pypi · katana-mcp-server0.60.0

Evidence

To listen on all interfaces (for remote access):

```bash

./scripts/start_mcp_server.sh --host 0.0.0.0 --port 8765

```

**Security Note**: Only expose the server on public interfaces if you have proper

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Evidence

python -m katana_mcp

    # Run with streamable-http for Claude.ai co-work or remote clients

    python -m katana_mcp --transport streamable-http --host 0.0.0.0 --port 8765

    # Run with SSE transport for Cursor IDE

    python -m katana_mcp --transport sse --port 8765

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Evidence

# SSE — for Cursor IDE

docker run -p 8765:8765 -e KATANA_API_KEY=your-key katana-mcp-server:latest \

  --transport sse --host 0.0.0.0 --port 8765

```

## Running Locally

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Evidence

# Run the MCP server with configurable transport

ENTRYPOINT ["python", "-m", "katana_mcp"]

CMD ["--transport", "streamable-http", "--host", "0.0.0.0", "--port", "8765"]

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Evidence

cpus: '0.25'

          memory: 256M

    healthcheck:

      test: ["CMD", "python", "-c", "import socket; s=socket.create_connection(('localhost', 8765), 2); s.close()"]

      interval: 30s

      timeout: 5s

      retries: 3

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

"""Request model for searching items."""

    model_config = ConfigDict(extra="forbid")

    query: str = Field(..., description="Search query (name, SKU, etc.)")

    limit: int = Field(default=20, description="Maximum results to return")

    include_archived: bool = Field(

        default=False,

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"""Request model for searching customers."""

    model_config = ConfigDict(extra="forbid")

    query: str = Field(..., description="Search query (name or email)")

    limit: int = Field(default=20, description="Maximum results to return")

    format: Literal["markdown", "json"] = Field(

        default="markdown",

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

from fastmcp.server.auth import StaticTokenVerifier

        return StaticTokenVerifier(

            tokens={token: {"client_id": "katana-mcp", "scopes": ["all"]}},

        )

    return None

Remediation

Replace wildcard scopes with specific named scopes: # BAD SCOPES = ["files:*", "all", "*"] # GOOD SCOPES = [ "files:read", "files:write:owned", "tools:call:safe-readers", ] Issue least privilege at the authorization server, request the minimum at the client, and challenge for elevation only when a privileged operation is attempted.

Evidence

# JSON-stringified array: '[...]' — trust it if it parses to a list.

    if s.startswith("["):

        try:

            parsed = json.loads(s)

        except (json.JSONDecodeError, ValueError):

            pass

        else:

            if isinstance(parsed, list):

                return parsed

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.