ai.dynsoft/sac

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/sac/renderer/design-systems/default/shim.js:84mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

    React.forwardRef(({ className, ...p }, ref) => {
      const clean = {};
      for (const k in p) { if (!_strip.has(k)) clean[k] = p[k]; }
      return e(tag, { ref, className: cn(base, className), ...clean });
    });

• src/sac/cli.py:679mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

              headers={"Content-Type": "application/json"},
          )
          resp = urllib.request.urlopen(req, timeout=300)
          result = json.loads(resp.read().decode("utf-8"))
      except urllib.error.URLError as exc:

• src/sac/server/http/http.py:1053mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          import urllib.request
  
          with urllib.request.urlopen(
              f"http://127.0.0.1:{port}/health", timeout=1.5
          ) as resp:

• src/sac/server/http/static/index.js:500mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      // New App version pushed by an agent — fetch latest code and re-render.
      try {
        const res = await fetch('/conversations/' + convId);
        const { conversation, events = [] } = await res.json();
        if (conversation && conversation.latest_code) {

• src/sac/server/http/static/index.js:708mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    if (!conversationId || !pendingAction) return;
    try {
      const res = await fetch('/conversations/' + conversationId);
      if (!res.ok) return;
      const { events = [] } = await res.json();

• src/sac/server/http/static/index.js:1595mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  window.loadConv = async function(id) {
    try {
      const res = await fetch('/conversations/' + id);
      const data = await res.json();
      const conv = data.conversation;

• src/sac/server/http/static/index.js:1692mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    if (!title) return;
    try {
      await fetch('/conversations/' + id, {
        method: 'PATCH',
        headers: { 'Content-Type': 'application/json' },

• src/sac/server/http/static/index.js:1707mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    if (!confirm('Delete this conversation?')) return;
    try {
      await fetch('/conversations/' + id, { method: 'DELETE' });
      if (conversationId === id) {
        conversationId = null;

• src/sac/server/mcp/mcp.py:110mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          import json
          import urllib.request
          with urllib.request.urlopen(
              f"http://127.0.0.1:{port}/health", timeout=1.5
          ) as resp:

• src/sac/server/mcp/mcp.py:254mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

      )
      # /inbox can take 60-120s for LLM generation
      with urllib.request.urlopen(req, timeout=300) as resp:
          return json.loads(resp.read().decode("utf-8"))
  

• src/sac/server/mcp/mcp.py:403mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

          try:
              def _poll(u=url, t=chunk_timeout):
                  with urllib.request.urlopen(u, timeout=t + 5) as resp:
                      return json.loads(resp.read().decode("utf-8"))
              result = await loop.run_in_executor(None, _poll)

• src/sac/server/mcp/mcp.py:448mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

      import urllib.request
      base_url = _ensure_http_server()
      with urllib.request.urlopen(f"{base_url}{path}", timeout=10) as resp:
          return json.loads(resp.read().decode("utf-8"))
  

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  credentials are read from the environment (SAC_API_KEY, SAC_SEARCH_API_KEY), but the README does not document which

• authorization_granularity

  6 tool registrations and no conditional access logic found — `03` §4 calls this case 'needs human review' and assigns it no score band, so it is not scored here

Maintenance

• recency

  last commit 35 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  median release gap 1 days (by releases), last release 144 day(s) ago

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  README.md: installation instructions (+25), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately