Skip to content

sourcedetect: detect unauthenticated MCP route exposure#17

Open
brian93512 wants to merge 1 commit intomainfrom
codex/as019-mcp-route-auth
Open

sourcedetect: detect unauthenticated MCP route exposure#17
brian93512 wants to merge 1 commit intomainfrom
codex/as019-mcp-route-auth

Conversation

@brian93512
Copy link
Copy Markdown
Member

Summary

  • add AS-019 sourcedetect rule for unauthenticated MCP route exposure in embedded Go/Gin servers
  • detect auth asymmetry when one MCP route protects a handler and another route exposes the same handler without equivalent auth
  • add fixtures and tests covering the nginx-ui style /mcp vs /mcp_message pattern

Testing

  • go test ./...

Comment thread pkg/sourcedetect/routes.go Fixed
@brian93512 brian93512 force-pushed the codex/as019-mcp-route-auth branch from b5dc742 to e2a79d3 Compare April 29, 2026 02:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants