Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
arabold/docs-mcp-server
main @ 0091ab8
12
Fixes
0
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
src/auth/ProxyAuthManager.ts: most-fixed (2 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The built-in OAuth proxy is highly sensitive to parameter-tampering, audience-binding, and client-controllable Host headers which allowed unauthorized token replay and validation bypasses. Developers must enforce strict parameter overrides and resource pinning to origin configurations.
SSRF: Outbound requests initiated by the crawler/scraper could target internal services or local resources if network limits, redirect validations, and DNS-resolution policies are bypassed.
Auth Bypass: Incorrect boolean parsing of string values like 'false', '0', or 'off' in environment variables could lead to administrative or unauthenticated states being silently enabled when they were intended to be disabled.