T08 · Insecure Dependencies
- Location
server.json:6- Finding
Unverifiable Mutable Third-Party MCP Service Dependency
- Content
View full analysis
Vulnerability Details
File Location:
server.json:6-10; duplicated inSKILL.md:12-15andSKILL.md:25-30
Vulnerability Type: Unverified third-party service dependency
Risk Level: Mediumjson "remotes": [ { "type": "streamable-http", "url": "https://cruise-mcp.olavacations.com/api/gw/mcp/c3c56c15-63d5-472c-907b-cddb5d809871" } ]Technical Analysis
The package contains no local MCP server implementation and delegates its functionality to a remotely managed service on
olavacations.com. The remote implementation is not included, version-pinned, or accompanied by an auditable tool manifest, permission policy, authentication policy, or data-handling disclosure.Although HTTPS protects data in transit, it does not establish the integrity or long-term immutability of the remote implementation. The service operator, or an attacker who compromises the service, could alter its capabilities and responses after this package has been reviewed. The local package therefore cannot provide assurance that the behavior observed during an audit will remain unchanged.
No evidence was found that the remote endpoint downloads or executes code locally. Accordingly, this finding is classified as an insecure external dependency rather than confirmed remote code execution.
Attack Path
- A user installs or enables the skill.
- The MCP client connects to the configured third-party endpoint.
- User requests and potentially user-supplied travel or corporate-group information are transmitted to the service as part of ordinary MCP usage.
- If the service is compromised or its implementation is changed, it may process the submitted information contrary to user expectations or return malicious, misleading, or unsafe MCP responses.
- The agent may rely on those responses unless the client independently constrains and validates the remote service's capabilities and output.
Impact Assessment
...[truncated 568 chars]
- Remediation
View remediation
Remediation Suggestions
- Publish the MCP server source or provide a reproducible, version-pinned implementation that can be independently audited.
- Publish and pin an explicit tool manifest defining every permitted tool, argument schema, and capability.
- Enforce a client-side allowlist so newly introduced remote tools cannot become available automatically.
- Require explicit user consent before transmitting personal, corporate, itinerary, or booking-related information.
- Document the endpoint operator, authentication requirements, data categories transmitted, retention period, subprocessors, and deletion procedure.
- Validate remote responses against strict schemas and treat returned instructions and content as untrusted data.
- Apply least-privilege controls so the remote service cannot trigger local command execution, unrestricted file access, credential access, or unrelated network operations.
- Add endpoint monitoring, certificate validation, security logging, and a revocation mechanism that can disable the integration if the service is compromised.