Skip to content

v4.5.1 — Fase 1 Security Hardening (standalone library)

Latest
Latest

Choose a tag to compare

View all tags
@lyonzin lyonzin released this 29 Jul 00:29
v4.5.1
76500a6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v4.5.1 — Fase 1 Security Hardening (standalone library, zero behavior change)

Ships the tools; wires them into MCP handlers in v4.6.0. Users motivated to adopt hardening today can import and apply immediately. Existing setups: nothing changes.

🟢 New surface — usable today

A standalone mcp_server.security library that closes three attack classes against untrusted document ingestion. Import explicitly to opt in:

Defense Import Use
Path traversal + symlink escape (CWE-22 / CWE-59) from mcp_server.security import validate_path_within, is_path_within, PathEscapeError Validate any filepath a client (LLM or human) supplied before touching disk. Rejects .., absolute-outside-base, symlinks whose target leaves the corpus root.
Prompt injection (OWASP LLM01:2025) from mcp_server.security import sanitize_external_content, neutralize_injection_sentinels, wrap_external_content, detect_external_marker Wrap content fetched from URLs / dropped files with tagged sentinels — the downstream LLM can distinguish operator-authored context from external content.
Unauthenticated HTTP transport (CWE-287) from mcp_server.security import BearerAuthMiddleware, bearer_token_matches, extract_bearer_token Attach BearerAuthMiddleware to a Starlette / FastAPI app. Constant-time comparison. stdio bypasses auth by construction (no network surface).
Provenance / integrity from mcp_server.security import content_sha256 Evidence-chain utility for auditing what was indexed vs what was returned.

🟡 Internal changes (visible only if you look)

  • README carries the OpenSSF Best Practices badge (placeholder project ID until the project is registered at bestpractices.coreinfrastructure.org).
  • SECURITY.md expanded with a full defense matrix + threat model.
  • .github/SECURITY.md — new. Enables GitHub's built-in "Report a vulnerability" button.
  • .github/openssf-best-practices.md — new. Evidence pack for OpenSSF badge registration.
  • .github/dependabot.yml — pip schedule tightened monthly → weekly (OpenSSF-recommended floor for language ecosystems). Expect ~4× more dependabot PRs.
  • docs/adr/0001-fase1-security-hardening.md — new ADR capturing the design + integration roadmap for v4.6.0.
  • tests/security/ — 71 new tests (57 unit green + 14 integration xfail, strict=False, pinned for v4.6.0 wire-up).
  • README ## Unreleased — new ### v4.5.1 entry with the full narrative.

🔴 What does NOT change (why this is a PATCH, not MINOR)

Behavior State
Existing add_document / add_from_url / parse_file / get_document calls Byte-identical — no caller in the master imports security yet
13 MCP tool signatures Preserved 100% (tests/test_backwards_compat.py green)
Config schema Zero change
BM25, semantic search, cross-encoder rerank, query cache, GPU support Zero change
Dependencies (mcp>=1.6.0,<2.0.0, chromadb, fastembed) Zero change
Performance Zero regression

⚠️ Watch-outs

  1. XXXX placeholder in the OpenSSF badge URL — the project needs to be registered at bestpractices.coreinfrastructure.org so the badge resolves to a real numeric ID.
  2. from mcp_server.security import ... works today, but automatic wiring (validation in add_document, injection defense in parse_file, bearer auth in main()) lands in v4.6.0. If you rely on the defenses being applied automatically, wait for v4.6.0. If you're motivated to adopt hardening now, import and call the primitives yourself.
  3. 14 integration tests in tests/security/ are marked xfail (strict=False) — they will turn green automatically when v4.6.0 wires the primitives into the MCP tools.

Migration guide

None required. This is an additive PATCH. Existing installs continue to work with byte-identical behavior.

Full threat model

See docs/adr/0001-fase1-security-hardening.md for the complete ADR — CWE mapping, per-defense contract, integration roadmap.

Version bump: 4.5.0 → 4.5.1 (PATCH — additive library only, zero behavior change on the default install).

Test results on CI: 34 SUCCESS / 0 real failure across 9 OS×Python cells (Linux + macOS + Windows × Python 3.11 + 3.12 + 3.13). Backwards-compat, Semgrep, mypy strict, format smoke matrix, memory baseline, property-based fuzz — all green.

Assets 2
Loading