Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

exa-labs/exa-mcp-server

              main @ a4dcddf
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

api/mcp.ts: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: The server forwarded raw incoming HTTP requests to an external analytics service without scrubbing authorization headers or query parameters, leaking active credentials. Developers must ensure any outbound tracking or analytics integration explicitly strips sensitive authentication metadata.

Auth Bypass: A logic bug in the rate-limit bypass evaluation allowed specific user-agent matching criteria to overwrite the user-provided API key ('config.exaApiKey') with the internal system bypass key, granting unauthorized access. State mutation rules for credentials must be robustly separated from request-attribute matching.