
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/search/client_bm25.py:133
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/search/client_regex.py:97
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/search/client_regex.py:113
result = await client.call_tool("search_tools", {"pattern": "text|string|word"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/search/client_regex.py:132
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/search/client_regex.py:145
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/tasks/client.py:149
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

examples/versioning/version_filters.py:86
result = await client.call_tool("process", {"data": "Hello"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

src/fastmcp/cli/client.py:530
result = await client.call_tool(tool_name, parsed_args, raise_on_error=False)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

src/fastmcp/cli/generate.py:379
result = await client.call_tool(tool_name, filtered, raise_on_error=False)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

src/fastmcp/client/client.py:186
result = await client.call_tool("my_tool", {"param": "value"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

src/fastmcp/contrib/bulk_tool_caller/bulk_tool_caller.py:83
result = await self._call_tool(tool_call.tool, tool_call.arguments)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

src/fastmcp/contrib/bulk_tool_caller/bulk_tool_caller.py:111
result = await self._call_tool(tool, tool_call_arguments)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

src/fastmcp/experimental/transforms/code_mode.py:550
result = await ctx.fastmcp.call_tool(tool.name, params)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

src/fastmcp/server/mixins/mcp_operations.py:235
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

src/fastmcp/server/providers/fastmcp_provider.py:160
result = await self._server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

