molecule-core

Files

T

fullstack-engineer 4dce9800a5 fix(handlers): OFFSEC-001 — scrub req.Method from dispatchRPC default error

Line 443 of mcp.go concatenated user-controlled req.Method into the
JSON-RPC -32601 error message, allowing an agent or canvas client to
inject arbitrary strings into the response via the method field.

Fix: replace "method not found: " + req.Method with the constant
"method not found" — matching the OFFSEC-001 scrub contract applied
to the InvalidParams (line 428) and UnknownTool (line 433) paths.

Test: extend TestMCPHandler_UnknownMethod_Returns32601 with two new
assertions:
  1. resp.Error.Message == "method not found"
  2. defence-in-depth check that the sent method name never appears
     in the response (strings.Contains guard)

Issue: #684

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-12 08:28:39 +00:00

cmd

docs(runbook): add admin-auth.md covering test-token route lockdown

2026-05-10 02:20:30 +00:00

internal

fix(handlers): OFFSEC-001 — scrub req.Method from dispatchRPC default error

2026-05-12 08:28:39 +00:00

migrations

feat(plugins): plugin drift detector + queue + admin apply endpoint (#123 )

2026-05-10 00:39:50 +00:00

pkg/provisionhook

feat(#1957 ): wire gh-identity plugin into workspace-server