forked from molecule-ai/molecule-core
Molecule AI Security Auditor
3ca778f160
Adds docs/security/safe-mcp-audit-2026-04-17.md — full SAFE-MCP ATT&CK
audit of @molecule-ai/mcp-server against 4 high-priority techniques:
SAFE-T1102 (Supply chain):
- NEW-003 HIGH: Unpinned npm MCP packages in .mcp.json (npx -y)
- VULN-003 HIGH: No manifest signing on GitHub plugin install
- VULN-004 HIGH: Floating plugin refs, no version pinning enforced
SAFE-T1201 (Prompt injection):
- VULN-002 HIGH: GLOBAL memory poisoning — delimiter spoofing gap
(partial mitigation via #767 globalMemoryDelimiter confirmed)
- VULN-006 MEDIUM: No tool output sanitization in MCP server
SAFE-T1301 (Excessive permissions):
- NEW-002 MEDIUM: Default subprocess sandbox allows language=shell/bash
SAFE-T1401 (Secret exfiltration):
- NEW-001 MEDIUM: builtin_tools missing auth_headers() on A2A calls
- VULN-005 MEDIUM: GLOBAL memories readable by all workspaces
Confirmed fix: VULN-001 (X-Workspace-ID system-caller forge, #761) CLOSED.
Closes #747.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs/
This directory serves two purposes:
- Markdown content — everything under
architecture/,agent-runtime/,api-protocol/,development/,frontend/,plugins/,product/, etc. This is what agents and humans read. - VitePress site —
.vitepress/config.ts,package.json,package-lock.json. These drive the rendered documentation site.
Local preview
cd docs
npm install
npm run dev # preview on http://localhost:5173
npm run build # static build to docs/.vitepress/dist/
Conventions
- New top-level docs must be linked from
PLAN.md,README.md, andCLAUDE.md— otherwise agents can't find them (see.claude/memoryfeedback_cross_reference_docs.md). edit-history/YYYY-MM-DD.mdis append-only log of significant changes; don't rewrite history.archive/holds one-shot analyses and retired docs — kept for context but not maintained.
Why site tooling lives here (not in docs-site/)
VitePress expects its config at <root>/.vitepress/config.ts where <root> is also the content directory. Splitting tooling into a sibling docs-site/ would require a non-trivial srcDir shim and break relative links in .vitepress/config.ts. Keeping both together is the pragmatic choice; this README is the tradeoff ledger.