[Security] MCP Client Core: SSRF, STDIO Environment Leak & Response Injection

[Correctover]

[Security] MCP Client Core: SSRF, STDIO Environment Leak & Response Injection

Hi @VoltAgent team,

I've conducted an independent security audit of VoltAgent's MCP client implementation (packages/core/src/mcp/client/index.ts) and found 3 vulnerabilities — the same systemic pattern I've identified across 9 other MCP frameworks (AgentScope, CowAgent, AstrBot, Google ADK, mcp-agent, Qwen-Agent, Mastra, LangChain4j, mcp-use).

VULN-1 [HIGH] STDIO Environment Variable Leak

Line 184: env: { ...getDefaultEnvironment(), ...(config.server.env || {}) }

getDefaultEnvironment() from MCP SDK returns the full parent process environment. All env vars (API keys, DB passwords, AWS credentials) are leaked to the MCP subprocess. A malicious MCP server can exfiltrate them.

Fix: Use a minimal env allowlist — only pass variables the subprocess actually needs.

VULN-2 [HIGH] SSRF — Zero URL Validation

Lines 162, 168, 174: new URL(config.server.url) passed directly to transports.

No protocol validation. Attackers can supply file:///etc/passwd, ftp://, or internal network addresses. No domain allowlist/blocklist.

Fix: Add protocol allowlist (http/https only) + internal address filtering.

VULN-3 [MEDIUM] Response Injection

Lines 502-512: return { content: result } — tool results passed directly to upstream LLM with no content filtering.

A malicious MCP server can inject prompt instructions via tool results.

Fix: Sanitize/filter tool results before returning.

---

Systemic Pattern

This is the 10th framework with the same 3 vulnerability categories. I've developed CCS (MCP Runtime Security Conformance Standard) and an open-source SDK (Correctover) that addresses all these patterns at ~22μs P50 overhead.

Zenodo DOI for cross-framework report: 10.5281/zenodo.21405206

I'm happy to:

1. Submit fix PRs for all 3 vulnerabilities
2. Share the CCS compliance reference for VoltAgent
3. Provide the full cross-framework security analysis

Let me know how you'd like to proceed.

[Correctover]

Hi team 👋

Following up on this security report. I've independently identified the same vulnerability pattern (SSRF + STDIO environment leak + response injection) across 10 major MCP frameworks — AgentScope, CowAgent, AstrBot, Google ADK, mcp-agent, Qwen-Agent, Mastra, LangChain4j, mcp-use, and now VoltAgent.

This confirms it's a systemic MCP ecosystem issue, not just individual bugs.

We've developed CCS (MCP Runtime Security Conformance Standard) — an open standard and SDK that addresses all these vulnerabilities with ~22μs P50 overhead.

What I can offer VoltAgent:

1. Ready-to-use fix patches for all 3 vulnerabilities
2. CCS compliance reference — VoltAgent could be a showcase for MCP runtime security
3. Full cross-framework security analysis (10 frameworks)

Happy to share fixes or discuss. Let me know how you'd like to proceed!