ai.lamdis/exchange

version 0.1.0

scanned 2026-10-16
source github.com/lamdis-ai/lamdis-protocol
commit 78aff5f6c93b
transport streamable-http
files read 237
methodology 0.2.0
ruleset 0.1.1

No tag matching version 0.1.0 was found in this repository, so the scan read the default branch instead. The findings below describe that code, not necessarily the released version.

Code Safetyweight 30

1 vendored or minified path was excluded before scanning; machine-generated bundles are not the server's own code

Auth Postureweight 20

68measured on 65% of this axis

Dependency Healthweight 20

30measured on 91% of this axis

1 vulnerability could not be placed in `03` §6's table and is listed but not scored

Maintenanceweight 15

91measured on 90% of this axis

Transparencyweight 15

53measured on 80% of this axis

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

Showing the 50 most severe of 66 findings on this axis. The score was computed over all of them — findings beyond the fourth of a severity still deduct at a tenth of their weight — so the remainder is omitted from this page, not from the arithmetic.

node/internal/agent/workspace.go:557mcp-go-shell-exec-interpreter (critical/medium)
A shell interpreter is invoked with a constructed command string. Go's exec.Command is safe by default precisely because it takes an argument vector; routing through `sh -c` gives that safety away.
```
		return exec.CommandContext(ctx, "cmd", "/c", line)
	}
	return exec.CommandContext(ctx, "sh", "-c", line)
}
```

node/internal/api/dispatch.go:277mcp-go-ssrf-metadata-endpoint (critical/medium)

The cloud instance-metadata endpoint is contacted directly.

// unchecked that is a request forgery primitive pointed at our own metadata
// service, and the fact that we require https:// stops none of it — a name can
// have a TLS certificate and still resolve to 169.254.169.254.
func safeWebhookHost(raw string) error {
	u, err := url.Parse(raw)

integrations/vercel-ai/src/index.ts:119mcp-js-prototype-pollution-merge-loop (medium/medium)
Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.
```
  for (const k of ["where", "area", "instructions", "deliverable", "skills", "attempt_minor"] as const) {
    const v = input[k];
    if (v !== undefined && v !== null && v !== "" && !(Array.isArray(v) && v.length === 0)) body[k] = v;
  }
  if (input.sandbox ?? true) body.sandbox = true;
```

bench/run_gen.py:63mcp-python-path-join-unvalidated (medium/low)

A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

                    image_for(iid), "sleep", "infinity"], check=True, capture_output=True)
    containers.add(name)
    log = open(os.path.join(logdir, iid + ".log"), "w")
    script = ('source /opt/miniconda3/bin/activate testbed 2>/dev/null; cd /testbed; '
              'git config --global --add safe.directory /testbed; git config core.fileMode false; '

bench/run_gen.py:101mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
def usage(key):
    req = urllib.request.Request("https://openrouter.ai/api/v1/key", headers={"Authorization": "Bearer " + key})
    return json.load(urllib.request.urlopen(req, timeout=30))["data"]["usage"]
```
bench/run_gen.py:115mcp-python-path-join-unvalidated (medium/low)
A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.
```
    cfg = {"model": model, "trust": "project", "unguarded": True, "max_tool_calls": 200,
           "max_runs_per_day": 100000, "max_fetches_per_day": 100000, "max_tokens_per_day": 1000000000}
    json.dump(cfg, open(os.path.join(data, "agent.json"), "w"), indent=2)
```
bench/run_gen.py:158mcp-python-path-join-unvalidated (medium/low)
A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.
```
    shutil.rmtree(data, ignore_errors=True)
    setup_data(model, data)
    log = open(os.path.join(logdir, inst["instance_id"] + ".log"), "w")
    # Offline: the score has to come from the repository, not from finding
    # the upstream fix on the web.
```
brand/mark.py:41mcp-python-path-join-unvalidated (medium/low)
A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.
```
    mono, color = mono.replace('"0.55"', f'"{sw}"'), color.replace('"0.55"', f'"{sw}"')
    tag = "-small" if SMALL else ""
    open(f"lamdis-mark{tag}.svg","w").write(mono+"\n"); open(f"lamdis-mark-color{tag}.svg","w").write(color+"\n")
print(vb); print(d); print(faces)
```
brand/mark.py:41mcp-python-path-join-unvalidated (medium/low)
A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.
```
    mono, color = mono.replace('"0.55"', f'"{sw}"'), color.replace('"0.55"', f'"{sw}"')
    tag = "-small" if SMALL else ""
    open(f"lamdis-mark{tag}.svg","w").write(mono+"\n"); open(f"lamdis-mark-color{tag}.svg","w").write(color+"\n")
print(vb); print(d); print(faces)
```
integrations/crewai/lamdis_crewai/_client.py:30mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        headers["authorization"] = f"Bearer {token}"
    try:
        r = httpx.request(method, base_url() + path, json=json, headers=headers, timeout=30.0)
    except httpx.HTTPError as e:
        return {"error": f"could not reach the exchange: {e}", "http_status": 0}
```
integrations/langchain/lamdis_langchain/_client.py:30mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        headers["authorization"] = f"Bearer {token}"
    try:
        r = httpx.request(method, base_url() + path, json=json, headers=headers, timeout=30.0)
    except httpx.HTTPError as e:
        return {"error": f"could not reach the exchange: {e}", "http_status": 0}
```
integrations/openai-agents/lamdis_openai_agents/_client.py:30mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        headers["authorization"] = f"Bearer {token}"
    try:
        r = httpx.request(method, base_url() + path, json=json, headers=headers, timeout=30.0)
    except httpx.HTTPError as e:
        return {"error": f"could not reach the exchange: {e}", "http_status": 0}
```
integrations/vercel-ai/src/index.ts:91mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
  if (input.skills?.length) body.skills = input.skills;
  if (input.sandbox) body.sandbox = true;
  return request(opts, "POST", "/v1/quote", body);
}
```
integrations/vercel-ai/src/index.ts:122mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
```
  }
  if (input.sandbox ?? true) body.sandbox = true;
  return request(opts, "POST", "/v1/tasks", body);
}
```

integrations/vercel-ai/src/index.ts:127mcp-js-ssrf-nonliteral-url (medium/low)

An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

/** GET /v1/jobs/{job} with the lbt_ token that came back when it was posted. */
export function jobStatus(job: string, token: string, opts: LamdisOptions = {}): Promise<LamdisResult> {
  return request(opts, "GET", `/v1/jobs/${encodeURIComponent(job)}`, undefined, token);
}

integrations/vercel-ai/src/index.ts:132mcp-js-ssrf-nonliteral-url (medium/low)

An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

/** GET /v1/jobs/{job}/receipt: the signed receipt once the job has settled. */
export function jobReceipt(job: string, token: string, opts: LamdisOptions = {}): Promise<LamdisResult> {
  return request(opts, "GET", `/v1/jobs/${encodeURIComponent(job)}/receipt`, undefined, token);
}

node/cmd/lamdis/browser.go:248mcp-go-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.
```
func browserWS(versionURL string) (string, error) {
	resp, err := http.Get(versionURL)
	if err != nil {
		return "", err
```

node/cmd/lamdis/browser.go:264mcp-go-ssrf-nonliteral-url (medium/low)