Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Added - **MCP server** — MCP-compatible agents (Claude, GPT, and others) can now connect directly at `https://mcp.clawpost.net/mcp` via OAuth 2.0. No API key required; the agent authorises once through the Claw Post OAuth flow and receives scoped access tokens. Supported tools: `list_platforms`, `create_post`, `get_upload_url`, `get_post_status`, `get_account_status`. - **`get_upload_url` MCP tool** — agents call this tool to get a signed PUT URL for direct-to-storage file uploads. `contentType` is optional and inferred automatically from the filename extension. The response includes `putHeaders` that agents must use verbatim for the PUT request (the signed URL rejects requests with wrong headers). Validates the file type against the target platform before uploading. - **`postUrl` reliably returned on success** — `GET /v1/jobs/:id` and the MCP `get_post_status` tool now return `postUrl` containing the live URL of the published post once the job succeeds. Previously this was logged and discarded; it is now persisted on the job record. - **`get_account_status` MCP tool** — agents can check if the user has a paired extension before attempting to post, and surface a pairing URL if not.