Previously MCP("npx -y pkg", args=[...]) passed the whole string as the
executable, so the subprocess spawn silently failed and 0 tools were
discovered. Now the command string is split on whitespace regardless of
whether args are supplied, using the first token as the executable and
prepending the remaining tokens to any explicit args.
Also updates examples/python/mcp/filesystem-mcp.py to use the reliable
executable + args form.
Co-authored-by: MervinPraison <[email protected]>
Addresses remaining attack surface from security advisories:
GHSA-3qg8-5g3r-79v5 (JWT signing key - CRITICAL):
auth_service.py: PLATFORM_ENV no longer defaults to 'dev' when unset.
When PLATFORM_JWT_SECRET is not set and PLATFORM_ENV is not explicitly
'dev', an ephemeral random secret is auto-generated with a warning.
This prevents production deployments from silently using the well-known
'dev-secret-change-me' key.
GHSA-vg22-4gmj-prxw (unauthenticated eval - CRITICAL):
Replaced all eval() calls in official examples and benchmarks with an
AST-based safe math evaluator that only allows numeric literals and
arithmetic operators. Files fixed:
- examples/python/a2a/a2a-server.py (the primary advisory target)
- examples/mcp/multi_server.py
- examples/python/mcp/mcp-tools-server.py
- examples/python/mcp/mcp-tools-server-sse.py
- examples/mcp_server/custom_tools_server.py
- examples/python/mcp_server_example.py
- examples/python/custom_tools/tools_with_latency.py
- examples/eval/reliability_example.py
- src/praisonai-agents/benchmarks/real_benchmark.py
The character-filter approach (allowlist '0123456789+-*/.()') was
insufficient because () enables attribute access chains. AST-based
evaluation only permits numeric literals and binary/unary arithmetic.
GHSA-hvhp-v2gc-268q and GHSA-9cr9-25q5-8prj (file read/write):
Already fixed in prior commits via _resolve_rule_path() and
_resolve_cwd_yaml_path() containment helpers.
Co-authored-by: ulsreall <[email protected]>
