sceneview-gateway

Security Findings (107)

• HighAS-002

  ⚠️Excessive Permissions ×12

  tool declares network permission

  render_3d_previewcreate_3d_artifactsearch_modelslist_car_modelslist_game_modelslist_medical_modelslist_furniture_modelsgenerate_ar_loggerembed_web_viewer

  tool declares exec permission

  debug_issuegenerate_sceneget_material_switcher

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• HighAS-003

  🔀Scope Mismatch

  get_material_switcher:tool name "get_material_switcher" implies read-only operation but declares exec permission

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• MediumAS-002

  ⚠️Excessive Permissions ×11

  tool declares fs permission

  create_3d_artifactget_model_optimization_guidesearch_modelsanalyze_projectget_furniture_placementget_material_switchersetup_rerun_projectembed_web_viewerexplain_concept

  tool declares db permission

  search_models

  tool declares env permission

  search_models

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×16

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  render_3d_previewcreate_3d_artifactdebug_issuegenerate_scenesearch_modelsget_car_configuratorlist_car_modelsget_level_editorget_particle_effectslist_game_modelsget_medical_imaginglist_medical_modelsget_material_switcherlist_furniture_modelsgenerate_ar_loggerembed_web_viewer

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×4

  tool declares http permission

  get_car_configuratorget_level_editorget_particle_effectsget_medical_imaging

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×63

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  get_samplelist_samplesget_setupvalidate_codeget_migration_guideget_node_referenceget_platform_roadmapget_best_practicesget_ar_setupget_troubleshootingget_ios_setupget_web_setuprender_3d_previewcreate_3d_artifactget_platform_setupmigrate_codedebug_issuegenerate_scenelist_platformsget_animation_guideget_gesture_guideget_performance_tipsget_material_guideget_collision_guideget_model_optimization_guideget_web_rendering_guidesearch_modelsanalyze_projectget_car_configuratorget_hud_overlayget_dashboard_3dget_ar_showroomget_parts_catalogget_ev_charging_station_viewerget_car_paint_shaderlist_car_modelsvalidate_automotive_codeget_character_viewerget_level_editorget_physics_gameget_particle_effectsget_inventory_3dlist_game_modelsvalidate_game_codeget_anatomy_viewerget_molecule_viewerget_medical_imagingget_surgical_planningget_dental_viewerlist_medical_modelsvalidate_medical_codeget_room_plannerget_furniture_placementget_material_switcherget_lighting_designget_room_tourlist_furniture_modelsvalidate_interior_codesetup_rerun_projectgenerate_ar_loggergenerate_python_sidecarembed_web_viewerexplain_concept

  Fix: Review and remediate the identified issue.