Skip to content

v2.3.15 — parity review, Cloud Security surface, multi-tenant hardening

Choose a tag to compare

View all tags
@maximelb maximelb released this 30 Jul 15:23
· 30 commits to master since this release
v2.3.15
2a8ebda
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Full audit of every MCP tool against the current API gateway, Go SDK and CLI, plus the Cloud Security (CNAPP) surface and a multi-tenant isolation review.

Tool count: 278 → 339, across 13 profiles (two new: cloud_security, cloud_security_readonly).

Security

  • ai_agent.operate bypass closed. In UID mode, omitting the oid argument while an OID was pinned on the auth context skipped the check entirely. Now enforced against the effective OID on all three dispatch paths.
  • Profiles are now an authorization boundary, not a display filter. tools/call previously never consulted the profile, so a narrow endpoint such as /mcp/cloud_security_readonly could invoke any registered tool including writes. lc_call_tool is bounded by the same set; api_access is exempt by construction.
  • X-LC-OID is checked against the bearer JWT's own org claims (failing open for thin tokens), and the credential headers are validated at the boundary.
  • cloudsec_get_fleet_overview filters rows per org against ai_agent.operate, withholding rollups when any row is dropped.
  • PermissionCache and OrgCache now sweep and cap; previously they never deleted entries while keying on the JWT, so every token rotation retained that credential's permission map.

A three-part isolation audit (credential/cache keying, shared mutable state, dispatch boundaries) found no cross-tenant leak.

Broken tools fixed

Tools that never worked or returned wrong data: all four yara_scan_* (rule passed as a flag where the parser wants a positional), find_strings, get_registry_keys, is_isolated / get_sensor_info (read a field the platform never sends), query_lookup (wrong nesting level), set_rule with a ttl (seconds where hive wants milliseconds), expand_investigation (form body to a JSON-only route), list_artifacts (both filters dead), create_case with a detection, get_sku_definitions (nonexistent route), add_output with JSON booleans/numbers, and batch_search_iocs (required info_type ignored). Sensor command values are now shell-quoted for the platform's tokenizer, so paths with spaces survive.

Systemic: every hive set_* tool used to wipe usr_mtd (tags, comment, expiry, ui_actions) and force-enable the record on content updates. Content writes now preserve metadata unless explicitly overridden.

New

The internal/tools/cloudsec package (49 tools): findings and triage writes, CIEM, inventory, DSPM, compliance, CAASM, topology, attack paths, policy simulation, graph query, CSV export, sensor↔asset resolution, fleet overview. Plus the ai_skill hive family, org description support, brief document-hive listings, IOC search options, get_org_delete_confirmation, and an SDK bump.

Breaking

  • Callers using a narrow profile endpoint to reach tools outside it now get an error.
  • Response shapes: get_historic_events, get_detection_rules, list_yara_rules, export_sensors, get_online_sensors.
  • Params: find_strings.strings is an array; list_artifacts renamed sid→source, artifact_type→hint, start/end required.
Assets 2
Loading