MCP Scanner
ScanLeaderboardDocsSign in
Home/stripe/agent-toolkit/Results
0F

ai

stripe/agent-toolkit

290 files · 34 findings

Share GitHub SARIF JSON
12 high22 medium
Tool Poisoningclean
Command Injectionclean
Path Traversal2 issues
SSRF12 issues
Credential Theftclean
Excessive Permissionsclean
Missing Auth20 issues
Supply Chain
SSRF12

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/card-element-to-checkout/solution/client/return.js:11
window.location.replace('http://localhost:5000/checkout.html')
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Missing Auth20

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/environment/server/server.js:24
app.get('/', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Path Traversal2

fs operations without path sanitization

medium

File system operations using variables without prior path validation or sanitization may allow traversal attacks.

skills/sync.js:80
await fs.mkdir(outputDir, { recursive: true });
How to fix

Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.

clean
Rug Pullclean

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/card-element-to-checkout/solution/server/server.py:226
return_url='http://localhost:5000/return.html?session_id={CHECKOUT_SESSION_ID}',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/checkout-gym/environment/client/return.js:11
window.replace('http://localhost:4242/checkout.html')
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/checkout-gym/environment/server/submission.json:11
"return_url": "http://localhost:4242/session-status?session_id={CHECKOUT_SESSION_ID}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/furever/grader/payments.py:34
url = f"http://localhost:{port}"
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/galtee-basic/environment/client/return.js:11
window.replace('http://localhost:4242/checkout.html')
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/galtee-basic/solution/server.js:236
return_url: 'http://localhost:4242/return.html',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

benchmarks/galtee-invoicing/environment/client/return.js:11
window.replace('http://localhost:4242/checkout.html')
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

tools/python/examples/openai/customer_support/emailer.py:167
_, thrid_data = imap_conn.fetch(email.id, "(X-GM-THRID)")
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tools/typescript/examples/cloudflare/src/index.ts:46
success_url: 'http://localhost:4242/payment/success',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tools/typescript/examples/cloudflare/src/index.ts:75
success_url: 'http://localhost:4242/payment/success',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

tools/typescript/examples/cloudflare/src/index.ts:103
success_url: 'http://localhost:4242/payment/success',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/environment/server/server.js:29
app.get('/config', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/environment/server/server.js:35
app.get('/products', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/environment/server/server.js:46
app.post('/create-payment-intent', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/environment/server/server.js:75
app.post('/webhook', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:29
app.get('/', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:34
app.get('/config', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:40
app.get('/products', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:51
app.get('/customer/:email/bookings', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:96
app.get('/customer/:email/bookings/:product', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:143
app.post('/customer/:email/bookings/:product/refund', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:203
app.post('/purchase', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:301
app.post('/create-payment-intent', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-basic/solution/server.js:330
app.post('/webhook', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/environment/server/server.js:13
app.get("/config", (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/environment/server/server.js:19
app.get("/products", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/environment/server/server.js:31
app.post("/purchase", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/solution/server.js:90
app.get("/products", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/solution/server.js:112
app.post("/purchase", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

benchmarks/galtee-invoicing/solution/server.js:256
app.get("/customer/:email/bookings", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

fs operations without path sanitization

medium

File system operations using variables without prior path validation or sanitization may allow traversal attacks.

skills/sync.js:82
await fs.writeFile(outputPath, skillFileContent, "utf8");
How to fix

Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.