pypi · sand-martin0.2.1

Evidence

import asyncio

import httpx

import json

import logging

RemediationAI

The get_node_details tool returns data for any node matching the supplied node_id without checking whether the caller has permission to view that node. Add a principal-derived authorization filter by extracting the caller's user_id or tenant_id from the MCP context and querying only nodes where `owner_id = caller_user_id` (or equivalent tenant check). This prevents information disclosure of nodes the caller does not own. Verify by requesting details for a node owned by a different user and confirm the response is a 403 Forbidden or 404 Not Found.

Evidence

import asyncio

import httpx

import json

import logging

RemediationAI

The get_node_details tool returns data for any node matching the supplied node_id without checking whether the caller has permission to view that node. Add a principal-derived authorization filter by extracting the caller's user_id or tenant_id from the MCP context and querying only nodes where `owner_id = caller_user_id` (or equivalent tenant check). This prevents information disclosure of nodes the caller does not own. Verify by requesting details for a node owned by a different user and confirm the response is a 403 Forbidden or 404 Not Found.

Evidence

import asyncio

import httpx

import json

import logging

RemediationAI

The get_node_details tool returns data for any node matching the supplied node_id without checking whether the caller has permission to view that node. Add a principal-derived authorization filter by extracting the caller's user_id or tenant_id from the MCP context and querying only nodes where `owner_id = caller_user_id` (or equivalent tenant check). This prevents information disclosure of nodes the caller does not own. Verify by requesting details for a node owned by a different user and confirm the response is a 403 Forbidden or 404 Not Found.

Evidence

import asyncio

import httpx

import json

import logging

RemediationAI

The get_node_details tool returns data for any node matching the supplied node_id without checking whether the caller has permission to view that node. Add a principal-derived authorization filter by extracting the caller's user_id or tenant_id from the MCP context and querying only nodes where `owner_id = caller_user_id` (or equivalent tenant check). This prevents information disclosure of nodes the caller does not own. Verify by requesting details for a node owned by a different user and confirm the response is a 403 Forbidden or 404 Not Found.

Evidence

import asyncio

import httpx

import json

import logging

RemediationAI

The get_node_details tool returns data for any node matching the supplied node_id without checking whether the caller has permission to view that node. Add a principal-derived authorization filter by extracting the caller's user_id or tenant_id from the MCP context and querying only nodes where `owner_id = caller_user_id` (or equivalent tenant check). This prevents information disclosure of nodes the caller does not own. Verify by requesting details for a node owned by a different user and confirm the response is a 403 Forbidden or 404 Not Found.

Evidence

return f.read().strip()

        except Exception as e:

            logger.warning(f"Failed to read token file: {e}")

    return None

async def _make_request(method: str, endpoint: str, data: Optional[Dict[str, Any]] = None) -> str:

RemediationAI

The _make_request function uses a shared module-level authentication token from _get_auth_token() that reads SAND_MARTIN_TOKEN environment variable or a temp file, ignoring per-caller identity when making HTTP requests to the Sand Martin C# Host. Modify _make_request to accept a caller_token parameter (extracted from the MCP request context) and pass it in the Authorization header instead of the shared token: `headers={'Authorization': f'Bearer {caller_token}'}`. This ensures each request is authenticated as the actual caller, not a shared service account. Verify by logging the Authorization header value and confirming it reflects the per-request caller's credentials.

Evidence

Sand Martin Host in Rhino.

    The authentication uses the 'Bearer' token format in the HTTP Authorization header:

    `Authorization: Bearer <YOUR_TOKEN>`

    Example manual verification:

    `curl -X GET http://127.0.0.1:8081/state -H "Authorization: Bearer <YOUR_TOKEN>"`

RemediationAI

The get_canvas_state, create_node, update_node, delete_node, connect_nodes, and disconnect_nodes tools all use a shared module-level authentication token from _get_auth_token() without consulting per-request caller credentials. Refactor each tool to accept the caller's token from the MCP request context (via mcp.request.metadata or similar) and pass it to _make_request instead of relying on the shared environment variable token. This ensures all operations are authenticated as the actual caller. Test by invoking each tool with different user credentials and confirming the Authorization header reflects the correct per-caller token.

Evidence

import asyncio

import httpx

import json

import logging

RemediationAI

The _make_request function performs network side effects (outbound HTTP requests to Sand Martin C# Host) that are not disclosed in its name or docstring. Add a detailed docstring that explicitly documents the network call: `"""Makes HTTP request to Sand Martin Host at HOST_URL. Side effects: outbound network request. Returns response text or raises httpx.HTTPError."""`. Consider renaming to _http_request_to_sand_martin for clarity. This ensures callers understand the function has external dependencies and network latency. Verify by reading the docstring and confirming it clearly states the network side effect.

