cryptorugmuncher-rugmunch-base

Security Findings (238)

• HighAS-012

  🔄Tool Drift

  Tool set changed silently at vsmithery: 164 tool(s) added, 43 tool(s) removed without a version bump.

  + 164 added

  edubase_delete_class_membersedubase_delete_class_permissionedubase_delete_class_tagedubase_delete_course_permissionedubase_delete_course_tagedubase_delete_event_permissionedubase_delete_event_tagedubase_delete_examedubase_delete_exam_brandingedubase_delete_exam_permissionedubase_delete_exam_tagedubase_delete_exam_usersedubase_delete_filebin_uploadedubase_delete_integrationedubase_delete_integration_permissionedubase_delete_integration_tagedubase_delete_organizationedubase_delete_organization_membersedubase_delete_organization_permissionedubase_delete_organization_tagedubase_delete_organization_webhookedubase_delete_questionedubase_delete_quizedubase_delete_quiz_permissionedubase_delete_quiz_questionsedubase_delete_quiz_tagedubase_delete_scorm_permissionedubase_delete_scorm_tagedubase_delete_tag_permissionedubase_delete_useredubase_delete_user_assumeedubase_delete_user_classesedubase_delete_user_loginedubase_delete_user_organizationsedubase_delete_video_permissionedubase_delete_video_tagedubase_filebinedubase_get_classedubase_get_class_assignmentsedubase_get_class_membersedubase_get_class_permissionedubase_get_class_tagedubase_get_class_tagsedubase_get_classesedubase_get_course_permissionedubase_get_course_tagedubase_get_course_tagsedubase_get_event_permissionedubase_get_event_tagedubase_get_event_tagsedubase_get_examedubase_get_exam_brandingedubase_get_exam_certificates_useredubase_get_exam_permissionedubase_get_exam_results_rawedubase_get_exam_results_useredubase_get_exam_tagedubase_get_exam_tagsedubase_get_exam_usersedubase_get_examsedubase_get_integrationedubase_get_integration_keysedubase_get_integration_permissionedubase_get_integration_tagedubase_get_integration_tagsedubase_get_integrationsedubase_get_organizationedubase_get_organization_membersedubase_get_organization_permissionedubase_get_organization_tagedubase_get_organization_tagsedubase_get_organization_webhookedubase_get_organizationsedubase_get_questionedubase_get_question_idedubase_get_questionsedubase_get_quizedubase_get_quiz_permissionedubase_get_quiz_questionsedubase_get_quiz_results_playedubase_get_quiz_results_useredubase_get_quiz_tagedubase_get_quiz_tagsedubase_get_quizesedubase_get_scorm_permissionedubase_get_scorm_tagedubase_get_scorm_tagsedubase_get_tagedubase_get_tag_permissionedubase_get_tagsedubase_get_useredubase_get_user_classesedubase_get_user_groupedubase_get_user_loginedubase_get_user_meedubase_get_user_nameedubase_get_user_organizationsedubase_get_user_searchedubase_get_usersedubase_get_video_permissionedubase_get_video_tagedubase_get_video_tagsedubase_mcp_server_versionedubase_patch_integrationedubase_patch_organizationedubase_patch_organization_webhookedubase_patch_useredubase_post_class_membersedubase_post_class_permissionedubase_post_class_tagedubase_post_class_transferedubase_post_classes_membersedubase_post_course_permissionedubase_post_course_tagedubase_post_course_transferedubase_post_event_permissionedubase_post_event_tagedubase_post_event_transferedubase_post_examedubase_post_exam_brandingedubase_post_exam_certificates_user_downloadedubase_post_exam_permissionedubase_post_exam_summaryedubase_post_exam_tagedubase_post_exam_transferedubase_post_exam_usersedubase_post_filebin_uploadedubase_post_integrationedubase_post_integration_keysedubase_post_integration_permissionedubase_post_integration_tagedubase_post_integration_transferedubase_post_metrics_customedubase_post_organizationedubase_post_organization_membersedubase_post_organization_permissionedubase_post_organization_tagedubase_post_organization_transferedubase_post_organization_webhookedubase_post_organization_webhook_triggeredubase_post_organizations_membersedubase_post_questionedubase_post_question_exportedubase_post_question_idedubase_post_quizedubase_post_quiz_permissionedubase_post_quiz_questionsedubase_post_quiz_tagedubase_post_quiz_transferedubase_post_scorm_permissionedubase_post_scorm_tagedubase_post_scorm_transferedubase_post_tag_permissionedubase_post_tag_transferedubase_post_useredubase_post_user_assumeedubase_post_user_classesedubase_post_user_groupedubase_post_user_loginedubase_post_user_nameedubase_post_user_organizationsedubase_post_video_permissionedubase_post_video_tagedubase_post_video_transfer

