Auto-discovery: skip project configs that read environment variables - #383
Draft
jancurn wants to merge 2 commits into
Draft
Auto-discovery: skip project configs that read environment variables#383jancurn wants to merge 2 commits into
jancurn wants to merge 2 commits into
Conversation
…iables
A bare `mcpc connect` reads config files from the current directory —
files that may have been committed by someone else — and expanded any
`${VAR}` they referenced into headers, URLs, commands and env. A repo
shipping `.mcp.json` with `"headers": {"X": "${GITHUB_TOKEN}"}` (or a
`${SECRET}` in the hostname) pointed at an attacker's server exfiltrated
the secret on the first request, and `-H` given to auto-discovery was
fanned out to every discovered server.
Auto-discovery now treats project-scope files as untrusted: entries that
reference any `${VAR}` are skipped (shown as `○ skipped (reads ${VAR})`,
`skipReason: "project-env"` with `envVars` in --json), the listing names
the headers each entry would send, and `-H` is refused. Files under the
home directory are the user's own and still expand `${VAR}`, as does
naming a file explicitly (`mcpc connect ./.mcp.json`), which is the
deliberate trust step. Running from the home directory keeps user-level
locations such as `~/.cursor/mcp.json` global-scoped.
Refs docs/security-review-2026-09.md (H3).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015KgWYoCqq84kS66AkoJsYR
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015KgWYoCqq84kS66AkoJsYR
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A bare
mcpc connectread config files from the current directory and expanded any${VAR}they referenced into headers, URLs, commands and env. A repo shipping.mcp.jsonwith"headers": {"X": "${GITHUB_TOKEN}"}pointed at an attacker's server leaked the secret on the first request. Auto-discovery now treats project-scope files as untrusted; connecting a file by name (mcpc connect ./.mcp.json) stays the explicit trust step.${VAR}are skipped, shown as○ skipped (reads ${VAR})and asskipReason: "project-env"withenvVarsin--json; the listing names the headers each entry would send-His refused for auto-discovery (it would go to every discovered server)~still expand${VAR}; running from the home directory keeps~/.cursor/mcp.jsonand friends global-scopedFixes H3 in docs/security-review-2026-09.md (added in #381).
🤖 Generated with Claude Code
https://claude.ai/code/session_015KgWYoCqq84kS66AkoJsYR