src/fastmcp/utilities/tests.py:187
result = await client.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_approval.py:11
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_approval.py:20
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_approval.py:52
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_choice.py:11
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_choice.py:34
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_choice.py:43
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_file_upload.py:30
result = await server.call_tool("Files___store_files", {"files": files})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_file_upload.py:34
result = await server.call_tool("list_files", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_file_upload.py:44
result = await server.call_tool("read_file", {"name": "test.txt"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_file_upload.py:55
result = await server.call_tool("read_file", {"name": "image.png"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_file_upload.py:74
result = await server.call_tool("list_files", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_file_upload.py:91
result = await server.call_tool("read_file", {"name": "test.txt"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_file_upload.py:104
result = await server.call_tool("Uploads___store_files", {"files": files})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_file_upload.py:172
result = await server.call_tool("read_file", {"name": "test.txt"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_form.py:21
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_form.py:47
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/apps/test_form.py:69
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/cli/test_mcp_server_config_integration.py:117
result = await client.call_tool("hello", {"name": "FastMCP"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/auth/test_oauth_client.py:91
result = await client_with_headless_oauth.call_tool("add", {"a": 5, "b": 3})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/auth/test_oauth_static_client.py:273
result = await client.call_tool("add", {"a": 3, "b": 4})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/client/client/test_client.py:183
assert result.description == "Example greeting prompt."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/client/client/test_client.py:196
assert result.description == "Example greeting prompt."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/client/client/test_client.py:692
assert resource.description == "A tagged resource"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/client/client/test_client.py:706
assert template.description == "A tagged template"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/client/test_client.py:53
result = await client.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/client/test_client.py:110
result = await client.call_tool("check_meta", {}, meta=test_meta)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/client/test_client.py:732
result = await client.call_tool("list_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/client/test_client.py:748
result = await client.call_tool("dict_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/client/test_initialize.py:114
result = await client.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/client/test_session.py:111
result = await client.call_tool("greet", {"name": "Test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/client/tasks/test_task_context_validation.py:114
assert result1.description == "Prompt that runs in background."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/client/tasks/test_task_context_validation.py:120
assert result2.description == "Prompt that runs in background."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/telemetry/test_client_tracing.py:27
result = await client.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:69
result = await client.call_tool("ask_for_name")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:82
result = await client.call_tool("ask_for_name")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:142
result = await client.call_tool("ask_for_optional_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:167
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:189
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:229
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:247
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:265
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:283
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:303
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:325
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:343
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:367
result = await client.call_tool("failing_elicit", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:410
result = await client.call_tool("multi_step_form", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:482
result = await client.call_tool("get_user_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:529
result = await client.call_tool("get_data", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:609
result = await client.call_tool("pattern_match_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:634
result = await client.call_tool("pattern_match_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation.py:659
result = await client.call_tool("pattern_match_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation_enums.py:59
result = await client.call_tool("ask_for_name")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation_enums.py:186
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation_enums.py:219
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation_enums.py:260
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_elicitation_enums.py:324
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_openapi.py:89
result = await client.call_tool("post_headers_headers_post")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_openapi.py:96
result = await client.call_tool("post_headers_headers_post")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_openapi.py:149
result = await client.call_tool("post_headers_headers_post")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_openapi.py:158
result = await client.call_tool("post_headers_headers_post")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_roots.py:40
result = await client.call_tool("list_roots", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/client/test_sampling.py:311
assert tool.description == "Search the web for results."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling.py:80
result = await client.call_tool("simple_sample", {"message": "Hello, world!"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling.py:92
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling.py:114
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling.py:135
call_tool_result = await client.call_tool("sample_with_fallback")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling.py:149
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling.py:297
result = await client.call_tool("sample_with_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_result_types.py:54
result = await client.call_tool("math_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_result_types.py:133
result = await client.call_tool("research", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_result_types.py:200
result = await client.call_tool("validate_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_result_types.py:254
result = await client.call_tool("check_result", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_result_types.py:286
result = await client.call_tool("test_step", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_result_types.py:344
result = await client.call_tool("test_step", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_result_types.py:395
result = await client.call_tool("test_step", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_result_types.py:440
result = await client.call_tool("test_step", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_tool_loop.py:68
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_tool_loop.py:131
result = await client.call_tool("multi_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_tool_loop.py:186
result = await client.call_tool("test_unknown", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_tool_loop.py:260
result = await client.call_tool("test_exception", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_tool_loop.py:358
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_tool_loop.py:436
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_tool_loop.py:516
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_tool_loop.py:606
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_tool_loop.py:676
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_sampling_tool_loop.py:757
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_stdio.py:347
result = await client.call_tool("pid")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_stdio.py:372
result = await client.call_tool("pid")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_stdio.py:383
result = await client.call_tool("pid")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_stdio.py:426
result = await proxy.call_tool("pid")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_stdio.py:440
result = await proxy.call_tool("pid")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_stdio.py:528
result = await client.call_tool("pid")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_stdio.py:635
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_streamable_http.py:204
result = await client.call_tool("greet_with_progress", {"name": "Alice"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_streamable_http.py:230
result = await client.call_tool("elicit")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/client/test_streamable_http.py:250
result = await client.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/deprecated/test_add_tool_transformation.py:55
result = await client.call_tool("short", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/deprecated/test_exclude_args.py:90
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/deprecated/test_import_server.py:350
assert result.description == "Example greeting prompt."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/deprecated/test_import_server.py:245
result = await client.call_tool("api_get_data", {"query": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/deprecated/test_import_server.py:299
result = await client.call_tool("service_provider_compute", {"input": 21})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/deprecated/test_import_server.py:323
result = await client.call_tool("api_get_data", {"query": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/deprecated/test_import_server.py:458
tool_result = await client.call_tool("sub_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/deprecated/test_import_server.py:503
result = await client.call_tool("shared_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/deprecated/test_import_server.py:625
result = await client.call_tool("api_shared_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/experimental/transforms/test_code_mode.py:306
assert by_name["execute"].description == "Custom execute description"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:130
result = await _run_tool(mcp, "search", {"query": "square number"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:149
result = await _run_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:170
result = await _run_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:191
result = await _run_tool(mcp, "get_schema", {"tools": ["square"], "detail": "full"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:210
result = await _run_tool(mcp, "get_schema", {"tools": ["square"]})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:226
result = await _run_tool(mcp, "get_schema", {"tools": ["nonexistent"]})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:243
result = await _run_tool(mcp, "get_schema", {"tools": ["square", "nonexistent"]})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:259
result = await _run_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:383
result = await _run_tool(mcp, "list_all", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:399
result = await _run_tool(mcp, "search", {"query": "square", "detail": "detailed"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:423
result = await _run_tool(mcp, "search", {"query": "square"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:505
result = await _run_tool(mcp, "search", {"query": "secret"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:527
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:561
result = await _run_tool(mcp, "search", {"query": "protected"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:584
result = await _run_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:636
result = await _run_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode.py:658
result = await _run_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:113
result = await _run_tool(mcp, "tags", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:139
result = await _run_tool(mcp, "tags", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:165
result = await _run_tool(mcp, "tags", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:185
result = await _run_tool(mcp, "tags", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:210
result = await _run_tool(mcp, "tags", {"detail": "full"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:228
result = await _run_tool(mcp, "tags", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:253
result = await _run_tool(mcp, "search", {"query": "add hello", "tags": ["math"]})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:269
result = await _run_tool(mcp, "search", {"query": "add", "tags": ["nonexistent"]})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:290
result = await _run_tool(mcp, "search", {"query": "add hello"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:312
result = await _run_tool(mcp, "search", {"query": "ping add", "tags": ["untagged"]})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:334
result = await _run_tool(mcp, "search", {"query": "square"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:351
result = await _run_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:371
result = await _run_tool(mcp, "get_schema", {"tools": []})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:387
result = await _run_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:423
result = await _run_tool(mcp, "search", {"query": "add numbers"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:440
