plane-mcp-server

Security Findings (161)

• CriticalAS-006

  💻Arbitrary Code Execution

  heuristic signal

  workload_exec:tool name or description implies arbitrary script/code execution (evaluate_script, execute javascript, etc.)

  Fix: This tool can execute arbitrary code or shell commands on the host system. Remove it unless strictly required. If kept: (1) restrict access to trusted users/agents only, (2) require human approval before each invocation (Claude Desktop: set approval_required: true; other clients: enable equivalent confirmation), (3) use the most restrictive sandbox or read-only mode available, and (4) never expose this tool to untrusted input sources.

• HighAS-012

  🔄Tool Drift

  Tool set changed silently at v2.5.0-phoenix-b5ad5360: 58 tool(s) added, 8 tool(s) removed without a version bump.

  + 58 added

  add_domain_portadd_domain_routebrowse_templatesclear_domain_tlsconvert_to_terraformcreate_domaincreate_gvccreate_identitycreate_policycreate_secret_dictionarycreate_secret_dockercreate_secret_ecrcreate_secret_opaquecreate_secret_tlscreate_volumesetcreate_workloaddelete_resourceexpand_volumesetexport_terraformget_cpln_rulesget_cpln_skillget_installed_templateget_permissionsget_resourceget_resource_schemaget_templateget_workload_eventsget_workload_logsinstall_templatelist_deploymentslist_installed_templateslist_metricslist_resourceslist_workload_replicasmount_volumeset_to_workloadquery_audit_eventsquery_metricsremove_domain_portremove_domain_routereveal_secretsearch_control_planeset_domain_tlsuninstall_templateupdate_domainupdate_domain_routeupdate_gvcupdate_identityupdate_policyupdate_secret_dictionaryupdate_secret_dockerupdate_secret_ecrupdate_secret_opaqueupdate_secret_tlsupdate_volumesetupdate_workloadupgrade_templateworkload_execworkload_reveal_secret

  − 8 removed

  thinkneo_check_policythinkneo_check_spendthinkneo_evaluate_guardrailthinkneo_get_budget_statusthinkneo_get_compliance_statusthinkneo_list_alertsthinkneo_provider_statusthinkneo_schedule_demo

  Fix: The set of tools exposed by this server changed between scans of the same version — a sign the package was silently updated without a version bump. Audit the changelog and all tool definitions before trusting this server. Pin to a specific commit hash rather than a floating version tag.

• HighAS-003

  🔀Scope Mismatch ×3

  tool name "get_workload_logs" implies read-only operation but declares exec permission

  get_workload_logs

  tool name "list_deployments" implies read-only operation but declares exec permission

  list_deployments

  tool name "list_workload_replicas" implies read-only operation but declares exec permission

  list_workload_replicas

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×32

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  clear_domain_tlscreate_domaincreate_gvccreate_identitycreate_policycreate_secret_dictionarycreate_secret_dockercreate_secret_ecrcreate_secret_opaquecreate_secret_tlscreate_volumesetget_permissionsget_resourceget_resource_schemaget_workload_eventsget_workload_logslist_deploymentslist_workload_replicasmount_volumeset_to_workloadquery_audit_eventsquery_metricssearch_control_planeupdate_domainupdate_gvcupdate_identityupdate_policyupdate_secret_dictionaryupdate_secret_dockerupdate_secret_ecrupdate_secret_opaqueupdate_secret_tlsupdate_volumeset

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×14

  input schema exposes 11 properties (threshold: 10)

  create_domainmount_volumeset_to_workloadquery_audit_eventsupdate_domainupdate_policy

  input schema exposes 15 properties (threshold: 10)

  create_gvcupdate_identity

  input schema exposes 13 properties (threshold: 10)

  create_identitycreate_policy

  input schema exposes 12 properties (threshold: 10)

  create_volumesetget_workload_logs

  input schema exposes 21 properties (threshold: 10)

  create_workloadupdate_workload

  input schema exposes 17 properties (threshold: 10)

  update_gvc

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×58

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  add_domain_portadd_domain_routebrowse_templatesclear_domain_tlsconvert_to_terraformcreate_domaincreate_gvccreate_identitycreate_policycreate_secret_dictionarycreate_secret_dockercreate_secret_ecrcreate_secret_opaquecreate_secret_tlscreate_volumesetcreate_workloaddelete_resourceexpand_volumesetexport_terraformget_cpln_rulesget_cpln_skillget_installed_templateget_permissionsget_resourceget_resource_schemaget_templateget_workload_eventsget_workload_logsinstall_templatelist_deploymentslist_installed_templateslist_metricslist_resourceslist_workload_replicasmount_volumeset_to_workloadquery_audit_eventsquery_metricsremove_domain_portremove_domain_routereveal_secretsearch_control_planeset_domain_tlsuninstall_templateupdate_domainupdate_domain_routeupdate_gvcupdate_identityupdate_policyupdate_secret_dictionaryupdate_secret_dockerupdate_secret_ecrupdate_secret_opaqueupdate_secret_tlsupdate_volumesetupdate_workloadupgrade_templateworkload_execworkload_reveal_secret

  Fix: Review and remediate the identified issue.

• InfoAS-002

  ⚠️Excessive Permissions ×45

  declared capabilities: database access

  browse_templateslist_metrics

  declared capabilities: network access

  clear_domain_tlsget_permissionsget_resourceget_workload_events

  declared capabilities: code/command execution, network access, filesystem access

  create_domaincreate_identityupdate_domainupdate_identity

  declared capabilities: code/command execution, network access, filesystem access, environment variables

  create_gvc

  declared capabilities: code/command execution, filesystem access, database access

  create_policycreate_workload

  declared capabilities: code/command execution, filesystem access

  create_secret_dictionarycreate_secret_dockercreate_secret_ecrcreate_secret_tlscreate_volumesetmount_volumeset_to_workloadupdate_policyupdate_secret_dictionaryupdate_secret_dockerupdate_secret_ecrupdate_secret_tlsupdate_volumesetupdate_workload

  declared capabilities: code/command execution, filesystem access, HTTP requests

  create_secret_opaqueupdate_secret_opaque

  declared capabilities: filesystem access

  delete_resourceexport_terraforminstall_templateremove_domain_portremove_domain_routereveal_secretupdate_domain_route

  declared capabilities: network access, filesystem access

  expand_volumeset

  declared capabilities: filesystem access, HTTP requests

  get_resource_schema

  declared capabilities: code/command execution, database access

  get_workload_logs

  declared capabilities: code/command execution, network access, HTTP requests

  list_deployments

  declared capabilities: code/command execution

  list_workload_replicasworkload_exec

  declared capabilities: network access, database access

  query_audit_events

  declared capabilities: network access, database access, HTTP requests

  query_metrics

  declared capabilities: network access, filesystem access, database access

  search_control_plane

  declared capabilities: code/command execution, network access, filesystem access, database access, environment variables

  update_gvc

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-010

  🔑Insecure Secret Handling ×7

  input parameter "pullSecretLinks" accepts a credential (informational; not evidence of insecure handling)

  create_gvcupdate_gvc

  input parameter "secretKey" accepts a credential (informational; not evidence of insecure handling)

  create_secret_ecrupdate_secret_ecr

  input parameter "includeSecretValues" accepts a credential (informational; not evidence of insecure handling)

  export_terraform

  input parameter "removePullSecretLinks" accepts a credential (informational; not evidence of insecure handling)

  update_gvc

  input parameter "secretName" accepts a credential (informational; not evidence of insecure handling)

  workload_reveal_secret

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.