Skip to content

Commit 1f4e92f

Browse files
cliffhallcliffhall
authored
Merge branch 'main' into groups
2 parents 45bc352 + a0e8583 commit 1f4e92f

54 files changed

Lines changed: 6062 additions & 50 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/sep-lifecycle-manual.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: SEP Lifecycle Automation (Manual)
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
issue_number:
7+
description: 'Issue/PR number to process (leave empty for full sweep)'
8+
type: string
9+
required: false
10+
dry_run:
11+
description: 'Run in dry-run mode (no changes)'
12+
type: boolean
13+
default: true
14+
15+
env:
16+
NODE_VERSION: '20'
17+
18+
jobs:
19+
run-automation:
20+
runs-on: ubuntu-latest
21+
environment: sep-automation - production
22+
permissions:
23+
contents: read
24+
issues: write
25+
pull-requests: write
26+
27+
steps:
28+
- name: Checkout
29+
uses: actions/checkout@v4
30+
31+
- name: Setup Node.js
32+
uses: actions/setup-node@v4
33+
with:
34+
node-version: ${{ env.NODE_VERSION }}
35+
cache: 'npm'
36+
cache-dependency-path: tools/sep-automation/package-lock.json
37+
38+
- name: Install dependencies
39+
working-directory: tools/sep-automation
40+
run: npm ci
41+
42+
- name: Build
43+
working-directory: tools/sep-automation
44+
run: npm run build
45+
46+
- name: Run SEP Lifecycle Automation
47+
id: automation
48+
working-directory: tools/sep-automation
49+
run: |
50+
if [[ "${{ github.event.inputs.dry_run }}" == "true" ]]; then
51+
echo "::notice::Running in DRY RUN mode - no changes will be made"
52+
else
53+
echo "::warning::Running in PRODUCTION mode - changes will be applied!"
54+
fi
55+
56+
if [[ -n "${{ github.event.inputs.issue_number }}" ]]; then
57+
echo "Processing single issue #${{ github.event.inputs.issue_number }}"
58+
npm start -- --issue ${{ github.event.inputs.issue_number }} 2>&1 | tee automation.log
59+
else
60+
echo "Running full sweep"
61+
npm start 2>&1 | tee automation.log
62+
fi
63+
env:
64+
# Use GitHub App for auth (has read:org for team membership checks)
65+
APP_ID: ${{ secrets.APP_ID }}
66+
APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
67+
# Fallback to GITHUB_TOKEN if App not configured
68+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
69+
MAINTAINERS_TEAM: core-maintainers
70+
DRY_RUN: ${{ github.event.inputs.dry_run }}
71+
DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
72+
LOG_LEVEL: info
73+
74+
- name: Upload logs
75+
uses: actions/upload-artifact@v4
76+
if: always()
77+
with:
78+
name: automation-logs-manual-${{ github.run_id }}
79+
path: tools/sep-automation/automation.log
80+
retention-days: 30

