github · bifroste351d72a7324

Evidence

}

	} else if insecureMode {

		transport.TLSClientConfig = &tls.Config{

			InsecureSkipVerify: true, // #nosec G402

			MinVersion:         tls.VersionTLS12,

		}

	} else {

Remediation

Drop the verify-disable flag. If the peer presents a private CA: - Python: pass `verify="/path/to/ca.pem"` or trust the system store - Node: `new https.Agent({ ca: fs.readFileSync("ca.pem") })` - Go: load the CA via `x509.NewCertPool().AppendCertsFromPEM(...)` and set `tls.Config.RootCAs` Self-signed certificates: import the cert into the OS trust chain rather than disabling verification per-call.

Evidence

```bash

kubectl create secret generic aws-credentials \

  --from-literal=access-key-id='AKIAIOSFODNN7EXAMPLE' \

  --from-literal=secret-access-key='wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'

```

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

```bash

kubectl create secret generic s3-credentials \

  --from-literal=access-key-id='AKIAIOSFODNN7EXAMPLE' \

  --from-literal=secret-access-key='wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'

```

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

weaviate:

      image: cr.weaviate.io/semitechnologies/weaviate:1.32.4

      command:

          - --host

          - 0.0.0.0

          - --port

          - '8080'

          - --scheme

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Evidence

weaviate:

    image: cr.weaviate.io/semitechnologies/weaviate:1.32.4

    command:

        - --host

        - 0.0.0.0

        - --port

        - '8080'

        - --scheme

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Evidence

temp_file_path = f.name

# Step 2: Upload batch input file

print("Step 2: Uploading batch input file...")

uploaded_file = client.files.upload(

    file=temp_file_path,

    config=UploadFileConfig(display_name='batch_e2e_gemini')

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

jsonl_content = create_batch_jsonl(num_requests=3)

# Step 2: Upload input file to S3

print("Step 2: Uploading input file to S3...")

timestamp = int(time.time())

s3_key = f"bifrost-batch-input/batch_{timestamp}.jsonl"

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

{"custom_id": "req-2", "method": "POST", "url": "/v1/chat/completions", "body": {"model": "anthropic.claude-3-sonnet-20240229-v1:0", "messages": [{"role": "user", "content": "What is the capital of France?"}], "max_tokens": 100}}'''

# Step 2: Upload file

print("Step 1: Uploading batch input file...")

uploaded_file = client.files.create(

    file=("batch_e2e.jsonl", jsonl_content.encode(), "application/jsonl"),

    purpose="batch",

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

bedrock_client.meta.events.register("before-send", add_provider_header)

# Step 1: Create OpenAI JSONL content

print("Step 1: Creating OpenAI batch input file...")

def create_openai_jsonl(num_requests: int) -> str:

    lines = []

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

)

# Step 1: Create batch input file

print("Step 1: Creating batch input file...")

def create_gemini_batch_json(num_requests: int) -> str:

    requests_list = []

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

{"custom_id": "req-2", "method": "POST", "url": "/v1/chat/completions", "body": {"model": "gpt-4o-mini", "messages": [{"role": "user", "content": "What is the capital of France?"}], "max_tokens": 100}}'''

# Step 2: Upload file (uses OpenAI's native file storage)

print("Step 1: Uploading batch input file...")

uploaded_file = client.files.create(

    file=("batch_e2e.jsonl", jsonl_content.encode(), "application/jsonl"),

    purpose="batch",

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

args = parser.parse_args()

    base_path = Path(__file__).parent.resolve()

    print(f"Bundling OpenAPI spec from: {base_path / args.input}")

    try:

        bundler = OpenAPIBundler(base_path)

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

bedrock_client.meta.events.register("before-send", add_provider_header)

# Step 1: Create JSONL content

print("Step 1: Creating batch input file...")

def create_batch_jsonl(num_requests: int) -> str:

    lines = []

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

{"custom_id": "req-2", "method": "POST", "url": "/v1/chat/completions", "body": {"model": "gemini-1.5-flash", "messages": [{"role": "user", "content": "What is the capital of France?"}], "max_tokens": 100}}'''

# Step 2: Upload file (uses Gemini's native file storage)

print("Step 1: Uploading batch input file...")

uploaded_file = client.files.create(

    file=("batch_e2e.jsonl", jsonl_content.encode(), "application/jsonl"),

    purpose="batch",

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

jsonl_content = create_gemini_jsonl(num_requests=3)

# Step 2: Upload input file (bucket/key are routing identifiers)

print("Step 2: Uploading input file...")

timestamp = int(time.time())

upload_response = s3_client.put_object(

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

bedrock_client.meta.events.register("before-send", add_provider_header)

# Step 1: Create Gemini JSONL content

print("Step 1: Creating Gemini batch input file...")

def create_gemini_jsonl(num_requests: int) -> str:

    lines = []

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

jsonl_content = create_openai_jsonl(num_requests=3)

# Step 2: Upload input file (bucket/key are routing identifiers)

print("Step 2: Uploading input file...")

timestamp = int(time.time())

upload_response = s3_client.put_object(

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Remediation

Typosquat: verify you meant the popular package. If so, correct the spelling; if you truly intended the less-common name, suppress with an inline waiver. Stale release: check whether the package has a maintained fork or successor. If no patched release exists, vendor the code or migrate to an active alternative before the unmaintained code accrues unfixed CVEs.