result = await _run_tool(mcp, "search", {"query": "add numbers"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:471
result = await _run_tool(mcp, "search", {"query": "numbers", "limit": 1})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:505
result = await _run_tool(mcp, "search", {"query": "tool"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:536
result = await _run_tool(mcp, "list_tools", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:561
result = await _run_tool(mcp, "list_tools", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:584
result = await _run_tool(mcp, "list_tools", {"detail": "full"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/experimental/transforms/test_code_mode_discovery.py:602
result = await _run_tool(mcp, "list_tools", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/fs/test_provider.py:307
result = await client.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/integration_tests/auth/test_github_provider_integration.py:362
result = await github_client_with_mock.call_tool("get_protected_data", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/integration_tests/auth/test_github_provider_integration.py:366
result = await github_client_with_mock.call_tool("get_user_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/integration_tests/test_github_mcp_remote.py:106
result = await streamable_http_client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/integration_tests/test_timeout_fix.py:50
result = await client.call_tool("slow_tool", {"duration": 6})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/prompts/test_prompt.py:570
assert result.description == "A greeting prompt"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/prompts/test_prompt.py:581
assert mcp_result.description == "Test"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/prompts/test_standalone_decorator.py:88
assert decorated.__fastmcp__.description == "Analyzes topics"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/resources/test_file_resources.py:43
assert resource.description == "test file"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/resources/test_function_resources.py:25
assert resource.description == "test function"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/resources/test_standalone_decorator.py:87
assert decorated.__fastmcp__.description == "Gets app configuration"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/auth/test_authorization.py:641
result = await client.call_tool("admin_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/auth/test_authorization.py:786
result = await client.call_tool("my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/http/test_http_dependencies.py:92
result = await client.call_tool("get_headers_tool")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/http/test_http_dependencies.py:101
result = await client.call_tool("get_headers_tool")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/http/test_http_dependencies.py:158
result = await client.call_tool("check_excluded_headers")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_caching.py:634
result = await client.call_tool("child_add", {"a": 5, "b": 3})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_initialization_middleware.py:147
result = await client.call_tool("test_tool", {"x": 42})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_initialization_middleware.py:246
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_initialization_middleware.py:251
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_initialization_middleware.py:255
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_middleware.py:460
result = await client.call_tool("add", {"a": 1, "b": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_middleware.py:480
result = await server.call_tool("add", {"a": 1, "b": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_middleware.py:496
result = await server.call_tool("add", {"a": 1, "b": 2}, run_middleware=False)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_middleware_nested.py:544
result = await client.call_tool("allowed_tool", {"x": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_middleware_nested.py:598
result = await client.call_tool("public_tool", {"x": 10})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_middleware_nested.py:646
result = await client.call_tool("read_it")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_ping.py:212
result = await client.call_tool("hello")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_rate_limiting.py:302
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_rate_limiting.py:460
result = await client.call_tool("quick_action", {"message": "after_wait"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_response_limiting.py:34
result = await client.call_tool("small_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_response_limiting.py:47
result = await client.call_tool("large_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_response_limiting.py:69
result = await client.call_tool("limited_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_response_limiting.py:73
result = await client.call_tool("unlimited_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_response_limiting.py:85
result = await client.call_tool("any_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_response_limiting.py:100
result = await client.call_tool("large_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_response_limiting.py:117
result = await client.call_tool("multi_block", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_response_limiting.py:135
result = await client.call_tool("binary_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_response_limiting.py:167
result = await mcp_server.call_tool("big_answer", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_timing.py:85
result = await middleware.on_call_tool(context, mock_call_next)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/middleware/test_tool_injection.py:218
assert multiply_tool.description == "Multiply two numbers."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_tool_injection.py:162
power_result = await client.call_tool("power", {"a": 2, "b": 3})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_tool_injection.py:167
modulo_result = await client.call_tool("modulo", {"a": 10, "b": 3})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/middleware/test_tool_injection.py:191
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_advanced.py:38
result = await main_app.call_tool("sub_dynamic_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_advanced.py:272
result = await root.call_tool("middle_multiply", {"a": 3, "b": 4})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_advanced.py:276
result = await root.call_tool("middle_leaf_add", {"a": 5, "b": 7})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_advanced.py:377
result = await root.call_tool("l1_l2_l3_deep_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_advanced.py:448
result = await main.call_tool("prefix_renamed", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_advanced.py:504
result = await client.call_tool("sub_my_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_filtering.py:34
result = await parent.call_tool("allowed_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_mount.py:44
result = await main_app.call_tool("sub_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_mount.py:64
result = await main_app.call_tool("sub_greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_mount.py:100
result = await main_app.call_tool("sub_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_mount.py:120
tool_result = await main_app.call_tool("sub_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_mount.py:290
result = await client.call_tool("working_working_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_mount.py:348
result = await main_app.call_tool("shared_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_mount.py:375
result = await main_app.call_tool("api_shared_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_proxy.py:39
result = await main_app.call_tool("proxy_get_data", {"query": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/mount/test_proxy.py:64
result = await main_app.call_tool("proxy_dynamic_data", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_context.py:67
result = await mcp.call_tool("tool_with_context", {"x": 42})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_context.py:79
result = await mcp.call_tool("async_tool", {"x": 42})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_context.py:90
result = await mcp.call_tool("no_context", {"x": 21})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_context.py:108
result = await mcp.call_tool("tool_with_resource", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_context.py:136
result = await mcp.call_tool("MyTool", {"x": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_context.py:161
result = await mcp.call_tool("decorated_tool", {"query": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/providers/local_provider_tools/test_decorator.py:94
assert tool.description == "Add two numbers"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:57
result = await mcp.call_tool("add", {"x": 1, "y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:71
result = await mcp.call_tool("add", {"x": 1, "y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:81
result = await mcp.call_tool("custom-add", {"x": 1, "y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:108
result = await mcp.call_tool("add", {"y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:122
result = await mcp.call_tool("add", {"y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:134
result = await mcp.call_tool("add", {"x": 1, "y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:144
result = await mcp.call_tool("add", {"x": 1, "y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:169
result = await mcp.call_tool("add", {"y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:181
result = await mcp.call_tool("add", {"x": 1, "y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:194
result = await mcp.call_tool("add_v1", {"x": 1, "y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:222
result = await mcp.call_tool("custom_multiply", {"a": 5, "b": 3})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:284
result = await mcp.call_tool("direct_call_tool", {"x": 5, "y": 3})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_decorator.py:300
result = await mcp.call_tool("string_named_tool", {"x": 42})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:59
result = await mcp.call_tool("string_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:69
result = await mcp.call_tool("bytes_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:81
result = await mcp.call_tool("uuid_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:93
result = await mcp.call_tool("path_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:105
result = await mcp.call_tool("datetime_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:118
result = await mcp.call_tool("image_tool", {"path": str(image_path)})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:138
result = await mcp.call_tool("audio_tool", {"path": str(audio_path)})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:157
result = await mcp.call_tool("file_tool", {"path": str(file_path)})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:171
result = await tool_server.call_tool("mixed_content_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:199
result = await tool_server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:226
result = await tool_server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_local_provider_tools.py:253
result = await tool_server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:97
result = await mcp.call_tool("f", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:123
result = await mcp.call_tool("f", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:141
result = await mcp.call_tool("simple_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:176
result = await mcp.call_tool("explicit_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:197
result = await mcp.call_tool("primitive_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:221
result = await mcp.call_tool("complex_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:246
result = await mcp.call_tool("dataclass_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:261
result = await mcp.call_tool("mixed_output", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:279
result = await server.call_tool("list_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:291
result = await server.call_tool("dict_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:308
result = await mcp.call_tool("edge_case_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_output_schema.py:334
result = await mcp.call_tool("alias_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:104
result = await mcp.call_tool("process_image", {"image": b"fake png data"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:134
result = await mcp.call_tool("add_one", {"x": "42"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:145
result = await mcp.call_tool("toggle", {"flag": "true"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:148
result = await mcp.call_tool("toggle", {"flag": "false"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:215
result = await mcp.call_tool("analyze", {"x": "a"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:250
result = await mcp.call_tool("analyze", {"x": "red"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:262
result = await mcp.call_tool("analyze", {"x": 1})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:265
result = await mcp.call_tool("analyze", {"x": 1.0})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:284
result = await mcp.call_tool("send_path", {"path": str(test_path)})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:309
result = await mcp.call_tool("send_uuid", {"x": test_uuid})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:333
result = await mcp.call_tool("send_datetime", {"x": dt})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:343
result = await mcp.call_tool("send_datetime", {"x": "2021-01-01T00:00:00"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:365
result = await mcp.call_tool("send_date", {"x": datetime.date.today()})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:377
result = await mcp.call_tool("send_date", {"x": "2021-01-01"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:387
result = await mcp.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/local_provider_tools/test_parameters.py:400
result = await mcp.call_tool("send_timedelta", {"x": 1000})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/openapi/test_comprehensive.py:883
result = await mcp_client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/openapi/test_comprehensive.py:915
result = await mcp_client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/openapi/test_openapi_features.py:931
result = await mcp_client.call_tool("get_user", {"id": 1})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/openapi/test_openapi_features.py:961
result = await mcp_client.call_tool("get_user", {"id": 1})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_client.py:133
result = await client.call_tool("list_roots", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_client.py:175
result = await client.call_tool("sampling", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_client.py:221
result = await client.call_tool("elicit", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_client.py:237
result = await client.call_tool("elicit", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_client.py:400
result = await client.call_tool("elicit_with_defaults", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_server.py:178
result = await client.call_tool("greet", {"name": "Test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_server.py:186
result = await client.call_tool("greet", {"name": "Test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_server.py:214
result = await client.call_tool("greet", {"name": "Test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_server.py:302
result = await client.call_tool("add_transformed", {"a": 1, "b": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_server.py:325
proxy_result = await client.call_tool("add", {"a": 1, "b": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_server.py:345
result = await client.call_tool("tool_with_meta", {"value": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_server.py:361
result = await client.call_tool("greet", {"name": "Marvin", "extra": "abc"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_proxy_server.py:885
result = await proxy.call_tool("greet", {"name": "Alice"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/proxy/test_stateful_proxy_client.py:112
result = await client.call_tool("stateful_get", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/test_fastmcp_provider.py:127
result = await client.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/test_fastmcp_provider.py:327
result = await client.call_tool("c_gc_compute", {"x": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/providers/test_local_provider.py:664
assert tool.description == "New description"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/test_local_provider.py:406
result = await client.call_tool("add", {"a": 2, "b": 3})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/test_local_provider.py:833
result = await client.call_tool("duplicate_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/providers/test_local_provider_prompts.py:106
assert prompt.description == "A custom description"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/providers/test_local_provider_resources.py:349
assert resources[0].description == "Data resource"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/providers/test_local_provider_resources.py:570
assert templates[0].description == "Template description"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/providers/test_skills_provider.py:91
assert provider.skill_info.description == "A test skill"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/providers/test_skills_provider.py:336
assert simple_skill.description == "A simple test skill"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/providers/test_skills_provider.py:465
assert main_resource.description == "My Skill Title"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/providers/test_skills_provider.py:575
assert main_resource.description == "First occurrence"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/test_transforming_provider.py:122
result = await client.call_tool("renamed", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/providers/test_transforming_provider.py:258
result = await client.call_tool("short", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/sampling/test_prepare_tools.py:60
assert result[0].description == "Search the web."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/sampling/test_sampling_tool.py:26
assert tool.description == "Search the web."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/sampling/test_sampling_tool.py:41
assert tool.description == "Search the internet"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/sampling/test_sampling_tool.py:60
assert tool.description == "Async search."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/sampling/test_sampling_tool.py:127
assert sdk_tool.description == "Search the web."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/sampling/test_sampling_tool.py:145
assert sampling_tool.description == "Search the web."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/sampling/test_sampling_tool.py:165
assert sampling_tool.description == "Search the internet"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/sampling/test_sampling_tool.py:184
assert sampling_tool.description == "Original tool."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_custom_subclass_tasks.py:71
result = await client.call_tool("custom_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_custom_subclass_tasks.py:103
result = await client.call_tool("custom_forbidden", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_progress_dependency.py:20
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_progress_dependency.py:59
result = await client.call_tool("count_to_ten", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_progress_dependency.py:145
result = await client.call_tool("test_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_resource_task_meta_parameter.py:191
result = await client.call_tool("outer_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_resource_task_meta_parameter.py:210
result = await client.call_tool("outer_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_resource_task_meta_parameter.py:227
result = await client.call_tool("outer_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_resource_task_meta_parameter.py:247
result = await client.call_tool("outer_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_config.py:142
result = await client.call_tool("forbidden_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_config.py:148
result = await client.call_tool("optional_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_meta_parameter.py:30
result = await server.call_tool("simple_tool", {"x": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_meta_parameter.py:45
result = await server.call_tool("task_enabled_tool", {"x": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_meta_parameter.py:80
result = await client.call_tool("auto_key_tool", {}, task=True)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_meta_parameter.py:219
result = await client.call_tool("immediate_tool", {"x": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_meta_parameter.py:262
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_meta_parameter.py:270
result = await client.call_tool("outer_tool", {"x": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_meta_parameter.py:285
result = await server.call_tool("inner_tool", {"x": x})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_meta_parameter.py:292
result = await client.call_tool("outer_tool", {"x": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_meta_parameter.py:306
result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_meta_parameter.py:312
result = await client.call_tool("outer_tool", {"x": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:628
result = await client.call_tool("child_optional_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:660
result = await client.call_tool("child_forbidden_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:923
result = await parent.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:929
result = await client.call_tool("outer", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:953
result = await client.call_tool("outer", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:977
result = await client.call_tool("outer", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:998
result = await parent.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:1004
result = await client.call_tool("outer", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:1031
result = await client.call_tool("outer", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:1055
result = await client.call_tool("outer", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_mount.py:1082
result = await client.call_tool("outer", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_proxy.py:72
result = await client.call_tool("add_numbers", {"a": 5, "b": 3})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_proxy.py:78
result = await client.call_tool("sync_only_tool", {"message": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_return_types.py:131
immediate_result = await client.call_tool(tool_name)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/tasks/test_task_tools.py:39
result = await client.call_tool("simple_tool", {"message": "hello"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/telemetry/test_provider_tracing.py:28
result = await parent.call_tool("child_child_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/telemetry/test_server_tracing.py:24
result = await mcp.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_context.py:451
result = await client.call_tool("get_transport", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_context.py:472
result = await client.call_tool("get_transport", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_context.py:496
result = await client.call_tool("get_transport", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:56
result = await mcp.call_tool("fetch_data", {"query": "users"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:73
result = await mcp.call_tool("greet_user", {"name": "Alice"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:95
result = await mcp.call_tool("query_db", {"sql": "SELECT * FROM users"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:119
result = await mcp.call_tool("call_api", {"endpoint": "users"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:156
result = await mcp.call_tool("use_context", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:174
result = await mcp.call_tool("use_both_contexts", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:187
result = await client.call_tool("get_request_id", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:204
result = await mcp.call_tool("process_data", {"value": 100})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:225
result = await mcp.call_tool("tool_with_cached_dep", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:249
result = await client.call_tool("mixed_deps", {"value": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:384
result = await mcp.call_tool("query_data", {"query": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:449
result = await mcp.call_tool("validated_tool", {"age": 25})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:497
result = await mcp.call_tool("query_sync", {"query": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:597
result = await mcp.call_tool("check_permission", {"action": "read"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:722
result = await client.call_tool("my_tool", {}, raise_on_error=False)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies.py:743
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies_advanced.py:68
result = await client.call_tool("tool_with_optional_context", {"name": "x"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies_advanced.py:79
result = await client.call_tool("tool_with_context", {"name": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies_advanced.py:143
result = await client.call_tool("tool_with_annotated_ctx", {"name": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies_advanced.py:156
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies_advanced.py:193
result = await client.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies_advanced.py:208
result = await client.call_tool("static_tool", {"name": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_dependencies_advanced.py:228
result = await client.call_tool("CallableTool", {"x": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:62
result = await client.call_tool("add_numbers", {"a": "10", "b": "20"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:77
result = await client.call_tool("multiply", {"x": "5", "y": "3"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:91
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:125
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:150
result = await client.call_tool("create_user", {"profile": stringified})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:181
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:299
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:315
result = await client.call_tool("process_optional", {"value": None})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:343
result = await client.call_tool("toggle", {"enabled": "true"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:348
result = await client.call_tool("toggle", {"enabled": "false"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_input_validation.py:363
result = await client.call_tool("sum_numbers", {"numbers": ["1", "2", "3"]})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_providers.py:171
result = await base_server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_providers.py:187
result = await base_server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_providers.py:203
result = await base_server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_providers.py:238
result = await base_server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_providers.py:277
result = await base_server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_providers.py:377
result = await mcp.call_tool("test_tool", {"a": 1, "b": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server.py:50
result = await client.call_tool("hello_world", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server.py:308
result = await client.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_docket.py:30
result = await client.call_tool("regular_tool", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_docket.py:49
result = await client.call_tool("check_docket", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_docket.py:72
result = await client.call_tool("check_worker", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_docket.py:103
result = await client.call_tool("schedule_work", {"task_name": "test-task"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_docket.py:226
result = await client.call_tool("check_both", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_lifespan.py:115
