fix(mcp): fail closed on empty scoped-key tag sets and missing accessType - #1581
Open
Sravanjangam wants to merge 1 commit into
Open
fix(mcp): fail closed on empty scoped-key tag sets and missing accessType#1581Sravanjangam wants to merge 1 commit into
Sravanjangam wants to merge 1 commit into
Conversation
…cessType - rbac: a scoped key whose tag/tag list resolves empty previously matched NO restriction clause, so every container tag came back with org-wide 'write' — defeating the scoped-key purpose. Empty set now denies everything. - shared/types: require accessType in sessionInfoSchema. An omitted value used to skip the restricted branch entirely and inherit the 'write' default; a schema-missing field now fails session parsing (-> 401) instead of failing open. All existing fixtures already send it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi supermemory team 👋 Thanks for building such a great product! While running a security & quality audit of the repo we hit this issue and put together a small, tested fix — details below.
Problem
MCP RBAC failed open:
effectiveContainerTagAccess()treated a scoped session whose scoped-tag set resolves empty as unrestricted → every container tag came back"write".sessionInfoSchemamarkedaccessTypeoptional, so a session missing it skipped the restricted branch entirely and inherited the"write"default.Net effect: a "scoped, read-only" API key had org-wide write access through MCP. Part of #1578 (finding M4, high severity).
Solution
Default-deny semantics: an empty allowlist allows nothing, and a session that doesn't declare its access type is rejected at parse time rather than silently escalated.
Changes
apps/mcp/src/server/auth/rbac.ts→ early-return[]whenscope.type === "scoped" && scopedTags.size === 0apps/mcp/src/shared/types.ts→accessTypenow required (with comment explaining why)rbac.test.ts→ +2 cases (scoped-empty denies writes; scoped key lists only its tags)shared/types.test.ts(new) → 2 schema cases incl. missingaccessTyperejectedVerification
Fresh from the committed branch:
bunx vitest run src/server/auth src/shared→ 17/17 pass, including pre-existing fixtures proving real sessions always sendaccessType(no compatibility break observed);tscadds zero new errors vs baseline; Biome clean.Happy to iterate on any of this — feedback and reworks very welcome! 🙏
Environment
fix/mcp-rbac-fail-closed— all gates re-run fresh at commit629ec2e59cb9