Remediation

Typosquat: verify you meant the popular package. If so, correct the spelling; if you truly intended the less-common name, suppress with an inline waiver. Stale release: check whether the package has a maintained fork or successor. If no patched release exists, vendor the code or migrate to an active alternative before the unmaintained code accrues unfixed CVEs.

Remediation

Typosquat: verify you meant the popular package. If so, correct the spelling; if you truly intended the less-common name, suppress with an inline waiver. Stale release: check whether the package has a maintained fork or successor. If no patched release exists, vendor the code or migrate to an active alternative before the unmaintained code accrues unfixed CVEs.

Remediation

Typosquat: verify you meant the popular package. If so, correct the spelling; if you truly intended the less-common name, suppress with an inline waiver. Stale release: check whether the package has a maintained fork or successor. If no patched release exists, vendor the code or migrate to an active alternative before the unmaintained code accrues unfixed CVEs.

Evidence

// Check if a specific version exists on the download server

async function checkVersionExists(version, platformDir, archDir, binaryName) {

	const url = `${BASE_URL}/bifrost/${version}/${platformDir}/${archDir}/${binaryName}`;

	const res = await fetch(url, { method: "HEAD" });

	return res.ok;

}

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

}

async function downloadBinary(url, dest) {

	const res = await fetch(url);

	if (!res.ok) {

		console.error(`❌ Download failed: ${res.status} ${res.statusText}`);

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

if (!root) return

      try {

        const response = await fetch('https://getbifrost.ai/datasheet')

        if (!response.ok) {

          throw new Error('Failed to fetch models')

        }

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

}

		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)

		defer cancel()

		models, err := fetch(ctx, baseURL, vk)

		return modelsMsg{models: models, err: err}

	}

}

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

// Check if a specific version exists on the download server

async function checkVersionExists(version, platformDir, archDir, binaryName) {

	const url = `${BASE_URL}/bifrost-cli/${version}/${platformDir}/${archDir}/${binaryName}`;

	const res = await fetch(url, { method: "HEAD" });

	return res.ok;

}

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

// Verify the downloaded binary against its SHA-256 checksum

async function verifyChecksum(binaryPath, checksumUrl) {

	const res = await fetch(checksumUrl);

	if (!res.ok) {

		console.warn(`⚠️ Checksum file not available (${res.status}), skipping verification`);

		return;

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

}

		const { api_key_id: _, ...requestParams } = config.modelParams;

		const response = await fetch(`${getBaseUrl()}/v1/chat/completions`, {

			method: "POST",

			headers,

			body: JSON.stringify({

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

useEffect(() => {

    async function fetchModels () {

      try {

        const response = await fetch('https://getbifrost.ai/datasheet')

        if (!response.ok) {

          throw new Error(`Failed to fetch models: ${response.status}`)

        }

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

// gets the latest version number for transport

async function getLatestVersion() {

	const releaseUrl = "https://getbifrost.ai/latest-release";

	const res = await fetch(releaseUrl);

	if (!res.ok) {

		return null;

	}

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

async function downloadBinary(url, dest) {

	// console.log(`🔄 Downloading binary from ${url}...`);

	const res = await fetch(url);

	if (!res.ok) {

		console.error(`❌ Download failed: ${res.status} ${res.statusText}`);

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

// Obtain a short-lived, single-use ticket for WS auth instead of putting the session token in the URL.

			let wsUrlWithAuth = wsUrl;

			try {

				const resp = await fetch(`${getApiBaseUrl()}/session/ws-ticket`, {

					method: "POST",

					credentials: "include",

				});

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

"Version": "2012-10-17",

  "Statement": [

    {

      "Effect": "Allow",

      "Action": [

        "ecr:GetAuthorizationToken",

        "ecr:BatchCheckLayerAvailability",

        "ecr:GetDownloadUrlForLayer",

        "ecr:BatchGetImage"

      ],

      "Resource": "*"

    },

    {

      "Effect": "Allow",

Remediation

File modes: use 0600 for secrets, 0644 for read-only data, 0755 for directories. IAM: scope Action to the specific service+verb (s3:GetObject) and Resource to exact ARNs. Never use * for both.

