Skip to content

fix(mcp): point quarantine remediation at quarantine_security, not upstream_servers #816

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Dumbris merged 1 commit into from
Jul 7, 2026
+11 −4
Merged

fix(mcp): point quarantine remediation at quarantine_security, not upstream_servers #816

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions internal/server/mcp.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2484,7 +2484,7 @@ func (p *MCPProxyServer) handleQuarantinedToolCall(ctx context.Context, serverNa
"toolName": toolName,
"requestedArgs": args,
"message": fmt.Sprintf("🔒 SECURITY BLOCK: Server '%s' is currently in quarantine for security review. Tool calls are blocked to prevent potential Tool Poisoning Attacks (TPAs).", serverName),
"instructions": "To use tools from this server, please: 1) Review the server and its tools for malicious content, 2) Use the 'upstream_servers' tool with operation 'list_quarantined' to inspect tools, 3) Use the tray menu or 'upstream_servers' tool to remove from quarantine if verified safe",
"instructions": "To use tools from this server, please: 1) Review the server and its tools for malicious content, 2) Use the 'quarantine_security' tool with operation 'inspect_quarantined' to inspect tools, 3) Ask the user to remove the server from quarantine via the tray menu or Web UI if verified safe",
"toolAnalysis": toolAnalysis,
"securityHelp": "For security documentation, see: Tool Poisoning Attacks (TPAs) occur when malicious instructions are embedded in tool descriptions. Always verify tool descriptions for hidden commands, file access requests, or data exfiltration attempts.",
}
Expand Down Expand Up @@ -3967,11 +3967,11 @@ func (p *MCPProxyServer) handleAddUpstream(ctx context.Context, request mcp.Call
if quarantined {
responseMap["security_status"] = "QUARANTINED_FOR_REVIEW"
responseMap["message"] = fmt.Sprintf("🔒 SECURITY: Server '%s' has been added but is quarantined for security review. Tool calls are blocked to prevent potential Tool Poisoning Attacks (TPAs).", name)
responseMap["next_steps"] = "To use tools from this server, please: 1) Review the server and its tools for malicious content, 2) Use the 'upstream_servers' tool with operation 'list_quarantined' to inspect tools, 3) Use the tray menu or API to unquarantine if verified safe"
responseMap["next_steps"] = "To use tools from this server, please: 1) Review the server and its tools for malicious content, 2) Use the 'quarantine_security' tool with operation 'inspect_quarantined' to inspect tools, 3) Ask the user to remove the server from quarantine via the tray menu or Web UI if verified safe"
responseMap["security_help"] = "For security documentation, see: Tool Poisoning Attacks (TPAs) occur when malicious instructions are embedded in tool descriptions. Always verify tool descriptions for hidden commands, file access requests, or data exfiltration attempts."
responseMap["review_commands"] = []string{
"upstream_servers operation='list_quarantined'",
"upstream_servers operation='inspect_quarantined' name='" + name + "'",
"quarantine_security operation='list_quarantined'",
"quarantine_security operation='inspect_quarantined' name='" + name + "'",
}
responseMap["unquarantine_note"] = "IMPORTANT: Unquarantining can be done through the system tray menu, Web UI, or API endpoints for security."
} else {
Expand Down
7 changes: 7 additions & 0 deletions internal/server/mcp_direct_callability_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,13 @@ func TestDirectToolCallabilityBlock_ServerQuarantined(t *testing.T) {
assert.Equal(t, "QUARANTINED_SERVER_BLOCKED", response["status"])
assert.Equal(t, "github", response["serverName"])
assert.Equal(t, "list_repos", response["toolName"])

// The remediation must point at operations the agent can actually execute:
// list_quarantined/inspect_quarantined live on quarantine_security, and
// upstream_servers rejects them with "Unknown operation".
instructions, _ := response["instructions"].(string)
assert.Contains(t, instructions, "quarantine_security")
assert.NotContains(t, instructions, "'upstream_servers' tool with operation 'list_quarantined'")
}

func TestDirectToolCallabilityBlock_ConfigDeniedTool(t *testing.T) {
Expand Down
Loading