github · mcp-serverHEAD

Evidence

import os

import argparse

import logging

import json

import volcenginesdkcore 

import volcenginesdkdts

import volcenginesdkdts20180101 

from typing import Optional, Final, Any, List

from pydantic import Field

from mcp_server_dts.config import load_config

from mcp.server.fastmcp import FastMCP

from mcp_server_dts import model

openapi_cli = None

openapi_20180101_cli = None

# Configure logging

logging.basicConfig(

    level=logging.INFO,

    format="%(asctime)s - %(name)s - %(levelname)s - %(mess

Remediation

Missing annotation: add `{ annotations: { destructiveHint: true } }` as the 4th argument to `server.tool(...)` (TS) or pass `destructive_hint=True` to the `@mcp.tool(...)` decorator (Python). readOnly-lying: remove the `readOnlyHint: true` / `read_only_hint=True` assertion, or refactor the handler so it no longer calls the destructive sink. Do not suppress with a waiver — clients rely on these hints for user-facing confirmation.

Evidence

import argparse

import base64

import json

import logging

import os

from typing import Optional

import volcenginesdkcore

from dotenv import load_dotenv

from mcp.server.fastmcp import Context, FastMCP

from mcp.server.fastmcp.resources import HttpResource

from mcp.server.session import ServerSession

from starlette.requests import Request

import mcp_server_vmp.config as config

import mcp_server_vmp.vmpapi as vmpapi

# Configure logging

logging.basicConfig(

    level=logging.INFO, format="%(asctime

Remediation

Missing annotation: add `{ annotations: { destructiveHint: true } }` as the 4th argument to `server.tool(...)` (TS) or pass `destructive_hint=True` to the `@mcp.tool(...)` decorator (Python). readOnly-lying: remove the `readOnlyHint: true` / `read_only_hint=True` assertion, or refactor the handler so it no longer calls the destructive sink. Do not suppress with a waiver — clients rely on these hints for user-facing confirmation.

Evidence

# Copyright (c) Amazon.com, Inc. or its affiliates.

# Copyright (c) 2025 ByteDance Ltd. and/or its affiliates.

# SPDX-License-Identifier: Apache-2.0

#

# This file has been modified by ByteDance Ltd. and/or its affiliates on 2025-10-30.

#

# Original file was released under the Apache License, Version 2.0.

# The full license text is available at:

#     http://www.apache.org/licenses/LICENSE-2.0

#

# This modified file is released under the same license.

"""VolcengineLabs Cloud Control API MCP Serv

Remediation

Missing annotation: add `{ annotations: { destructiveHint: true } }` as the 4th argument to `server.tool(...)` (TS) or pass `destructive_hint=True` to the `@mcp.tool(...)` decorator (Python). readOnly-lying: remove the `readOnlyHint: true` / `read_only_hint=True` assertion, or refactor the handler so it no longer calls the destructive sink. Do not suppress with a waiver — clients rely on these hints for user-facing confirmation.

Evidence

from mcp.server.fastmcp import FastMCP

from .api.api import ImagexAPI

import uuid

import json

def Error(message: str):

    return "API Error: " + message

def HandlerVolcResponse(response: dict):

    if (

        response

        and hasattr(response, "ResponseMetadata")

        and response.ResponseMetadata

        and hasattr(response.ResponseMetadata, "Error")

        and response.ResponseMetadata.Error

    ):

        return Error(response.ResponseMetadata.Error.Message)

    return str(res

Remediation

Missing annotation: add `{ annotations: { destructiveHint: true } }` as the 4th argument to `server.tool(...)` (TS) or pass `destructive_hint=True` to the `@mcp.tool(...)` decorator (Python). readOnly-lying: remove the `readOnlyHint: true` / `read_only_hint=True` assertion, or refactor the handler so it no longer calls the destructive sink. Do not suppress with a waiver — clients rely on these hints for user-facing confirmation.

Evidence

TRANSPORT_TYPE=streamable-http

COPY . .

RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

    && uv sync

EXPOSE 8000

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

],

        }

        response = requests.post(url, headers=headers, json=data, verify=False)

        logger.info(f"response: {response}")

        response.raise_for_status()

        response_json = response.json() if response.content else None

        logger.info(f"response_json: {response_json}")

        results_dict = response_json.get('results')[0].get('content').get('results').get('organic')

        logger.info(f"results_dict: {results_dict}")

Remediation

Drop the verify-disable flag. If the peer presents a private CA: - Python: pass `verify="/path/to/ca.pem"` or trust the system store - Node: `new https.Agent({ ca: fs.readFileSync("ca.pem") })` - Go: load the CA via `x509.NewCertPool().AppendCertsFromPEM(...)` and set `tls.Config.RootCAs` Self-signed certificates: import the cert into the OS trust chain rather than disabling verification per-call.

Evidence

# VolcEngine config example

VOLCENGINE_ACCESS_KEY=VOLCENGINE_ACCESS_KEY

VOLCENGINE_SECRET_KEY=VOLCENGINE_SECRET_KEY

VOLCENGINE_REGION=cn-beijing

VOLCENGINE_ENDPOINT=vpc.cn-beijing.volcengineapi.com

Remediation

Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Evidence

keys = list(cloud_resource.keys())

                        if keys:

                            first_key = keys[0]

                            target_function_id = cloud_resource.get(first_key, {}).get("function_id")

                    except json.JSONDecodeError:

                        pass

                # Fallback: try to get from Config

                if not target_function_id:

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

try:

                    app_detail = client.get_application(target_application_id)

                    cloud_resource = app_detail.get("Result", {}).get("CloudResource", "")

                    access_url = extract_access_url_from_cloud_resource(cloud_resource)

                except:

                    pass

            log("  → Deployment completed!")

        else:

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

data = cloud_resource[keys[0]]

                    url_obj = data.get('url', {})

                    # Prefer system_url, fallback to inner_url

                    access_url = url_obj.get('system_url') or url_obj.get('inner_url')

        except:

            pass

        # Build base response

        app_detail = {

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

}

      }

    }

  } catch {}

  return defaultOptions;

}

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

if isinstance(kwargs['CreateTime'], int):

                try:

                    from datetime import datetime

                    kwargs['CreateTime'] = datetime.fromtimestamp(kwargs['CreateTime']).strftime("%Y-%m-%d %H:%M:%S")

                except:

                    pass

            if not isinstance(kwargs['CreateTime'], str):

                kwargs['CreateTime'] = str(kwargs['CreateTime'])

        if 'UpdateTime' in kwargs:

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.