Evidence

"Version": "2012-10-17",

  "Statement": [

    {

      "Effect": "Allow",

      "Action": [

        "ecr:GetAuthorizationToken",

        "ecr:BatchCheckLayerAvailability",

        "ecr:GetDownloadUrlForLayer",

        "ecr:BatchGetImage"

      ],

      "Resource": "*"

    },

    {

      "Effect": "Allow",

Remediation

File modes: use 0600 for secrets, 0644 for read-only data, 0755 for directories. IAM: scope Action to the specific service+verb (s3:GetObject) and Resource to exact ARNs. Never use * for both.

Evidence

"Statement": [

    {

      "Sid": "ECRAuth",

      "Effect": "Allow",

      "Action": [

        "ecr:GetAuthorizationToken"

      ],

      "Resource": "*"

    },

    {

      "Sid": "ECRPullFromBifrost",

Remediation

File modes: use 0600 for secrets, 0644 for read-only data, 0755 for directories. IAM: scope Action to the specific service+verb (s3:GetObject) and Resource to exact ARNs. Never use * for both.

Evidence

"Resource": "arn:aws:ecr:us-east-1:BIFROST_ACCOUNT_ID:repository/YOUR_HUB_SLUG"

    },

    {

      "Effect": "Allow",

      "Action": [

        "logs:CreateLogStream",

        "logs:PutLogEvents"

      ],

      "Resource": "*"

    }

  ]

}

Remediation

File modes: use 0600 for secrets, 0644 for read-only data, 0755 for directories. IAM: scope Action to the specific service+verb (s3:GetObject) and Resource to exact ARNs. Never use * for both.

Evidence

"Version": "2012-10-17",

  "Statement": [

    {

      "Effect": "Allow",

      "Action": [

        "ecr:GetAuthorizationToken"

      ],

      "Resource": "*"

    },

    {

      "Effect": "Allow",

Remediation

File modes: use 0600 for secrets, 0644 for read-only data, 0755 for directories. IAM: scope Action to the specific service+verb (s3:GetObject) and Resource to exact ARNs. Never use * for both.

Evidence

"vllm_key_config": {

          "type": "object",

          "properties": {

            "url": {

              "type": "string",

              "description": "VLLM server base URL (can use env. prefix)"

            },

            "model_name": {

              "type": "string",

              "description": "Exact model name served on this VLLM instance"

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"then": {

                "type": "object",

                "properties": {

                  "path": {

                    "type": "string",

                    "description": "Database file path"

                  }

                },

                "required": ["path"],

                "additionalProperties": false

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

});

const ReadFileSchema = z.object({

  path: z.string().describe("The file path to read"),

});

const DelaySchema = z.object({

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"stdioConfig": {

          "type": "object",

          "properties": {

            "command": {

              "type": "string"

            },

            "args": {

              "type": "array",

              "items": {

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"enabled": {

                    "type": "boolean"

                  },

                  "path": {

                    "type": "string"

                  },

                  "version": {

                    "type": "integer",

                    "minimum": 1

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

},

              "then": {

                "properties": {

                  "path": {

                    "type": "string",

                    "description": "Database file path"

                  }

                },

                "required": ["path"],

                "additionalProperties": false

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"stdio_config": {

          "type": "object",

          "properties": {

            "command": {

              "type": "string",

              "description": "Command to execute"

            },

            "args": {

              "type": "array",

              "items": {

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

const ProxyConfigSchema = z

	.object({

		type: ProxyTypeSchema,

		url: z.string().optional(),

		username: z.string().optional(),

		password: z.string().optional(),

	})

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"vllm_key_config": {

                "type": "object",

                "properties": {

                  "url": {

                    "type": "string",

                    "description": "VLLM server base URL (can use env. prefix)"

                  },

                  "model_name": {

                    "type": "string",

                    "description": "Exact model name served on this VLLM instance"

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"httpConfig": {

          "type": "object",

          "properties": {

            "url": {

              "type": "string",

              "format": "uri"

            }

          },

          "required": ["url"]

        },

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"items": {

                  "type": "object",

                  "properties": {

                    "path": {

                      "type": "string"

                    },

                    "pathType": {

                      "type": "string",

                      "enum": ["Prefix", "Exact", "ImplementationSpecific"]

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

});

const SearchSchema = z.object({

  query: z.string().describe("The search query"),

});

const GetTimeSchema = z.object({

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

const pluginFormSchema = z.object({

	name: z.string().min(1, "Name is required"),

	enabled: z.boolean(),

	path: z.string().optional(),

	config: z.string().optional(),

	hasConfig: z.boolean(),

});

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"sgl_key_config": {

              "type": "object",

              "properties": {

                "url": {

                  "type": "string",

                  "minLength": 1,

                  "description": "SGLang server base URL (can use env. prefix)"

