Add version-aware MCP & A2A security checks (OAuth 2.1, MCP Apps, A2A UI, signatures) - #1
Merged
Merged
Conversation
… UI, signatures) MCP: - Negotiate latest spec revision (2025-06-18) instead of pinned 2024-11-05; flag deprecated revisions that predate the OAuth Resource Server model and Resource Indicators (RFC 8707); echo MCP-Protocol-Version header - Probe OAuth 2.1 Protected Resource Metadata (RFC 9728) and inspect the WWW-Authenticate challenge; flag openly-accessible servers - Tool annotations (readOnly/destructive hints) checks for state-changing tools - Scan resources/list and prompts/list for file:// exposure, sensitive locations, and prompt-injection / intent-subversion poisoning - Detect the MCP Apps interactive-UI extension (ui:// resources, _meta UI templates) and flag sandbox/CSP/consent obligations and external-origin UI - Lethal-trifecta detection (untrusted input + private data + exfiltration) A2A: - Resolve canonical /.well-known/agent-card.json with legacy fallback - Modern securitySchemes/security (apiKey-in-query, HTTP Basic, unreferenced schemes) with legacy authentication fallback - JWS AgentCardSignature checks (presence, alg:none, missing kid) - Transport binding validation (JSONRPC/GRPC/HTTP+JSON, plaintext endpoints) - Declared extensions incl. A2A UI / A2UI untrusted-render warning - protocolVersion and auxiliary-URL (iconUrl/documentationUrl) checks SDK packages and compliance test routes updated for parity.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+1072
to
+1076
| const prmRes = await fetch(`${origin}/.well-known/oauth-protected-resource`, { | ||
| method: 'GET', | ||
| headers: { Accept: 'application/json' }, | ||
| signal: AbortSignal.timeout(5000), | ||
| }); |
Comment on lines
+1502
to
+1506
| const resResponse = await fetch(serverUrl, { | ||
| method: 'POST', | ||
| headers: reqHeaders, | ||
| body: JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'resources/list', params: {} }), | ||
| }); |
Comment on lines
+1515
to
+1519
| const promptResponse = await fetch(serverUrl, { | ||
| method: 'POST', | ||
| headers: reqHeaders, | ||
| body: JSON.stringify({ jsonrpc: '2.0', id: 4, method: 'prompts/list', params: {} }), | ||
| }); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MCP:
flag deprecated revisions that predate the OAuth Resource Server model and
Resource Indicators (RFC 8707); echo MCP-Protocol-Version header
WWW-Authenticate challenge; flag openly-accessible servers
locations, and prompt-injection / intent-subversion poisoning
templates) and flag sandbox/CSP/consent obligations and external-origin UI
A2A:
schemes) with legacy authentication fallback
SDK packages and compliance test routes updated for parity.