[GH-ISSUE #290] Security audit findings — tool description injection + missing output sanitization #132

New issue

Closed

opened 2026-10-18 21:12:03 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-18 21:12:03 +00:00

Owner

Originally created by @manja316 on GitHub (Mar 26, 2026).
Original GitHub issue: https://github.com/open-webui/mcpo/issues/290

Hi @open-webui team,

I recently ran a security audit on mcpo as part of research on MCP server security posture across the ecosystem.

Found a couple of items worth flagging:

1. Tool description injection risk
As an MCP-to-OpenAPI proxy, mcpo sits between tool definitions and the model. Tool descriptions aren't validated against adversarial patterns — a poisoned upstream MCP server can inject instructions through the proxy layer into the model context, bypassing any downstream safety checks.

2. Missing output sanitization
Proxied responses from upstream MCP servers pass through to the model context without scanning for embedded injection patterns. The proxy is actually the ideal layer to add sanitization — one fix covers every upstream server.

Both are in a full audit report — 8-page PDF with CVSS ratings, EU AI Act mapping, and remediation steps — for $29 at luciferforge.github.io/mcp-security-audit/

Demo: https://luciferforge.github.io/mcp-audit-reports/

— Lucifer / LuciferForge Security

Originally created by @manja316 on GitHub (Mar 26, 2026). Original GitHub issue: https://github.com/open-webui/mcpo/issues/290 Hi @open-webui team, I recently ran a security audit on **mcpo** as part of research on MCP server security posture across the ecosystem. Found a couple of items worth flagging: **1. Tool description injection risk** As an MCP-to-OpenAPI proxy, mcpo sits between tool definitions and the model. Tool descriptions aren't validated against adversarial patterns — a poisoned upstream MCP server can inject instructions through the proxy layer into the model context, bypassing any downstream safety checks. **2. Missing output sanitization** Proxied responses from upstream MCP servers pass through to the model context without scanning for embedded injection patterns. The proxy is actually the ideal layer to add sanitization — one fix covers every upstream server. Both are in a full audit report — 8-page PDF with CVSS ratings, EU AI Act mapping, and remediation steps — for $29 at luciferforge.github.io/mcp-security-audit/ Demo: https://luciferforge.github.io/mcp-audit-reports/ — Lucifer / LuciferForge Security

bsakaguchi closed this issue

2026-10-18 21:12:03 +00:00

bsakaguchi commented

2026-10-18 21:12:04 +00:00

Author

Owner

@taylorwilsdon commented on GitHub (May 17, 2026):

This server is meant to sit in the middle of trusted connections, not act as a security layer and not looking to buy an automated audit - thanks

@taylorwilsdon commented on GitHub (May 17, 2026): This server is meant to sit in the middle of trusted connections, not act as a security layer and not looking to buy an automated audit - thanks