result = await client.call_tool("get_db_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_lifespan.py:145
result = await client.call_tool("get_info", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_lifespan.py:180
result = await client.call_tool("get_both", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_lifespan.py:226
result = await client.call_tool("get_all", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_lifespan.py:259
result = await client.call_tool("get_context", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_lifespan.py:297
result = await client.call_tool("get_context", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_server_lifespan.py:322
result = await client.call_tool("get_context", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_session_visibility.py:73
result = await client.call_tool("activate_finance", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_session_visibility.py:97
result = await client.call_tool("deactivate_internal", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_session_visibility.py:158
result = await client.call_tool("check_rules", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_tool_annotations.py:217
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/test_tool_transformation.py:277
assert tool.description == "My endpoint"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/test_tool_transformation.py:81
result = await client.call_tool("transformed_tool", {"message": "test"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_catalog.py:121
result = await mcp.call_tool("count_tools", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_catalog.py:144
result = await mcp.call_tool("read_catalog", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_catalog.py:179
result = await mcp.call_tool("read_catalog", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_catalog.py:221
result = await mcp.call_tool("read_catalog", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_catalog.py:243
result = await mcp.call_tool("read_catalog", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_prompts_as_tools.py:68
result = await client.call_tool("list_prompts", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_prompts_as_tools.py:87
result = await client.call_tool("list_prompts", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_prompts_as_tools.py:108
result = await client.call_tool("list_prompts", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_prompts_as_tools.py:127
result = await client.call_tool("get_prompt", {"name": "simple_prompt"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_prompts_as_tools.py:147
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_prompts_as_tools.py:195
result = await client.call_tool("list_prompts", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:70
result = await client.call_tool("list_resources", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:88
result = await client.call_tool("list_resources", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:110
result = await client.call_tool("list_resources", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:128
result = await client.call_tool("list_resources", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:146
result = await client.call_tool("read_resource", {"uri": "config://app"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:160
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:187
result = await client.call_tool("read_resource", {"uri": "data://binary"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:214
result = await client.call_tool("list_resources", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:281
result = await client.call_tool("list_resources", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:316
result = await client.call_tool("read_resource", {"uri": "test://open"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_resources_as_tools.py:339
result = await client.call_tool("list_resources", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/transforms/test_search.py:474
tool_a.description = "find records in the database"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/server/transforms/test_search.py:479
tool_b.description = "send an email to a recipient"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:121
result = await mcp.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:150
result = await mcp.call_tool("search_tools", {"pattern": "delete"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:176
result = await client.call_tool("search_tools", {"pattern": "delete"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:193
result = await client.call_tool("search_tools", {"pattern": "delete"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:201
result = await client.call_tool("search_tools", {"pattern": "delete"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:216
result = await mcp.call_tool("search_tools", {"pattern": "add"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:224
result = await mcp.call_tool("search_tools", {"pattern": "email"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:232
result = await mcp.call_tool("search_tools", {"pattern": "record_id"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:240
result = await mcp.call_tool("search_tools", {"pattern": "recipient"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:248
result = await mcp.call_tool("search_tools", {"pattern": "add|multiply"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:258
result = await mcp.call_tool("search_tools", {"pattern": "ADD"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:266
result = await mcp.call_tool("search_tools", {"pattern": "[invalid"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:275
result = await mcp.call_tool("search_tools", {"pattern": ".*"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:283
result = await mcp.call_tool("search_tools", {"pattern": "zzz_nonexistent"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:291
result = await mcp.call_tool("search_tools", {"pattern": "add"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:308
result = await mcp.call_tool("search_tools", {"query": "database"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:319
result = await mcp.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:331
result = await mcp.call_tool("search_tools", {"query": "number"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:339
result = await mcp.call_tool("search_tools", {"query": "zzz_nonexistent_xyz"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:350
result = await mcp.call_tool("search_tools", {"query": "weather forecast"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:363
result = await mcp.call_tool("search_tools", {"query": "weather forecast"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:371
result = await mcp.call_tool("search_tools", {"query": ""})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/transforms/test_search.py:379
result = await mcp.call_tool("search_tools", {"query": "add numbers"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/versioning/test_calls.py:192
result = await mcp.call_tool("calculate", {"x": 3, "y": 4})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/versioning/test_calls.py:197
result = await mcp.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/versioning/test_calls.py:204
result = await mcp.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/versioning/test_calls.py:301
result = await client.call_tool("calc", {"x": 5}, version=version)
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/versioning/test_mounting.py:46
result = await mcp.call_tool("count", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/versioning/test_mounting.py:221
result = await parent.call_tool("child_double", {"x": 5})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/versioning/test_versioning.py:179
result = await mcp.call_tool("add", {"x": 1, "y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/server/versioning/test_visibility_version_fallback.py:92
result = await mcp.call_tool("calc", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_apps.py:475
result = await client.call_tool("greet", {"name": "Alice"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_apps_prefab.py:385
result = await client.call_tool("greet", {"name": "Alice"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_apps_prefab.py:403
result = await client.call_tool("greet", {"name": "Alice"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/test_fastmcp_app.py:271
assert tools[0].description == "Shows data"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_fastmcp_app.py:505
result = await server.call_tool("contacts___save", {"name": "alice"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_fastmcp_app.py:519
result = await server.call_tool("save", {"name": "bob"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_fastmcp_app.py:533
result = await server.call_tool("crm___save_contact", {"name": "alice"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_fastmcp_app.py:547
result = await server.call_tool("crm_save_contact", {"name": "bob"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_fastmcp_app.py:611
result = await outer.call_tool("deep___hidden", {"x": "found"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_fastmcp_app.py:683
result = await server.call_tool("contacts___save", {"name": "alice"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_fastmcp_app.py:906
backend_result = await server.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_mcp_config.py:581
result = await client.call_tool("test_server_log_test", {"message": "test 42"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_mcp_config.py:642
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/test_mcp_config.py:839
result = await client.call_tool("test_server_elicit_test", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/tools/test_standalone_decorator.py:88
assert decorated.__fastmcp__.description == "Greets people"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_standalone_decorator.py:137
result = await client.call_tool("greet", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:75
result = await client.call_tool("simple_with_context", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:80
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:92
result = await client.call_tool("optional_context", {"name": "World"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:100
result = await client.call_tool("union_with_context", {"value": 42})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:108
result = await client.call_tool("returns_image", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:114
result = await client.call_tool("async_with_context", {})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:122
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:133
result = await client.call_tool("literal_with_context", {"mode": "fast"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:151
result = await client.call_tool("modern_union_tool", {"value": "hello"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:158
result = await client.call_tool("modern_union_tool", {"value": 42})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_future_annotations.py:164
result = await client.call_tool("modern_union_tool", {"value": None})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_timeout.py:26
result = await mcp.call_tool("quick_async_tool")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_timeout.py:39
result = await mcp.call_tool("quick_sync_tool")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_timeout.py:52
result = await mcp.call_tool("fast_async_tool")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/test_tool_timeout.py:65
result = await mcp.call_tool("fast_sync_tool")
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/tool/test_content.py:515
result = await client.call_tool("get_user_info", {"user_id": "123"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/tool/test_content.py:544
result = await client.call_tool("get_profile", {"user_id": "456"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/tool/test_results.py:33
result = await client.call_tool("test_tool", {"unstructured": "test data"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/tool/test_results.py:47
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/tool/test_results.py:58
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/tool/test_results.py:172
result = await client.call_tool(
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/tools/tool/test_title.py:23
assert tool.description == "Custom description"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/tools/tool/test_tool.py:424
assert tool.description == "Add two numbers."
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/tool_transform/test_args.py:426
result = await client.call_tool("new_add", {"x": 1, "y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/tools/tool_transform/test_metadata.py:86
assert transformed.description == "Original description"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/tools/tool_transform/test_metadata.py:92
assert transformed.description == "New description"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/tools/tool_transform/test_metadata.py:110
assert transformed.description == "Added description"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/tools/tool_transform/test_tool_transform.py:41
assert new_tool.description == add_tool.description
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/tools/tool_transform/test_tool_transform.py:82
assert transformed.parent_tool.description == "Custom description"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/tool_transform/test_tool_transform.py:581
result = await client.call_tool("find_items", {"query": "hello", "limit": 3})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/tools/tool_transform/test_tool_transform.py:618
result = await client.call_tool("add_transformed", {"new_x": 1, "old_y": 2})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/openapi/test_models.py:51
assert param.description == "Filter criteria"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/openapi/test_models.py:102
assert request_body.description == "User data"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/openapi/test_models.py:160
assert response.description == "Success response"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/openapi/test_models.py:180
assert response.description == "User created"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/openapi/test_models.py:262
assert route.description == "Update user by ID"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/openapi/test_models.py:478
assert reconstructed_param.description == original_param.description
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Response referencing or invoking other tools

