v0.29.0 — MCP confinement and the analysis-prompt frame

Two CRITICAL vulnerabilities, both reachable in every published version through 0.28.0. Upgrade before running HackMyAgent against a repository you do not control, and re-register the MCP server if you use it.

There is no patched 0.28.x. 0.28.0 was cut and published from a separate branch while this fix was still in review, so it carries neither fix, and neither does 0.27.0.

The MCP server read any file and wrote to any directory (#463)

Affects 0.6.0 through 0.28.0. hackmyagent_analyze_file returned whatever absolute path the host model asked for. mcp-serve now requires --root and has no unconfined mode.

If you have run the MCP server, rotate any credential that was readable from the machine it ran on. It accepted any absolute path, so the set of files it could have returned is not bounded by the project you pointed it at. HackMyAgent collects no telemetry, so we cannot tell you what any particular install read, and nothing we can run after the fact would establish that.

A file being scanned could make HackMyAgent report it clean (#462, closed in part)

Affects 0.8.0 through 0.28.0. Scanned content was interpolated into the analysis prompt with no boundary and no escaping, and the analyst's answer was read with a parser that turned any failure into "no findings". End to end, secure --deep scored a file with a plaintext admin password 69/100 exit 1, and 98/100 exit 0 once a forged block was appended. The credentials were still in the file.

The artifact is now wrapped in a boundary carrying 128 random bits per request, so a file cannot forge the frame it would have to imitate, and a response HackMyAgent cannot read is reported as an unanalyzed file rather than a clean one.

#484 remains OPEN. The reply reader is still forgeable: a scanned file carrying its own fenced findings array can get that array adopted as the deep-tier result. A secure --deep PASS on a tree you do not control is not proof of anything. Running secure without --deep is unaffected.

Breaking

mcp-serve requires --root, so an existing MCP registration stops working until re-registered. secure --deep gains a third exit code. A ^0.28.0 range does not resolve to this release; @latest and npx pick it up on the next run.

Known issues

Five P1s are carried, each reproduced against published 0.28.0 rather than asserted pre-existing: #438 (an unreadable file is scored as clean and the score goes UP), #389 (--fix writes plaintext credentials to a path it does not gitignore), #487 (scan host:port discards the port and calls a live server unreachable, exit 0), #480 (wild --tier unvalidated), #477 (fix-all reports credentials clean where secure reports CRITICAL).

#368 and #390 are on a third carry, one more than the release rule allows. That is a recorded decision, not an oversight: 0.28.0 carries both of them too, plus both vulnerabilities above, so holding this release would leave every user strictly worse off. Both are the first work in 0.30.0.

Full detail, including the reproductions, is in CHANGELOG.md.

Published with SLSA v1 provenance via npm Trusted Publishing.