Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.
new URL(`${textUriBase}/${resourceId}`);Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.
HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.
app.get("/sse", async (req, res) => {Add authentication middleware to all routes that access or modify data.
File system operations using variables without prior path validation or sanitization may allow traversal attacks.
const data = await fs.readFile(this.memoryFilePath, "utf-8");
Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.
Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.
new URL(`${blobUriBase}/${resourceId}`);Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
const response = await fetch(url, { signal: controller.signal });Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.
app.post("/message", async (req, res) => {Add authentication middleware to all routes that access or modify data.
HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.
app.post("/mcp", async (req: Request, res: Response) => {Add authentication middleware to all routes that access or modify data.
HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.
app.get("/mcp", async (req: Request, res: Response) => {Add authentication middleware to all routes that access or modify data.
HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.
app.delete("/mcp", async (req: Request, res: Response) => {Add authentication middleware to all routes that access or modify data.
File system operations using variables without prior path validation or sanitization may allow traversal attacks.
await fs.writeFile(this.memoryFilePath, lines.join("\n"));Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.