high

Detected tool responses that attempt to call or invoke other tools (use_tool, call_tool, invoke, execute_tool). A poisoned tool response could trick the LLM into executing additional tools without user consent.

tests/utilities/test_async_utils.py:63
result = await client.call_tool("greet", {"name": "world"})
How to fix

Tool responses should never contain tool invocation patterns. Validate and sanitize all output to ensure it does not include cross-tool call instructions.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/test_components.py:81
assert component.description == "A fully configured component"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/test_components.py:388
assert new_component.description == component.description
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/test_components.py:413
assert updated_component.description == "New Description"  # Updated
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/test_components.py:422
assert component.description == "Original Description"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/test_skills.py:100
assert by_name["pdf-processing"].description == "Process PDF documents"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

tests/utilities/test_skills.py:101
assert by_name["code-review"].description == "Review code for quality"
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/fastmcp_config_demo/server.py:22
Take a screenshot of the user's screen and return it as an image.
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/fastmcp_config_demo/server.py:30
# Capture and compress the screenshot to stay under size limits
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/fastmcp_config_demo/server.py:31
screenshot = pyautogui.screenshot()
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/fastmcp_config_demo/server.py:31
screenshot = pyautogui.screenshot()
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/fastmcp_config_demo/server.py:32
screenshot.convert("RGB").save(buffer, format="JPEG", quality=60, optimize=True)
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/fastmcp_config_demo/server.py:47
screenshot = pyautogui.screenshot()
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/fastmcp_config_demo/server.py:47
screenshot = pyautogui.screenshot()
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/fastmcp_config_demo/server.py:49
small = screenshot.resize((100, 100), PILImage.Resampling.LANCZOS)
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/screenshot.fastmcp.json:3
"entrypoint": "screenshot.py",
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/screenshot.py:8
Give Claude a tool to capture and view screenshots.
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/screenshot.py:17
# Dependencies are configured in screenshot.fastmcp.json
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/screenshot.py:22
def take_screenshot() -> Image:
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/screenshot.py:24
Take a screenshot of the user's screen and return it as an image. Use
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/screenshot.py:32
screenshot = pyautogui.screenshot()
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/screenshot.py:32
screenshot = pyautogui.screenshot()
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

examples/screenshot.py:33
screenshot.convert("RGB").save(buffer, format="JPEG", quality=60, optimize=True)
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

src/fastmcp/server/tasks/handlers.py:124
await snapshot.save(docket, session_id, server_task_id, ttl_seconds)
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

examples/providers/sqlite/server.py:89
"SELECT * FROM tools WHERE name = ? AND enabled = 1", (name,)
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

src/fastmcp/server/providers/__init__.py:17
rows = await self.db.fetch("SELECT * FROM tools")
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

src/fastmcp/server/providers/__init__.py:21
row = await self.db.fetchone("SELECT * FROM tools WHERE name = ?", name)
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

src/fastmcp/server/providers/base.py:18
rows = await self.db.fetch("SELECT * FROM tools")
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

src/fastmcp/server/providers/base.py:22
row = await self.db.fetchone("SELECT * FROM tools WHERE name = ?", name)
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Debug mode enabled in production configuration

medium

Detected DEBUG=true or similar debug flags that may be active in production. Debug mode often enables verbose logging, detailed error messages, and development-only endpoints.

tests/deprecated/test_tool_injection_middleware.py:158
return "debug=true"
How to fix

Ensure debug mode is disabled in production. Use environment-based configuration to control debug settings.

Debug mode enabled in production configuration

medium

Detected DEBUG=true or similar debug flags that may be active in production. Debug mode often enables verbose logging, detailed error messages, and development-only endpoints.

tests/deprecated/test_tool_injection_middleware.py:234
text='{"contents":[{"content":"debug=true","mime_type":"text/plain","meta":null}],"meta":null}',
How to fix

Ensure debug mode is disabled in production. Use environment-based configuration to control debug settings.

Debug mode enabled in production configuration

medium

Detected DEBUG=true or similar debug flags that may be active in production. Debug mode often enables verbose logging, detailed error messages, and development-only endpoints.

tests/deprecated/test_tool_injection_middleware.py:241
{"content": "debug=true", "mime_type": "text/plain", "meta": None}
How to fix

Ensure debug mode is disabled in production. Use environment-based configuration to control debug settings.

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

tests/server/test_dependencies.py:95
result = await mcp.call_tool("query_db", {"sql": "SELECT * FROM users"})
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Returning entire database records without field filtering

medium

Detected SELECT * or ORM queries without explicit field selection. Returning all columns risks exposing sensitive fields (passwords, tokens, internal IDs) to the client or LLM context.

tests/server/test_dependencies.py:98
"Executing 'SELECT * FROM users' on db_connection"
How to fix

Always specify the exact columns or fields to return. Use SELECT with explicit column names or ORM select/projection options.

Windows-style path traversal patterns

high

Backslash-based directory traversal patterns targeting Windows file systems.

examples/skills/client.py:62
print(result[0].text[:500] + "...\n")
How to fix

Normalize path separators and apply traversal checks for both forward and backslashes.

Python open() with user-controlled path

high

Using Python's open() with variable paths without validation enables path traversal.

src/fastmcp/client/oauth_callback.py:242
webbrowser.open(f"http://localhost:{port}/callback?code=test123&state=xyz")
How to fix

Validate and sanitize file paths using os.path.realpath() and check against allowed directories.

Windows-style path traversal patterns

high

Backslash-based directory traversal patterns targeting Windows file systems.

src/fastmcp/server/providers/local_provider/decorators/prompts.py:186
f"            ...\n\n"
How to fix

Normalize path separators and apply traversal checks for both forward and backslashes.

Windows-style path traversal patterns

high

Backslash-based directory traversal patterns targeting Windows file systems.

src/fastmcp/server/providers/local_provider/decorators/resources.py:186
f"            ...\n\n"
How to fix

Normalize path separators and apply traversal checks for both forward and backslashes.

Windows-style path traversal patterns

high

Backslash-based directory traversal patterns targeting Windows file systems.

src/fastmcp/server/providers/local_provider/decorators/tools.py:348
f"            ...\n\n"
How to fix

Normalize path separators and apply traversal checks for both forward and backslashes.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/apps/test_file_upload.py:50
data = base64.b64encode(b"\x00\x01\x02\xff").decode()
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/resources/test_file_resources.py:156
data = b"\x00\x01\x02\xff"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/resources/test_function_resources.py:190
content=b"\x00\x01\x02",
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/resources/test_function_resources.py:201
assert result.content == b"\x00\x01\x02"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/resources/test_function_resources.py:252
content=b"\x00\x01\x02",
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/resources/test_function_resources.py:259
assert mcp_content.blob == "AAEC"  # base64 of \x00\x01\x02
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/resources/test_resources.py:133
content = ResourceContent(b"\x00\x01\x02")
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/resources/test_resources.py:134
assert content.content == b"\x00\x01\x02"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/resources/test_resources.py:186
content=b"\x00\x01\x02", mime_type="application/octet-stream"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/resources/test_resources.py:190
assert mcp_content.blob == "AAEC"  # base64 of \x00\x01\x02
How to fix

Strip null bytes from all file path inputs before processing.

Directory traversal sequence targeting sensitive files

critical

Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.

tests/server/middleware/test_caching.py:643
arguments={"password": "secret", "path": "../../etc/passwd"},
How to fix

Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.

Directory traversal sequence targeting sensitive files

critical

Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.

tests/server/middleware/test_caching.py:650
assert "../../etc/passwd" not in key
How to fix

Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.

Directory traversal sequence targeting sensitive files

critical

Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.

tests/server/middleware/test_caching.py:654
uri=AnyUrl("file:///tmp/../../etc/shadow?token=abcd")
How to fix

Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/server/providers/test_local_provider_resources.py:495
content=b"\x00\x01\x02",
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/server/providers/test_local_provider_resources.py:503
assert result.contents[0].content == b"\x00\x01\x02"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/server/transforms/test_resources_as_tools.py:182
return b"\x00\x01\x02\x03"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/server/transforms/test_resources_as_tools.py:190
assert decoded == b"\x00\x01\x02\x03"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Null byte injection in file paths

critical

Null bytes in file paths can truncate path validation and access unintended files.

tests/tools/test_tool_future_annotations.py:48
png_data = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc\xf8\x0f\x00\x00\x01\x01\x00\x05\x18\xd4c\x00\x00\x00\x00IEND\xaeB`\x82"
How to fix

Strip null bytes from all file path inputs before processing.

Directory traversal sequence targeting sensitive files

critical

Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.

tests/utilities/openapi/test_director.py:1065
"../../../etc/passwd",
How to fix

Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.