  − 43 removed

  apply_schemabutterbase_docsconfigure_oauth_providerconfigure_realtimecreate_frontend_deploymentcreate_policycreate_user_isolation_policydelete_appdelete_functiondelete_oauth_providerdelete_rls_policydelete_storage_objectdeploy_functiondry_run_schemaenable_rlsgenerate_download_urlgenerate_service_keygenerate_upload_urlget_app_configget_function_logsget_oauth_configget_realtime_configget_rls_policiesget_schemaget_storage_objectsinit_appinsert_rowinvoke_functionlist_appslist_frontend_deploymentslist_functionslist_migrationsquery_audit_logsseed_databaseselect_rowsset_frontend_envstart_frontend_deploymentsubmit_suggestionupdate_corsupdate_function_envupdate_jwt_configupdate_oauth_providerupdate_storage_config

  Fix: The set of tools exposed by this server changed between scans of the same version — a sign the package was silently updated without a version bump. Audit the changelog and all tool definitions before trusting this server. Pin to a specific commit hash rather than a floating version tag.

• HighAS-002

  ⚠️Excessive Permissions ×9

  tool declares network permission

  edubase_filebinedubase_post_question_exportedubase_post_exam_certificates_user_downloadedubase_delete_user_loginedubase_get_user_searchedubase_post_organization_webhook

  tool declares exec permission

  edubase_post_quizedubase_post_organizationedubase_post_integration

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• HighAS-010

  🔑Insecure Secret Handling ×4

  input parameter "must_change_password" appears to accept a secret or credential

  edubase_post_user

  input parameter "password" appears to accept a secret or credential

  edubase_post_useredubase_post_user_assume

  input parameter "token" appears to accept a secret or credential

  edubase_delete_user_assume

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

• MediumAS-002

  ⚠️Excessive Permissions ×40

  tool declares fs permission

  edubase_filebinedubase_post_filebin_uploadedubase_delete_filebin_uploadedubase_post_questionedubase_delete_questionedubase_delete_examedubase_delete_exam_brandingedubase_delete_exam_usersedubase_delete_quizedubase_delete_quiz_questionsedubase_delete_useredubase_post_user_loginedubase_delete_user_loginedubase_delete_user_assumeedubase_delete_class_membersedubase_delete_user_classesedubase_delete_organizationedubase_delete_organization_membersedubase_delete_user_organizationsedubase_delete_organization_webhookedubase_delete_integrationedubase_delete_class_tagedubase_delete_course_tagedubase_delete_event_tagedubase_delete_exam_tagedubase_delete_integration_tagedubase_delete_organization_tagedubase_delete_quiz_tagedubase_delete_scorm_tagedubase_delete_video_tagedubase_delete_class_permissionedubase_delete_course_permissionedubase_delete_event_permissionedubase_delete_exam_permissionedubase_delete_integration_permissionedubase_delete_organization_permissionedubase_delete_quiz_permissionedubase_delete_scorm_permissionedubase_delete_tag_permissionedubase_delete_video_permission

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×12

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  edubase_filebinedubase_post_question_exportedubase_post_exam_certificates_user_downloadedubase_post_quizedubase_delete_user_loginedubase_get_user_searchedubase_post_organizationedubase_get_organization_webhookedubase_patch_organization_webhookedubase_delete_organization_webhookedubase_post_organization_webhook_triggeredubase_post_integration

