Master Security for
Model Context Protocol

🛡️ Lab Exercise: Hardening MCP Tool Schema

In this lab, you will patch a vulnerable Model Context Protocol server tool definition that suffers from indirect command injection.

// VULNERABLE TOOL IMPLEMENTATION
server.tool(
  "execute_git_command",
  "Executes git commands inside workspace",
  { command: z.string() },
  async ({ command }) => {
    // ❌ Dangerous: Direct shell execution of user input!
    const output = await execSync(`git ${command}`);
    return { content: [{ type: "text", text: output.toString() }] };
  }
);

🔑 Recommended Patch Strategy

1. Restrict allowed subcommands using strict enum validation.
2. Use execFile without shell spawn to eliminate injection risk.
3. Validate response token limits before returning context to LLM.