Access to sensitive system files

critical

Direct access to sensitive files like /etc/passwd, /etc/shadow, or SSH keys indicates potential data exfiltration.

tests/utilities/openapi/test_director.py:1078
assert "/etc/passwd" not in url
How to fix

Remove direct references to sensitive system files. Use a restricted file access layer.

URL-encoded path traversal sequences

high

URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.

tests/utilities/openapi/test_director.py:1067
"..%2F..%2Fadmin",
How to fix

URL-decode paths before validation. Apply path traversal checks after full decoding.

URL-encoded path traversal sequences

high

URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.

tests/utilities/openapi/test_director.py:1067
"..%2F..%2Fadmin",
How to fix

URL-decode paths before validation. Apply path traversal checks after full decoding.

URL-encoded path traversal sequences

high

URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.

tests/utilities/openapi/test_director.py:1068
"..%2f..%2fadmin",
How to fix

URL-decode paths before validation. Apply path traversal checks after full decoding.

URL-encoded path traversal sequences

high

URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.

tests/utilities/openapi/test_director.py:1068
"..%2f..%2fadmin",
How to fix

URL-decode paths before validation. Apply path traversal checks after full decoding.

URL-encoded path traversal sequences

high

URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.

tests/utilities/openapi/test_director.py:1092
assert "%2E%2E%2Fadmin" in url or "%2e%2e%2fadmin" in url
How to fix

URL-decode paths before validation. Apply path traversal checks after full decoding.

URL-encoded path traversal sequences

high

URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.

tests/utilities/openapi/test_director.py:1092
assert "%2E%2E%2Fadmin" in url or "%2e%2e%2fadmin" in url
How to fix

URL-decode paths before validation. Apply path traversal checks after full decoding.

URL-encoded path traversal sequences

high

URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.

tests/utilities/openapi/test_director.py:1147
{"id": "..%2F..%2Fadmin"},
How to fix

URL-decode paths before validation. Apply path traversal checks after full decoding.

URL-encoded path traversal sequences

high

URL-encoded dot-dot-slash sequences (%2e%2e%2f) bypass naive path validation.

tests/utilities/openapi/test_director.py:1147
{"id": "..%2F..%2Fadmin"},
How to fix

URL-decode paths before validation. Apply path traversal checks after full decoding.

Directory traversal sequence targeting sensitive files

critical

Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.

tests/utilities/test_skills.py:278
"../../../etc/passwd",
How to fix

Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.

Missing error logging in catch block

medium

Detected a catch block that returns, continues, or breaks without logging the error or rethrowing. Silently discarding errors hinders incident response and forensic analysis.

src/fastmcp/cli/apps_dev.py:890
try { data = JSON.parse(data); } catch(e) { return; }
How to fix

Add error logging before returning, continuing, or breaking inside catch blocks. Ensure all errors are recorded for audit and debugging.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/cli/apps_dev.py:71
def log_request(self, body: dict[str, Any]) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/cli/apps_dev.py:89
def log_response(self, body: dict[str, Any]) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/cli/apps_dev.py:134
def log_bridge(self, body: dict[str, Any]) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/cli/apps_dev.py:153
def _log_response_bytes(log: _MessageLog, raw: bytes, content_type: str) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/cli/apps_dev.py:417
#mcp-log-panel.hidden { display: none; }
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/cli/apps_dev.py:527
.log-seg button:last-child { border-right: none; }
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/cli/apps_dev.py:567
<script>if (window.location.pathname === "/") document.getElementById("mcp-log-reset").style.display = "none";</script>
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/cli/run.py:141
log_level: LogLevelType | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/client.py:255
log_handler: LogHandler | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/client.py:294
if log_handler is None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/client.py:802
async def set_logging_level(self, level: mcp.types.LoggingLevel) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/logging.py:14
LogHandler: TypeAlias = Callable[[LogMessage], Awaitable[None]]
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/logging.py:17
async def default_log_handler(message: LogMessage) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/logging.py:47
def create_log_callback(handler: LogHandler | None = None) -> LoggingFnT:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/logging.py:51
async def log_callback(params: LoggingMessageNotificationParams) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/oauth_callback.py:250
access_log=False,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/transports/base.py:30
logging_callback: LoggingFnT | None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/transports/stdio.py:37
log_file: Path | TextIO | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/transports/stdio.py:181
log_file: Path | TextIO | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/transports/stdio.py:200
if log_file is None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/transports/stdio.py:243
log_file: Path | TextIO | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/transports/stdio.py:295
log_file: Path | TextIO | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/client/transports/stdio.py:325
log_file: Path | TextIO | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/auth/cimd.py:70
logo_uri: AnyHttpUrl | None = Field(
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/auth/providers/debug.py:100
logger.debug("Token validation failed: callable returned False")
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/auth/providers/introspection.py:249
self.logger.debug("Token introspection returned active=false")
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/context.py:545
level: LoggingLevel | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/context.py:546
logger_name: str | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/context.py:716
logger_name: str | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/context.py:732
logger_name: str | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/context.py:748
logger_name: str | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/context.py:764
logger_name: str | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/context.py:1376
logger_name: str | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1069
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1099
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1163
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1219
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1260
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1300
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1341
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1429
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1501
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1559
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/dependencies.py:1616
traceback: TracebackType | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/low_level.py:45
self._minimum_logging_level: LoggingLevel | None = None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/error_handling.py:39
logger: logging.Logger | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/error_handling.py:40
include_traceback: bool = False,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/error_handling.py:47
logger: Logger instance for error logging. If None, uses 'fastmcp.errors'
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/error_handling.py:58
def _log_error(self, error: Exception, context: MiddlewareContext) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/error_handling.py:164
logger: logging.Logger | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/logging.py:120
self, message: dict[str, str | int | float], log_level: int | None = None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/logging.py:170
logger: logging.Logger | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/logging.py:182
logger: Logger instance to use. If None, creates a logger named 'fastmcp.requests'
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/logging.py:188
methods: List of methods to log. If None, logs all methods.
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/logging.py:200
self.structured_logging: bool = False
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/logging.py:222
logger: logging.Logger | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/logging.py:233
logger: Logger instance to use. If None, creates a logger named 'fastmcp.structured'
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/logging.py:238
methods: List of methods to log. If None, logs all methods.
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/timing.py:28
self, logger: logging.Logger | None = None, log_level: int = logging.INFO
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/timing.py:33
logger: Logger instance to use. If None, creates a logger named 'fastmcp.timing'
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/timing.py:80
self, logger: logging.Logger | None = None, log_level: int = logging.INFO
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/middleware/timing.py:85
logger: Logger instance to use. If None, creates a logger named 'fastmcp.timing.detailed'
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/mixins/mcp_operations.py:357
async def _set_logging_level_mcp(self, level: mcp.types.LoggingLevel) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/mixins/transport.py:187
log_level: str | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/mixins/transport.py:232
log_level: str | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/providers/proxy.py:896
async def default_proxy_log_handler(message: LogMessage) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/providers/proxy.py:1046
async def __aexit__(self, exc_type, exc_value, traceback) -> None:  # type: ignore[override]  # ty:ignore[invalid-method-override]
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/server.py:108
class _SuppressUnlistedToolWarning(logging.Filter):
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/server.py:284
client_log_level: mcp.types.LoggingLevel | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/server.py:377
self.client_log_level: mcp.types.LoggingLevel | None = (
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/server.py:379
if client_log_level is not None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/telemetry.py:44
def _get_parent_trace_context() -> Context | None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/server/transforms/catalog.py:82
f"_catalog_bypass_{self._instance_id}", default=False
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/settings.py:195
If True, will use rich formatting for log output. If False,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/settings.py:284
MCP_LOG_LEVEL | None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/telemetry.py:38
def get_tracer(version: str | None = None) -> Tracer:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/telemetry.py:60
or None if no trace context to inject and meta was None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/telemetry.py:82
def extract_trace_context(meta: dict[str, Any] | None) -> Context:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/cli.py:201
def log_server_banner(server: FastMCP[Any]) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:31
logger: logging.Logger | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:32
enable_rich_tracebacks: bool | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:43
# Check if logging is disabled in settings
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:48
if enable_rich_tracebacks is None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:51
if logger is None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:57
logger.propagate = False
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:64
# Use standard logging handlers if rich logging is disabled
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:104
traceback_handler.addFilter(lambda record: record.exc_info is not None)
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:113
logger: logging.Logger | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:114
enable_rich_tracebacks: bool | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/logging.py:234
def _unclamp_logger(logger: logging.Logger) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/mcp_server_config/v1/mcp_server_config.py:62
log_level: Literal["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"] | None = Field(
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/openapi/parser.py:234
logger.error(f"Failed to extract schema as dict: {e}", exc_info=False)
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/openapi/parser.py:237
logger.error(f"Failed to extract schema as dict: {e}", exc_info=False)
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

