T08 · Insecure Dependencies
Warning
- Location
- INTEGRATION.md:3
- Finding
- Unauthenticated Mutable Remote MCP Dependency Without Integrity Pinning## Vulnerability Details **File Location**: `INTEGRATION.md:3-30` **Additional Locations**: `SKILL.md:8-9, 52-58`; `DEMO.md:8-12, 18-25, 40-48` **Vulnerability Type**: Remote supply-chain trust and unverified service dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown MONARK is one public MCP endpoint exposing the four tools `{attest, gate, cascade, calibrate}`: - `https://mcp.monarkgate.tech/mcp` (mirror `https://api.monarkgate.tech/mcp`) Transport is Streamable HTTP. The endpoint is public and unauthenticated, with no availability commitment; treat it as a reference implementation of the coverage-gate contract, not a hosted service with an uptime promise. ## One-line install ### Hermes / claw-agent ``` hermes mcp add monark --url https://mcp.monarkgate.tech/mcp ``` `hermes mcp add` takes **no `--transport` flag**: a server added with `--url` defaults to Streamable HTTP, and the YAML `transport:` key is set separately (by editing the config or via `hermes mcp configure`). To scope which tools are exposed, use `hermes mcp configure monark` (or the config keys `tools.include` / `tools.exclude`). Confirm the server is reachable with `hermes mcp test monark`. ### OpenClaw ``` openclaw mcp add monark --url https://mcp.monarkgate.tech/mcp --transport streamable-http ``` Here `--transport streamable-http` is an explicit flag. Scope the exposed tools at add time with `--include` (for example `--include 'gate,calibrate'`) or `--exclude`. ``` The Skill also instructs callers to send calibration data and predictions to the service: ```markdown Endpoint: `https://mcp.monarkgate.tech/mcp` (mirror `https://api.monarkgate.tech/mcp`). Every call is stateless — MONARK stores nothing between the two calls; you carry q̂ and B_t in and out. Request (`POST /calibrate`): ```json { "scores": [0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0], "alpha": 0.1, "nMin": 5 } ``` `` ...[truncated 3088 chars]
- Remediation
- ## Remediation Suggestions 1. Provide an auditable local implementation or publish a versioned server artifact whose source corresponds to a fixed release. 2. Sign release artifacts and publish cryptographic digests, provenance attestations, and verification instructions. 3. Pin clients to a reviewed protocol and implementation version rather than relying only on a mutable hostname. 4. Document explicitly that predictions, calibration arrays, and request metadata leave the local environment and must not contain secrets, personal data, proprietary model outputs, or other sensitive information unless separately approved. 5. Recommend strict tool allow-listing, such as exposing only `gate` and `calibrate` when the other tools are unnecessary. 6. Treat all returned verdicts and tool metadata as untrusted input. Validate response schemas, enforce size and timeout limits, reject unexpected fields, and fail closed when verification fails. 7. Ensure downstream applications do not interpret `allow` or `commit` as authorization to execute a tool. Apply independent authorization, policy checks, and human approval to consequential actions. 8. Add endpoint monitoring and a documented revocation procedure so operators can disable the integration promptly following service compromise or unexpected behavior changes.