Skip to content

Commit be6c2d9

Browse files
authored
Add security warnings to Argument schema definition (#371)
## Summary - Add comprehensive security warnings to the `Argument` type in server.schema.json - Warn about command injection risks from user-provided input in arguments - Include concrete example of malicious payload (`;rm -rf ~/Development`) - Recommend non-shell execution methods and user consent for safer command execution Fixes #41
1 parent 576b759 commit be6c2d9

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

docs/reference/server-json/server.schema.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,7 @@
330330
]
331331
},
332332
"Argument": {
333+
"description": "Warning: Arguments construct command-line parameters that may contain user-provided input. This creates potential command injection risks if clients execute commands in a shell environment. For example, a malicious argument value like ';rm -rf ~/Development' could execute dangerous commands. Clients should prefer non-shell execution methods (e.g., posix_spawn) when possible to eliminate injection risks entirely. Where not possible, clients should obtain consent from users or agents to run the resolved command before execution.",
333334
"anyOf": [
334335
{
335336
"$ref": "#/$defs/PositionalArgument"

0 commit comments

Comments
 (0)