src/fastmcp/utilities/ui.py:501
def create_logo(icon_url: str | None = None, alt_text: str = "FastMCP") -> str:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/client/test_client.py:101
"trace_id": getattr(meta, "trace_id", None),
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/client/test_client.py:120
assert result_no_meta.data.get("trace_id") is None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_logs.py:22
async def handle_log(self, message: LogMessage) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_logs.py:36
async def log(context: Context) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_logs.py:43
level: LoggingLevel | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_logs.py:44
logger: str | None = None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_logs.py:143
message: str, context: Context, level: LoggingLevel | None = None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_logs.py:166
message: str, context: Context, level: LoggingLevel | None = None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_logs.py:241
"""Test that default_log_handler works when logger name is None."""
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_logs.py:253
logger=None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_logs.py:327
logger=None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_stdio.py:624
async def test_log_file_none_uses_default_behavior(
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_stdio.py:627
"""Test that log_file=None uses default stderr handling"""
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/client/test_stdio.py:629
script_path=stdio_script_with_stderr, log_file=None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/conftest.py:45
FastMCP loggers have propagate=False by default, which prevents messages from
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/conftest.py:122
tuple[TracerProvider, InMemorySpanExporter], None, None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/experimental/transforms/test_code_mode_discovery.py:216
async def test_get_tags_empty_catalog() -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/experimental/transforms/test_code_mode_discovery.py:402
async def test_search_shows_catalog_size_when_results_are_subset() -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/experimental/transforms/test_code_mode_discovery.py:591
async def test_list_tools_empty_catalog() -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/auth/test_oauth_proxy_storage.py:196
"logo_uri": None,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/middleware/test_error_handling.py:38
assert middleware.include_traceback is False
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/middleware/test_logging.py:30
caplog: pytest.LogCaptureFixture, module: str | None = None
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/middleware/test_middleware.py:146
async def log_tool(context: Context) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/middleware/test_middleware_nested.py:147
async def log_tool(context: Context) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/middleware/test_middleware_nested.py:200
async def log_tool(context: Context) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/providers/proxy/test_proxy_client.py:244
log_handler_called = False
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/providers/proxy/test_proxy_client.py:246
async def log_handler(message: LogMessage) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/providers/proxy/test_proxy_client.py:288
async def log_handler_a(message: LogMessage) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/providers/proxy/test_proxy_client.py:291
async def log_handler_b(message: LogMessage) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/providers/proxy/test_stateful_proxy_client.py:80
async def log_handler_a(message: LogMessage) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/providers/proxy/test_stateful_proxy_client.py:83
async def log_handler_b(message: LogMessage) -> None:
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/test_log_level.py:28
server.run_stdio_async(log_level="DEBUG", show_banner=False),
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/test_log_level.py:47
log_level="INFO", show_banner=False, host="127.0.0.1", port=8000
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/test_logging.py:77
"disable_existing_loggers": False,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/test_logging.py:142
"disable_existing_loggers": False,
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/transforms/test_catalog.py:56
async def read_catalog(ctx: Context = None) -> list[str]:  # type: ignore[assignment]  # ty:ignore[invalid-parameter-default]
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/server/transforms/test_catalog.py:204
"""get_tool_catalog() respects visibility (disabled tools are excluded)."""
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/telemetry/test_module.py:75
ctx = extract_trace_context(None)
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/utilities/test_logging.py:60
def test_configure_logging_with_rich_disabled():
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/utilities/test_logging.py:64
fastmcp.settings.enable_rich_logging = False
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

tests/utilities/test_logging.py:69
# Should only have one handler when rich logging is disabled
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

src/fastmcp/server/providers/filesystem.py:109
result = discover_and_import(self._root)
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

src/fastmcp/server/providers/filesystem_discovery.py:359
def discover_and_import(root: Path) -> DiscoveryResult:
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Tool name collision with system tools

critical

Registering a tool with a name that collides with common system commands (bash, shell, exec, eval, etc.) can shadow built-in tools and intercept agent operations.

tests/cli/test_generate_cli.py:900
name="run",
How to fix

Rename the tool to a unique, descriptive name that does not collide with system commands.

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

tests/fs/test_discovery.py:138
def test_import_with_relative_import(self, tmp_path: Path):
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

tests/fs/test_discovery.py:140
# Create package with relative import (use unique name to avoid module caching)
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

tests/fs/test_discovery.py:300
result = discover_and_import(tmp_path)
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

tests/fs/test_discovery.py:318
result = discover_and_import(tmp_path)
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

tests/fs/test_discovery.py:346
result = discover_and_import(tmp_path)
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

tests/fs/test_discovery.py:494
def test_syspath_not_polluted_after_import(self, tmp_path: Path):
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

tests/fs/test_discovery.py:501
def test_syspath_not_polluted_after_package_import(self, tmp_path: Path):
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Dynamic import from variable URL

critical

Dynamic imports with variable URLs can load malicious code at runtime.

tests/server/test_icons.py:331
def test_icon_import(self):
How to fix

Use static imports only. Do not dynamically import modules from variable paths.

Hardcoded API key or token literal

critical

String literals matching known API key prefixes (sk-, ghp_, AKIA, xoxb-, etc.) or long base64-like strings may expose secrets in source code.

tests/conformance/server.py:27
"nGP4z8BQDwAEgAF/pooBPQAAAABJRU5ErkJggg=="
How to fix

Remove hardcoded secrets from source code. Use environment variables or a secrets manager.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

tests/conftest.py:97
s.listen(1)
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

tests/conftest.py:111
s.listen(1)
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

tests/server/auth/oauth_proxy/conftest.py:224
s.listen(1)
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Python exec() call

critical

Python's exec() function executes arbitrary code strings and is a vector for code injection.

tests/experimental/transforms/test_code_mode_discovery.py:76
exec(wrapped, namespace, namespace)
How to fix

Remove exec() calls. Use ast.literal_eval for safe expression evaluation.