Evidence

import asyncio

import httpx

import json

import logging

RemediationAI

The _make_request function performs network side effects (outbound HTTP requests to Sand Martin C# Host) that are not disclosed in its name or docstring. Add a detailed docstring that explicitly documents the network call: `"""Makes HTTP request to Sand Martin Host at HOST_URL. Side effects: outbound network request. Returns response text or raises httpx.HTTPError."""`. Consider renaming to _http_request_to_sand_martin for clarity. This ensures callers understand the function has external dependencies and network latency. Verify by reading the docstring and confirming it clearly states the network side effect.

Evidence

stream=sys.stderr

)

logger = logging.getLogger("sand-martin")

# Initialize FastMCP server

mcp = FastMCP(

    "sand-martin",

    instructions="""

    Securely orchestrates the Grasshopper canvas within Rhino using the Sand Martin Host.

    SECURITY & AUTHENTICATION:

    This server requires a random 32-character 'shared secret' token generated by the 

    Sand Martin Host in Rhino.

    The authentication uses the 'Bearer' token format in the HTTP Authorization header:

    `Authorizatio

RemediationAI

The FastMCP server instructions contain imperative directives ('MUST first ask', 'should write', 'ask the user', 'identify', 'Call') that steer LLM agent behavior and decision-making rather than describing tool capabilities. Replace imperative workflow instructions with declarative tool descriptions: remove 'MUST', 'should', 'ask the user' and instead write 'This server provides tools to create, update, delete, and connect nodes. Each tool requires authentication via Bearer token.' This prevents the instructions from manipulating agent behavior at runtime. Verify by reviewing the instructions and confirming they describe tool behavior without imperative directives.

Evidence

stream=sys.stderr

)

logger = logging.getLogger("sand-martin")

# Initialize FastMCP server

mcp = FastMCP(

    "sand-martin",

    instructions="""

    Securely orchestrates the Grasshopper canvas within Rhino using the Sand Martin Host.

    SECURITY & AUTHENTICATION:

    This server requires a random 32-character 'shared secret' token generated by the 

    Sand Martin Host in Rhino.

    The authentication uses the 'Bearer' token format in the HTTP Authorization header:

    `Authorizatio

RemediationAI

The FastMCP server initialization embeds dynamic behavior guidance in the instructions field that steers AI agent workflows and authentication handling at runtime, creating a vector for prompt injection or agent manipulation. Move all security-critical guidance (authentication requirements, authorization rules, rate limits) out of the instructions field and into tool-level docstrings and parameter validation logic. Keep instructions minimal and declarative: 'This server orchestrates Grasshopper canvas operations.' This prevents runtime instruction injection from affecting agent behavior. Verify by confirming the instructions field contains only static, declarative text without workflow directives.

Evidence

import asyncio

import httpx

import json

import logging

import sys

import os

import tempfile

from typing import Optional, Dict, Any

from mcp.server.fastmcp import FastMCP

# Configure logging to stderr (required for MCP servers as stdout is used for communication)

logging.basicConfig(

    level=logging.INFO,

    format="%(asctime)s - %(name)s - %(levelname)s - %(message)s",

    stream=sys.stderr

)

logger = logging.getLogger("sand-martin")

# Initialize FastMCP server

mcp = FastMCP(

    "sand-mart

RemediationAI

The Sand Martin MCP server fetches untrusted JSON responses from an external C# Host and returns them verbatim to the LLM without provenance delimiters, enabling indirect prompt injection if the host is compromised. Wrap all responses from the remote host with explicit provenance markers: `return f'[SAND_MARTIN_HOST_RESPONSE] {json_response} [/SAND_MARTIN_HOST_RESPONSE]'` and validate the JSON structure before returning. Additionally, sanitize any string fields that might contain prompt-injection payloads. This makes the external origin explicit and limits injection surface. Verify by injecting malicious JSON into a mocked Sand Martin Host response and confirming the LLM receives it wrapped with provenance delimiters.

Evidence

import asyncio

import httpx

import json

import logging

import sys

import os

import tempfile

from typing import Optional, Dict, Any

from mcp.server.fastmcp import FastMCP

# Configure logging to stderr (required for MCP servers as stdout is used for communication)

logging.basicConfig(

    level=logging.INFO,

    format="%(asctime)s - %(name)s - %(levelname)s - %(message)s",

    stream=sys.stderr

)

logger = logging.getLogger("sand-martin")

# Initialize FastMCP server

mcp = FastMCP(

    "sand-mart

RemediationAI

The delete_node, update_node, disconnect_nodes, and connect_nodes tools have destructive-sounding names but are not annotated with the destructiveHint flag, allowing the LLM to invoke them silently without user confirmation. Add `destructive_hint=True` to the @mcp.tool decorator for each destructive tool: `@mcp.tool(description='...', destructive_hint=True)`. This signals to MCP clients that these operations require user confirmation before execution. Verify by checking that an MCP client (e.g., Claude Desktop) displays a confirmation prompt before invoking a tool decorated with destructive_hint=True.

LLM consensus

Evidence

Metadata-Version: 2.4

Name: sand-martin

Version: 0.2.1

Summary: An MCP server for generating and managing Grasshopper Python components

Project-URL: Homepage, https://github.com/LeoYuanjieLi/sand-martin

Project-URL: Issues, https://github.com/LeoYuanjieLi/sand-martin/issues

Project-URL: Repository, https://github.com/LeoYuanjieLi/sand-martin

Author-email: Leo Li <pbleoli@gmail.com>

License: Apache-2.0

License-File: LICENSE

Keywords: architecture,automation,grasshopper,llm,mcp,rhino

Classifier: D

RemediationAI

The MCP manifest (PKG-INFO) declares tools but does not specify an authentication mechanism, leaving reviewers unable to audit security controls. Add an explicit authentication field to the package metadata or create a SECURITY.md file documenting the authentication scheme: 'Authentication: Bearer token via SAND_MARTIN_TOKEN environment variable or sand_martin.token file. Per-caller tokens must be passed in MCP request context.' This makes the authentication model auditable. Verify by confirming the authentication mechanism is documented and matches the actual implementation.

Evidence

# <img src="assets/icon.png" width="32" height="32"> Sand Martin

Sand Martin is an MCP (Model Context Protocol) server that enables real-time orchestration of the Grasshopper canvas within Rhino. It allows Large Language Models (like Claude) to create components, inject Python code, and wire nodes together directly in a live Grasshopper session.

## Demo

### 1. Authenticate with the Agent

![Sand Martin Auth](assets/gif1-auth-mcp.gif)

### 2. Update Slider Values

![Update Slider](assets/gif2-up

RemediationAI

The README.md does not declare the authentication mechanism required by the MCP server, preventing users from understanding security requirements. Add an 'Authentication' section to the README: 'This server requires a Bearer token passed via the SAND_MARTIN_TOKEN environment variable or sand_martin.token file. Each MCP client must provide per-caller credentials in the request context.' This ensures users understand the security model before deployment. Verify by reading the README and confirming it clearly documents authentication requirements.

Evidence

- uses: actions/checkout@v4

    - name: Set up Python

      uses: actions/setup-python@v5

      with:

        python-version: "3.10"

RemediationAI

The GitHub Actions workflow uses `actions/checkout@v4` which is a mutable tag that can be rewritten by a compromised maintainer, allowing malicious code injection into the CI pipeline. Pin the action to a specific commit SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1`. Use tools like `pinact` or `ratchet` to automate SHA pinning. This ensures the exact version of the action is used and prevents supply-chain attacks. Verify by confirming the workflow file contains only pinned SHA references and no mutable tags.

Evidence

id-token: write

    steps:

    - uses: actions/checkout@v4

    - name: Set up Python

      uses: actions/setup-python@v5

RemediationAI

The GitHub Actions workflow uses `actions/setup-python@v5` which is a mutable tag that can be rewritten, allowing malicious code injection. Pin to a specific commit SHA: `uses: actions/setup-python@8f312734cc8431c50696c52d10e6fde8b49db3d8 # v5.0.0`. This prevents tag rewriting attacks. Verify by confirming the workflow file contains only pinned SHA references.

Evidence

run: python3 -m build

    - name: Publish distribution 📦 to PyPI

      uses: pypa/gh-action-pypi-publish@release/v1

      with:

        # Note: Trusted Publishing (no password required) must be configured on PyPI first.

        # See: https://docs.pypi.org/trusted-publishers/

RemediationAI

The GitHub Actions workflow uses `pypa/gh-action-pypi-publish@release/v1` which is a mutable branch reference that can be rewritten. Pin to a specific commit SHA: `uses: pypa/gh-action-pypi-publish@e53eb8b47601917af7b433337f2b912456d141898 # release/v1`. This prevents branch rewriting attacks. Verify by confirming all action references use pinned SHAs.