‎.github/workflows/sep-lifecycle.yml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
name: SEP Lifecycle Automation
2+
3+
on:
4+
# Event-driven: react to SEP changes immediately
5+
issues:
6+
types: [labeled, unlabeled, assigned, unassigned, opened, reopened]
7+
pull_request_target:
8+
types: [labeled, unlabeled, assigned, unassigned, opened, reopened]
9+
10+
# Scheduled: weekly full sweep + Discord summary
11+
schedule:
12+
- cron: '0 9 * * 1' # Every Monday at 9 AM UTC
13+
14+
env:
15+
NODE_VERSION: '20'
16+
17+
jobs:
18+
check-sep:
19+
# For issue/PR events, only run if it looks like a SEP
20+
if: |
21+
github.event_name == 'schedule' ||
22+
contains(github.event.issue.labels.*.name, 'SEP') ||
23+
contains(github.event.issue.labels.*.name, 'proposal') ||
24+
contains(github.event.issue.labels.*.name, 'draft') ||
25+
contains(github.event.issue.labels.*.name, 'in-review') ||
26+
contains(github.event.issue.labels.*.name, 'accepted') ||
27+
contains(github.event.pull_request.labels.*.name, 'SEP') ||
28+
contains(github.event.pull_request.labels.*.name, 'proposal') ||
29+
contains(github.event.pull_request.labels.*.name, 'draft') ||
30+
contains(github.event.pull_request.labels.*.name, 'in-review') ||
31+
contains(github.event.pull_request.labels.*.name, 'accepted') ||
32+
contains(github.event.issue.title, 'SEP') ||
33+
contains(github.event.pull_request.title, 'SEP')
34+
runs-on: ubuntu-latest
35+
outputs:
36+
should_run: ${{ steps.check.outputs.should_run }}
37+
issue_number: ${{ steps.check.outputs.issue_number }}
38+
is_single: ${{ steps.check.outputs.is_single }}
39+
steps:
40+
- name: Determine run mode
41+
id: check
42+
run: |
43+
if [[ "${{ github.event_name }}" == "schedule" ]]; then
44+
echo "should_run=true" >> $GITHUB_OUTPUT
45+
echo "issue_number=" >> $GITHUB_OUTPUT
46+
echo "is_single=false" >> $GITHUB_OUTPUT
47+
else
48+
# Issue or PR event
49+
ISSUE_NUMBER="${{ github.event.issue.number || github.event.pull_request.number }}"
50+
echo "should_run=true" >> $GITHUB_OUTPUT
51+
echo "issue_number=$ISSUE_NUMBER" >> $GITHUB_OUTPUT
52+
echo "is_single=true" >> $GITHUB_OUTPUT
53+
fi
54+
55+
run-automation:
56+
needs: check-sep
57+
if: needs.check-sep.outputs.should_run == 'true'
58+
runs-on: ubuntu-latest
59+
permissions:
60+
contents: read
61+
issues: write
62+
pull-requests: write
63+
64+
steps:
65+
- name: Checkout
66+
uses: actions/checkout@v4
67+
68+
- name: Setup Node.js
69+
uses: actions/setup-node@v4
70+
with:
71+
node-version: ${{ env.NODE_VERSION }}
72+
cache: 'npm'
73+
cache-dependency-path: tools/sep-automation/package-lock.json
74+
75+
- name: Install dependencies
76+
working-directory: tools/sep-automation
77+
run: npm ci
78+
79+
- name: Build
80+
working-directory: tools/sep-automation
81+
run: npm run build
82+
83+
- name: Run SEP Lifecycle Automation
84+
id: automation
85+
working-directory: tools/sep-automation
86+
run: |
87+
if [[ "${{ needs.check-sep.outputs.is_single }}" == "true" ]]; then
88+
echo "Processing single issue #${{ needs.check-sep.outputs.issue_number }}"
89+
npm start -- --issue ${{ needs.check-sep.outputs.issue_number }} 2>&1 | tee automation.log
90+
else
91+
echo "Running full sweep"
92+
npm start 2>&1 | tee automation.log
93+
fi
94+
env:
95+
# Use GitHub App for auth (has read:org for team membership checks)
96+
APP_ID: ${{ secrets.APP_ID }}
97+
APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
98+
# Fallback to GITHUB_TOKEN if App not configured
99+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
100+
MAINTAINERS_TEAM: core-maintainers
101+
DRY_RUN: 'false'
102+
DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
103+
LOG_LEVEL: info
104+
105+
- name: Upload logs
106+
uses: actions/upload-artifact@v4
107+
if: always()
108+
with:
109+
name: automation-logs-${{ github.run_id }}
110+
path: tools/sep-automation/automation.log
111+
retention-days: 30

‎SECURITY.md‎

Lines changed: 167 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Thank you for helping us keep the SDKs and systems they interact with secure.
77
This SDK is maintained by [Anthropic](https://www.anthropic.com/) as part of the Model
88
Context Protocol project.
99

10-
The security of our systems and user data is Anthropic’s top priority. We appreciate the
10+
The security of our systems and user data is Anthropic's top priority. We appreciate the
1111
work of security researchers acting in good faith in identifying and reporting potential
1212
vulnerabilities.
1313

@@ -19,3 +19,169 @@ in this functionality be reported through their
1919

2020
Our Vulnerability Program Guidelines are defined on our
2121
[HackerOne program page](https://hackerone.com/anthropic-vdp).
22+
23+
## Intended Behaviors and Trust Model
24+
25+
This section documents behaviors that are intentional design choices in MCP and are
26+
**not** considered security vulnerabilities. Understanding these behaviors helps
27+
developers build accurate threat models, enables security researchers to focus on
28+
genuine vulnerabilities, and clarifies the trust boundaries within MCP for all
29+
implementers.
30+
31+
### Trust Model
32+
33+
MCP is designed to enable AI applications to interact with external tools, data
34+
sources, and services. The protocol operates under the following trust assumptions:
35+
36+
**MCP clients trust MCP servers they connect to.** When a user or application
37+
configures an MCP client to connect to a server, the client trusts that server to
38+
provide tools, resources, and prompts. The security of this trust relationship
39+
depends on proper server selection and configuration by the user or administrator.
40+
41+
**Local MCP servers are trusted like any other software you install.** When you run a
42+
local MCP server, you are trusting it with the same level of access as any other
43+
application or package on your system. Just as you would evaluate the trustworthiness
44+
of a library or tool before installing it, you should evaluate MCP servers before
45+
running them.
46+
47+
**MCP servers trust the execution environment they run in.** Servers have access to
48+
the resources available in their execution context. This is by design, as servers need
49+
access to local files, databases, APIs, or other resources to provide their intended
50+
functionality.
51+
52+
**Users and administrators are responsible for server selection.** MCP clients should
53+
provide clear information about server capabilities, but the decision to connect to
54+
and use a server rests with the user or administrator. Some clients may auto-connect
55+
to certain servers based on configuration; users should review these settings.
56+
57+
### Behaviors That Are Not Vulnerabilities
58+
59+
The following behaviors are intentional features of MCP and are **not** eligible for
60+
security vulnerability reports or bug bounty rewards:
61+
62+
#### Command Execution for STDIO Transport
63+
64+
MCP clients using the STDIO transport launch MCP servers by executing commands. This
65+
command execution is an intended feature, not a vulnerability:
66+
67+
- Clients execute the configured command to start the server process
68+
- The server process runs with the same privileges as the client
69+
- Command arguments specified in configuration are passed to the server
70+
71+
**This is expected behavior.** Users configure which servers to run, and the client
72+
executes those configurations. Reports about "arbitrary command execution" via STDIO
73+
transport configuration, whether in MCP client applications or SDKs, are not
74+
vulnerabilities. Process spawning is a core feature of the STDIO transport mechanism.
75+
76+
#### Server Capabilities and Side Effects
77+
78+
MCP servers provide capabilities that may have significant effects on the system or
79+
external services. These capabilities are features, not vulnerabilities:
80+
81+
**File system access:** Servers like the reference filesystem server intentionally
82+
read, write, and list files within their configured scope. A filesystem server's
83+
purpose is to provide file access to AI applications.
84+
85+
**Git and version control:** Servers providing git functionality can execute git
86+
commands, which may include operations like resetting commits or force pushing. If you
87+
grant an AI agent unrestricted access to git commands, it can perform any git
88+
operation—this is not a vulnerability in the server.
89+
90+
**Database operations:** Servers may execute queries, modify data, or manage database
91+
schemas based on their intended purpose.
92+
93+
**Network and API access:** Servers may make HTTP requests, call external APIs, or
94+
interact with remote services.
95+
96+
**System commands:** Some servers are designed to execute system commands or scripts.
97+
98+
**This is expected behavior.** Servers that perform their documented functions are
99+
working as intended. Reports about "server X can perform action Y" are not
100+
vulnerabilities when Y is the server's intended purpose. The appropriate safeguards
101+
and permissions for these capabilities are the responsibility of the user or
102+
administrator deploying the server.
103+
104+
#### Resource Access Patterns
105+
106+
MCP resources expose data to clients. Servers may provide resources containing file
