infranodus-mcp-server-infranodus

Security Findings (103)

• HighAS-012

  🔄Tool Drift

  Tool set changed silently at v1.6.1: 8 tool(s) added, 0 tool(s) removed without a version bump.

  + 8 added

  add_project_learningsdelete_graphdelete_statementsenable_project_learningsget_project_learningsoptimize_knowledge_basesubmit_workflow_feedbackupdate_statements

  Fix: The set of tools exposed by this server changed between scans of the same version — a sign the package was silently updated without a version bump. Audit the changelog and all tool definitions before trusting this server. Pin to a specific commit hash rather than a floating version tag.

• LowAS-002

  ⚠️Excessive Permissions ×11

  input schema exposes 13 properties (threshold: 10)

  generate_knowledge_graphanalyze_textanalyze_youtube_resultsupdate_statements

  input schema exposes 14 properties (threshold: 10)

  create_knowledge_graphgenerate_ontology_graphgenerate_research_ideas

  input schema exposes 12 properties (threshold: 10)

  generate_research_questions

  input schema exposes 11 properties (threshold: 10)

  develop_text_toolgenerate_seo_reportsubmit_workflow_feedback

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×24

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  generate_knowledge_graphcreate_knowledge_graphanalyze_textgenerate_content_gapsgenerate_topical_clustersgenerate_research_questionsgenerate_research_ideasgenerate_responses_from_graphgenerate_contextual_hintdevelop_conceptual_bridgesdevelop_latent_topicsoptimize_text_structuredevelop_text_toolsearchfetchmerged_graph_from_textsdifference_between_textsanalyze_google_search_resultsanalyze_youtube_resultsanalyze_related_search_queriessearch_queries_vs_search_resultsgenerate_seo_reportdelete_statementsdelete_graph

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-002

  ⚠️Excessive Permissions ×27

  declared capabilities: network access

  generate_knowledge_graphanalyze_textgenerate_content_gapsgenerate_topical_clustersgenerate_research_questionsgenerate_research_ideasgenerate_responses_from_graphgenerate_contextual_hintdevelop_conceptual_bridgesdevelop_latent_topicsoptimize_text_structuredevelop_text_toolsearchfetchmerged_graph_from_textsdifference_between_textsanalyze_google_search_resultsanalyze_related_search_queriessearch_queries_vs_search_resultsgenerate_seo_report

  declared capabilities: network access, filesystem access

  create_knowledge_graphdelete_graph

  declared capabilities: code/command execution

  analyze_youtube_results

  declared capabilities: filesystem access

  optimize_knowledge_baseget_project_learnings

  declared capabilities: network access, filesystem access, database access

  delete_statements

  declared capabilities: filesystem access, database access

  update_statements

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×40

  No metadata.dependencies or repo_url were exposed by this MCP server, and no local project manifest could be inferred from the launch command.

  generate_knowledge_graphcreate_knowledge_graphgenerate_ontology_graphmemory_add_relationsmemory_get_relationsanalyze_existing_graph_by_nameanalyze_textgenerate_content_gapsgenerate_topical_clustersgenerate_research_questionsgenerate_research_ideasgenerate_responses_from_graphgenerate_contextual_hintretrieve_from_knowledge_basedevelop_conceptual_bridgesdevelop_latent_topicsoptimize_text_structureoptimize_reasoningdevelop_text_toollist_graphssearchfetchoverlap_between_textsmerged_graph_from_textsdifference_between_textsanalyze_google_search_resultsanalyze_youtube_resultsanalyze_related_search_queriessearch_queries_vs_search_resultsanalyze_llm_resultsgenerate_seo_reportoptimize_knowledge_baseenable_project_learningsadd_project_learningsget_project_learningssubmit_workflow_feedbackdelete_statementsupdate_statementsdelete_graphget_more_tools

  Fix: Review and remediate the identified issue.