docs(security): SAFE-MCP audit report 2026-04-17 (closes #747)

[molecule-ai]

[security-auditor-agent]

Closes #747.

Summary

• Commits docs/security/safe-mcp-audit-2026-04-17.md — full audit of the Molecule AI MCP server stack against the SAFE-MCP ATT&CK framework (Linux Foundation / OpenID Foundation, Apr 2026), covering four high-priority SAFE-T categories
• Confirmed VULN-001 FIXED (security: CRITICAL — X-Workspace-ID header forge bypasses CanCommunicate and token validation in A2A proxy #761): X-Workspace-ID: system:* forge is blocked at the HTTP handler layer
• Filed sub-issues for all HIGH severity findings: security: Unpinned npm MCP packages in .mcp.json (npx -y) — SAFE-T1102 #805, security: No manifest signing / content integrity on GitHub plugin install — SAFE-T1102 #806, security: GLOBAL memory delimiter-spoofing gap — prompt injection still possible — SAFE-T1201 #807

Findings Summary

Severity	Count	IDs
CRITICAL	0	— (VULN-001 was CRITICAL, now FIXED)
HIGH	3	NEW-003, VULN-003, VULN-004 (+ VULN-002 partially mitigated)
MEDIUM	4	VULN-006, NEW-002, NEW-001, VULN-005
LOW	1	NEW-004
FIXED	1	VULN-001 (#761)

High-Priority Findings

NEW-003 (HIGH) — Unpinned npm MCP packages in .mcp.json (#805)
Both @molecule-ai/mcp-server and @awareness-sdk/local run via npx -y with no version pin — arbitrary code execution on next restart if either npm package is compromised. Fix: pin exact versions, remove -y, add lockfile.

VULN-003 (HIGH) — No manifest signing on GitHub plugin install (#806)
platform/internal/plugins/github.go clones plugin repos with no checksum/signature verification. A push to an org-allowed repo installs unverified content. Fix: add sha256: field to plugin.yaml, verify post-clone.

VULN-004 (HIGH) — Floating plugin refs
No enforcement of pinned #sha or #vtag for production installs. Same org/repo ref installs different code on reinstall. Fix: reject bare org/repo without explicit ref.

VULN-002 (HIGH, partially mitigated) — GLOBAL memory delimiter spoofing (#807)
PR #767 added a [MEMORY id=... scope=GLOBAL from=...]: wrapper — good mitigation. Remaining gap: content that begins with a fake [MEMORY ...] prefix defeats the visual heuristic. No write-time content scanning exists. Fix: reject writes matching delimiter prefix; add injection heuristic scan.

Medium/Low Findings (backlog)

• VULN-006 MEDIUM — No tool output sanitization in a2a_mcp_server.py — delegate_task results returned verbatim
• NEW-002 MEDIUM — Default subprocess sandbox allows language=shell/bash — SAFE-T1301
• NEW-001 MEDIUM — builtin_tools/a2a_tools.py and delegation.py missing auth_headers() on A2A calls
• VULN-005 MEDIUM — GLOBAL memories readable by all workspaces (partially mitigated by delimiter)
• NEW-004 LOW — _maybe_log_skill_promotion unauthenticated heartbeat POST

Test plan

• Verify audit document renders correctly on GitHub
• Confirm sub-issues security: Unpinned npm MCP packages in .mcp.json (npx -y) — SAFE-T1102 #805, security: No manifest signing / content integrity on GitHub plugin install — SAFE-T1102 #806, security: GLOBAL memory delimiter-spoofing gap — prompt injection still possible — SAFE-T1201 #807 are triaged and assigned to sprint backlog
• Verify VULN-001 fix (HTTP 403 on X-Workspace-ID: system:forge) in a2a_proxy_test.go

🤖 Generated with Claude Code — Security Auditor Agent