                }

              },

              "required": ["url"],

              "additionalProperties": false

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"type": "object",

            "description": "Configuration for the plugin"

          },

          "path": {

            "type": "string",

            "description": "Path to the plugin (optional, required for dynamic plugins)",

            "optional": true

          },

          "version": {

            "type": "integer",

            "minimum": 1,

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"websocketConfig": {

          "type": "object",

          "properties": {

            "url": {

              "type": "string",

              "format": "uri"

            }

          },

          "required": ["url"]

        },

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

.object({

    enabled: z.boolean(),

    type: globalProxyTypeSchema,

    url: z.string(),

    username: z.string().optional(),

    password: z.string().optional(),

    ca_cert_pem: z.string().optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"ollama_key_config": {

              "type": "object",

              "properties": {

                "url": {

                  "type": "string",

                  "minLength": 1,

                  "description": "Ollama server base URL (can use env. prefix)"

                }

              },

              "required": ["url"],

              "additionalProperties": false

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"vllm_key_config": {

              "type": "object",

              "properties": {

                "url": {

                  "type": "string",

                  "minLength": 1,

                  "description": "VLLM server base URL (can use env. prefix)"

                },

                "model_name": {

                  "type": "string",

                  "minLength": 1,

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

},

  "scripts": {

    "build": "tsc && chmod +x dist/index.js",

    "prepare": "npm run build"

  },

  "dependencies": {

    "@modelcontextprotocol/sdk": "^1.0.4",

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

},

  "scripts": {

    "build": "tsc && chmod +x dist/index.js",

    "prepare": "npm run build"

  },

  "dependencies": {

    "@modelcontextprotocol/sdk": "^1.0.4",

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

},

  "scripts": {

    "build": "tsc && chmod +x dist/index.js",

    "prepare": "npm run build"

  },

  "dependencies": {

    "@modelcontextprotocol/sdk": "^1.0.4",

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

},

  "scripts": {

    "build": "tsc && chmod +x dist/index.js",

    "prepare": "npm run build"

  },

  "dependencies": {

    "@modelcontextprotocol/sdk": "^1.0.4",

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

}),

						);

					}

				} catch {}

			},

		}),

	}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

async onQueryStarted(arg, { queryFulfilled }) {

				try {

					await queryFulfilled;

				} catch {

				} finally {

					clearAuthStorage();

				}

			},

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

onBlur={() => {

					try {

						setCurrentValue(JSON.stringify(JSON.parse(currentValue), null, 2));

					} catch {}

				}}

				lang="json"

				wrap={true}

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

setCurrentValue(v);

					try {

						props.onChange(JSON.parse(v));

					} catch {}

				}}

				onBlur={() => {

					try {

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

}

						}),

					);

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

}),

						);

					}

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

}

						}),

					);

				} catch {}

			},

		}),

	}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

);

					}

					dispatch(routingRulesApi.util.updateQueryData("getRoutingRule", updatedRule.id, () => updatedRule));

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

}

						}),

					);

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

await verifyChecksum(tempBinaryPath, checksumUrl);

		renameSync(tempBinaryPath, binaryPath);

	} catch (err) {

		try { unlinkSync(tempBinaryPath); } catch {}

		throw err;

	}

	console.log(`✅ Installed bifrost to ${binaryPath}`);

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

dispatch(mcpApi.util.invalidateTags(["MCPClients"]));

						break;

					}

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

}),

						);

					}

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

);

					}

					dispatch(routingRulesApi.util.updateQueryData("getRoutingRule", newRule.id, () => newRule));

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

}),

					);

					dispatch(providersApi.util.updateQueryData("getProvider", arg.name, () => updatedProvider));

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

);

					// Also update the individual plugin cache

					dispatch(pluginsApi.util.updateQueryData("getPlugin", newPlugin.name, () => newPlugin));

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

draft.sort(sortProviders);

						}),

					);

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

dispatch(

						providersApi.util.updateQueryData("getAllKeys", undefined, (draft) => draft.filter((key) => key.provider !== providerName)),

					);

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

if (log.params?.tools) {

    try {

      toolsParameter = JSON.stringify(log.params.tools, null, 2);

    } catch { }

  }

  const audioFormat =

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

}

						}),

					);

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

);

					// Also update the individual plugin cache

					dispatch(pluginsApi.util.updateQueryData("getPlugin", arg.name, () => updatedPlugin));

				} catch {}

			},

		}),

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {

        return Object.values(parsed).reduce<number>((sum, v) => sum + (Array.isArray(v) ? v.length : 0), 0);

      }

    } catch { }

    return 0;

  })();

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

} else if (typeof parsedValue === "string") {

					valueToUse = parsedValue;

				}

			} catch(error) {}

		}

		// For single operators (=, !=), use single select

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.