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×8

  input schema exposes 76 properties (threshold: 10)

  edubase_post_question

  input schema exposes 18 properties (threshold: 10)

  edubase_post_user

  tool declares http permission

  edubase_get_organization_webhookedubase_post_organization_webhookedubase_patch_organization_webhookedubase_delete_organization_webhookedubase_post_organization_webhook_trigger

  input schema exposes 13 properties (threshold: 10)

  edubase_post_organization_webhook

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×164

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  edubase_mcp_server_versionedubase_filebinedubase_post_filebin_uploadedubase_delete_filebin_uploadedubase_get_questionsedubase_get_questionedubase_post_questionedubase_delete_questionedubase_post_question_exportedubase_get_question_idedubase_post_question_idedubase_get_examsedubase_get_examedubase_post_examedubase_delete_examedubase_get_exam_brandingedubase_post_exam_brandingedubase_delete_exam_brandingedubase_get_exam_usersedubase_post_exam_usersedubase_delete_exam_usersedubase_post_exam_summaryedubase_get_quiz_results_playedubase_get_quiz_results_useredubase_get_exam_results_useredubase_get_exam_results_rawedubase_get_exam_certificates_useredubase_post_exam_certificates_user_downloadedubase_get_quizesedubase_get_quizedubase_post_quizedubase_delete_quizedubase_get_quiz_questionsedubase_post_quiz_questionsedubase_delete_quiz_questionsedubase_get_usersedubase_get_user_meedubase_get_useredubase_post_useredubase_patch_useredubase_delete_useredubase_get_user_nameedubase_post_user_nameedubase_get_user_groupedubase_post_user_groupedubase_get_user_loginedubase_post_user_loginedubase_delete_user_loginedubase_get_user_searchedubase_post_user_assumeedubase_delete_user_assumeedubase_get_classesedubase_get_classedubase_get_class_assignmentsedubase_get_class_membersedubase_post_class_membersedubase_delete_class_membersedubase_post_classes_membersedubase_get_user_classesedubase_post_user_classesedubase_delete_user_classesedubase_get_organizationsedubase_get_organizationedubase_post_organizationedubase_patch_organizationedubase_delete_organizationedubase_get_organization_membersedubase_post_organization_membersedubase_delete_organization_membersedubase_post_organizations_membersedubase_get_user_organizationsedubase_post_user_organizationsedubase_delete_user_organizationsedubase_get_organization_webhookedubase_post_organization_webhookedubase_patch_organization_webhookedubase_delete_organization_webhookedubase_post_organization_webhook_triggeredubase_get_integrationsedubase_get_integrationedubase_post_integrationedubase_patch_integrationedubase_delete_integrationedubase_get_integration_keysedubase_post_integration_keysedubase_get_tagsedubase_get_tagedubase_get_class_tagsedubase_get_class_tagedubase_post_class_tagedubase_delete_class_tagedubase_get_course_tagsedubase_get_course_tagedubase_post_course_tagedubase_delete_course_tagedubase_get_event_tagsedubase_get_event_tagedubase_post_event_tagedubase_delete_event_tagedubase_get_exam_tagsedubase_get_exam_tagedubase_post_exam_tagedubase_delete_exam_tagedubase_get_integration_tagsedubase_get_integration_tagedubase_post_integration_tagedubase_delete_integration_tagedubase_get_organization_tagsedubase_get_organization_tagedubase_post_organization_tagedubase_delete_organization_tagedubase_get_quiz_tagsedubase_get_quiz_tagedubase_post_quiz_tagedubase_delete_quiz_tagedubase_get_scorm_tagsedubase_get_scorm_tagedubase_post_scorm_tagedubase_delete_scorm_tagedubase_get_video_tagsedubase_get_video_tagedubase_post_video_tagedubase_delete_video_tagedubase_get_class_permissionedubase_post_class_permissionedubase_delete_class_permissionedubase_post_class_transferedubase_get_course_permissionedubase_post_course_permissionedubase_delete_course_permissionedubase_post_course_transferedubase_get_event_permissionedubase_post_event_permissionedubase_delete_event_permissionedubase_post_event_transferedubase_get_exam_permissionedubase_post_exam_permissionedubase_delete_exam_permissionedubase_post_exam_transferedubase_get_integration_permissionedubase_post_integration_permissionedubase_delete_integration_permissionedubase_post_integration_transferedubase_get_organization_permissionedubase_post_organization_permissionedubase_delete_organization_permissionedubase_post_organization_transferedubase_get_quiz_permissionedubase_post_quiz_permissionedubase_delete_quiz_permissionedubase_post_quiz_transferedubase_get_scorm_permissionedubase_post_scorm_permissionedubase_delete_scorm_permissionedubase_post_scorm_transferedubase_get_tag_permissionedubase_post_tag_permissionedubase_delete_tag_permissionedubase_post_tag_transferedubase_get_video_permissionedubase_post_video_permissionedubase_delete_video_permissionedubase_post_video_transferedubase_post_metrics_custom

  Fix: Review and remediate the identified issue.