security: read-only MCP/index threat model, root allowlist, and untrusted-content framing #2589

Goal

Specify and test the safety properties of serving repository documentation to agents.

Background

Repository documents are untrusted input to an agent: they can contain prompt injection, secrets, or personal data. Base already treats manifest commands as needing explicit trust; the documentation server must stay strictly weaker (read-only) and bounded to declared roots.

Next-release planning review of 2026-10-14/15 against main at 7faf6dfb. Tracking: #2555.

Prerequisites: #2585 and #2586.

Scope

• Threat model document.
• Enforce: read-only, no exec or write tools, stdio only, roots limited to manifest-declared paths inside the project root (symlink and traversal safe), honors ignore files, size caps.
• Run Base redaction before indexing; mark returned content as untrusted data in the response envelope.
• Tests for traversal, symlink escape, ignored files, and secret redaction.

Acceptance Criteria

• Each enforced property has a failing-before test.
• Threat model is linked from the MCP docs.
• A secret fixture never appears in the index or in a response.

Validation

BASE_CLI_SOURCE_DIR=../base-cli/lib/python \
PYTHONPATH=../base-cli/lib/python:lib/python:cli/python \
python -m pytest <new security tests>
git diff --check

Non-Goals

• No network exposure.
• No authentication layer (stdio, local only).

Project Fields

• Status: Backlog
• Priority: P1
• Area: Security
• Initiative: Agentic Coding Platform
• Size: S
• Milestone: v1.12.0
• Category: security

Agent Assignment

Assignee: codeforester. Blocked on #2587.

Plan revision (2026-10-16)

Keep this in v1.12.0 and place it before #2587. #2587 consumes this threat model and its tests, rather than the security issue depending on the server. Expand the threat model to cover prompt injection and malicious instructions in issue/PR/docs content, credential/environment leakage, source-path and symlink identity, cache/index retention, and model-side trust framing. “Read-only stdio” is not sufficient by itself: the acceptance tests must prove containment, redaction, and explicit untrusted-data envelopes.