fix(mcp): enforce session write gate on add_memory/getDocument scoping + input bounds - #1582
Open
Sravanjangam wants to merge 1 commit into
Open
fix(mcp): enforce session write gate on add_memory/getDocument scoping + input bounds#1582Sravanjangam wants to merge 1 commit into
Sravanjangam wants to merge 1 commit into
Conversation
- add_memory: apply the same session write gate as guided-save/ upload-file; an explicit containerTag previously bypassed RBAC so a restricted/scoped-read session could write into any space. - getDocument: verify the fetched document's containerTags include the active space before returning it (get-by-ID bypassed space scoping every other read tool applies); generic not-found error avoids an existence oracle. Docs without tag metadata can't be checked. - fetch-graph-data: bound page/limit (int, >=1) like sibling list tools; unbounded values flowed straight into a metered backend query and were echoed into model context uncapped. - guided-save: cap prefill at 200k like add_memory content. - whoAmI: stop echoing the MCP transport session id (bearer-style credential) into model-visible output persisted in transcripts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi supermemory team 👋 Thanks for building such a great product! While running a security & quality audit of the repo we hit this issue and put together a small, tested fix — details below.
Problem
Four gaps in MCP tools allowed a restricted session to exceed its grants:
add_memoryskipped the session write gate its sibling tools apply whenever the caller supplied explicitcontainerTags.getDocumentfetched any raw document ID with no space scoping — cross-space reads by ID.fetch-graph-datapassed unbounded, non-integerpage/limitinto the metered backend.guided-save.prefillwas length-unbounded, andwhoAmIechoed the transportsessionIdinto model-visible output.Part of #1578 (findings M5–M7 + low-severity set).
Solution
Mirror the gate pattern the sibling tools already use, verify document membership server-side before returning data, bound every numeric/string input, and keep credentials out of tool outputs.
Changes
tools/add-memory.ts→ session write gate applied to explicitcontainerTagstools/get-document.ts→containerTagsmembership check returning generic "Document not found"tools/fetch-graph-data.ts→ bounded integer coercion ofpage/limittools/guided-save.ts→prefillcapped at 200000 charstools/who-am-i.ts→sessionIdremoved from outputVerification
Fresh from the committed branch:
bunx vitest run src/server/auth→ 13/13 pass on this branch base;tscadds zero new errors vs baseline for all five touched files; Biome clean. Merge note: independent of #1581/#1587 (different files).Happy to iterate on any of this — feedback and reworks very welcome! 🙏
Environment
fix/mcp-tool-guards— all gates re-run fresh at commitb81b9b4183da