Evidence

import asyncio

import httpx

import json

import logging

import sys

import os

import tempfile

from typing import Optional, Dict, Any

from mcp.server.fastmcp import FastMCP

# Configure logging to stderr (required for MCP servers as stdout is used for communication)

logging.basicConfig(

    level=logging.INFO,

    format="%(asctime)s - %(name)s - %(levelname)s - %(message)s",

    stream=sys.stderr

)

logger = logging.getLogger("sand-martin")

# Initialize FastMCP server

mcp = FastMCP(

    "sand-mart

RemediationAI

The code performs a time-of-check-to-time-of-use (TOCTOU) race by calling `os.path.exists` to check a path, then opening or reading the same path without a lock, allowing an attacker to race a symlink or file replacement between the check and use. Replace the check-then-use pattern with direct error handling: remove the `os.path.exists` call and wrap the file operation in a try-except block catching FileNotFoundError. For example: `try: f = open(path); except FileNotFoundError: handle_error()`. This makes the operation atomic and race-free. Verify by attempting to race a symlink replacement during file access and confirming the operation fails safely or accesses the intended file.

LLM consensus

Evidence

{

                    return GetRhinoNodeDetails(nodeId);

                }

            } catch {

            }

            return Task.FromResult(JsonConvert.SerializeObject(new { status = "error", message = "No active Grasshopper document" }));

        }

RemediationAI

The NodeManager.cs catch block silently swallows exceptions with no logging, preventing incident response and hiding real failures. Replace `catch { }` with `catch (Exception ex) { logger.Error($"Error in GetNodeDetails: {ex.Message}", ex); }` to log the exception with full context. This enables debugging and monitoring. Verify by triggering an error condition and confirming the exception is logged with timestamp and stack trace.

Evidence

{

                    return CreateRhinoConnection(request);

                }

            } catch {

            }

            return Task.FromResult(JsonConvert.SerializeObject(new { status = "error", message = "No active Grasshopper document" }));

        }

RemediationAI

The ConnectionManager.cs catch block silently swallows exceptions with no logging. Replace `catch { }` with `catch (Exception ex) { logger.Error($"Error in CreateConnection: {ex.Message}", ex); }`. This enables visibility into connection failures. Verify by triggering an error and confirming it is logged.

Evidence

{

                    return GetRhinoCanvasState();

                }

            } catch {

            }

            return Task.FromResult(JsonConvert.SerializeObject(new { nodes = new List<NodeInfo>() }));

        }

RemediationAI

The StateManager.cs catch block silently swallows exceptions with no logging. Replace `catch { }` with `catch (Exception ex) { logger.Error($"Error in GetCanvasState: {ex.Message}", ex); }`. This enables debugging of state retrieval failures. Verify by triggering an error and confirming it is logged.

Evidence

{

                    return DisconnectRhinoNode(request);

                }

            } catch {

            }

            return Task.FromResult(JsonConvert.SerializeObject(new { status = "error", message = "No active Grasshopper document" }));

        }

RemediationAI

The ConnectionManager.cs catch block in DisconnectRhinoNode silently swallows exceptions. Replace `catch { }` with `catch (Exception ex) { logger.Error($"Error in DisconnectNode: {ex.Message}", ex); }`. This enables monitoring of disconnection failures. Verify by triggering an error and confirming it is logged.

Evidence

{

                    return DeleteRhinoNode(nodeId);

                }

            } catch {

            }

            return Task.FromResult(JsonConvert.SerializeObject(new { status = "error", message = "No active Grasshopper document" }));

        }

RemediationAI

The NodeManager.cs catch block in DeleteRhinoNode silently swallows exceptions. Replace `catch { }` with `catch (Exception ex) { logger.Error($"Error in DeleteNode: {ex.Message}", ex); }`. This enables auditing of deletion failures. Verify by triggering an error and confirming it is logged.

Evidence

{

                    return UpdateRhinoNode(request);

                }

            } catch {

            }

            return Task.FromResult(JsonConvert.SerializeObject(new { status = "error", message = "No active Grasshopper document" }));

        }

RemediationAI

The NodeManager.cs catch block in UpdateRhinoNode silently swallows exceptions. Replace `catch { }` with `catch (Exception ex) { logger.Error($"Error in UpdateNode: {ex.Message}", ex); }`. This enables visibility into update failures. Verify by triggering an error and confirming it is logged.

Evidence

{

                    return CreateRhinoNode(request);

                }

            } catch {

            }

            return Task.FromResult(JsonConvert.SerializeObject(new { status = "error", message = "No active Grasshopper document" }));

        }

RemediationAI

The NodeManager.cs catch block in CreateRhinoNode silently swallows exceptions. Replace `catch { }` with `catch (Exception ex) { logger.Error($"Error in CreateNode: {ex.Message}", ex); }`. This enables debugging of node creation failures. Verify by triggering an error and confirming it is logged.