107+
contents, database query results, API responses, or system information.
108+
109+
**This is expected behavior.** Resources are designed to provide context and data to
110+
AI applications. The scope of accessible data is determined by server implementation
111+
and configuration.
112+
113+
#### LLM-Driven Tool Invocation
114+
115+
When AI applications use MCP, the language model determines which tools to invoke
116+
based on user requests and available tool descriptions. This means:
117+
118+
- The LLM may invoke tools in ways the user did not explicitly request
119+
- Tool invocations depend on how the LLM interprets the user's intent
120+
- Multiple tools may be invoked in sequence
121+
122+
**This is expected behavior.** LLM-driven tool selection is fundamental to how AI
123+
applications use MCP. Reports about "LLM invoked unexpected tool" are not MCP
124+
vulnerabilities, as they relate to LLM behavior and application-level controls.
125+
126+
### Developer and Operator Responsibilities
127+
128+
MCP's security model places certain responsibilities on developers and operators:
129+
130+
**Server developers are responsible for:**
131+
132+
- Implementing appropriate access controls within their servers
133+
- Documenting the capabilities and permissions their servers require
134+
- Validating inputs from clients before performing sensitive operations
135+
- Following the principle of least privilege in server design
136+
137+
**Client developers are responsible for:**
138+
139+
- Providing clear information to users about server capabilities
140+
- Implementing appropriate consent mechanisms before connecting to servers
141+
- Displaying tool invocations and resource access to users when appropriate
142+
- Sandboxing server execution where feasible
143+
144+
**Operators and users are responsible for:**
145+
146+
- Connecting only to trusted MCP servers
147+
- Reviewing server configurations before deployment
148+
- Understanding the capabilities of servers they enable
149+
- Configuring appropriate access restrictions for their environment
150+
151+
For additional guidance on building and deploying secure MCP implementations, see the
152+
[Security Best Practices](https://modelcontextprotocol.io/specification/draft/basic/security_best_practices)
153+
documentation.
154+
155+
### What Remains In Scope
156+
157+
The following categories **are** considered security vulnerabilities when they arise
158+
from flaws in the MCP specification or official SDK implementations:
159+
160+
- **Protocol-level vulnerabilities**: Flaws in the MCP specification that enable
161+
attacks regardless of implementation
162+
- **Authentication/authorization bypasses**: Ways to access resources or invoke tools
163+
without proper authorization
164+
- **Implementation vulnerabilities**: Bugs in specific SDK implementations (buffer
165+
overflows, injection flaws, etc.)
166+
- **Sandbox escapes**: Breaking out of intended isolation boundaries explicitly
167+
defined in the protocol or SDKs
168+
- **Session hijacking**: Unauthorized access to another user's session
169+
- **Token theft or leakage**: Vulnerabilities that expose access tokens
170+
- **Cross-tenant access**: Accessing resources belonging to other users in
171+
multi-tenant deployments
172+
173+
This list is not exhaustive.
174+
175+
### Reporting Guidelines
176+
177+
When evaluating whether to report a potential security issue:
178+
179+
1. **Check this document first.** If the behavior is listed as intended, it is not
180+
a vulnerability.
181+
2. **Consider the trust model.** If the issue requires the attacker to already have
182+
access that the trust model assumes they have, it may not be a vulnerability.
183+
3. **Focus on unexpected access.** Vulnerabilities typically involve accessing
184+
resources or performing actions that should not be possible given the established
185+
trust boundaries.
186+
4. **Provide context.** If you believe you have found a genuine vulnerability,
187+
explain how it violates the intended security boundaries.

‎blog/layouts/partials/footer.html‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,12 +74,11 @@
7474
{{- if (not site.Params.disableThemeToggle) }}
7575
<script>
7676
document.getElementById("theme-toggle").addEventListener("click", () => {
77-
const html = document.querySelector("html");
78-
if (html.dataset.theme === "dark") {
79-
html.dataset.theme = 'light';
77+
if (document.body.className.includes("dark")) {
78+
document.body.classList.remove('dark');
8079
localStorage.setItem("pref-theme", 'light');
8180
} else {
82-
html.dataset.theme = 'dark';
81+
document.body.classList.add('dark');
8382
localStorage.setItem("pref-theme", 'dark');
8483
}
8584
})

0 commit comments

Comments
 (0)