docs: security audit of MCP tool handlers, platform tools, and auth patterns

[cursor]

Summary

Adds a comprehensive security audit covering all 21 MCP server tool files, the TypeScript/Python/Go SDK clients, and authentication patterns.

Findings

3 Medium-severity issues:

1. Path traversal via unvalidated path parameters — branch_id, clip_id, source_id, graphic_id, and message_id are interpolated into URL paths with only .string().min(1) validation (no UUID or format check), while comparable parameters like stream_id use .uuid().
2. Sensitive credentials returned in MCP tool responses — wave_rotate_stream_key, wave_get_stream_tokens, wave_list_api_keys, and wave_platform_create_scoped_key pass raw API responses (containing plaintext secrets) into LLM context windows.
3. Platform key privilege escalation — wave_platform_create_scoped_key accepts admin permissions with no client-side check that the created key doesn't exceed the creator's scope.

5 Low-severity issues:
4. 10 tool modules export register*Tools() but only 7 are wired in server.ts (dead security surface)
5. A tool in production.ts is registered with a description string as its name
6. WAVE_BASE_URL is unvalidated — SSRF via environment variable redirect
7. Error responses returned to MCP without credential redaction
8. Safety state (read-only mode, cost confirmation) is defined but never enforced

Positive observations: Good SSRF protection in gateway tool, UUID validation on most path params, no credential logging anywhere, proper JSON serialization prevents payload injection, all three SDKs handle retry/rate-limiting correctly.

Files

• docs/audits/security-audit-mcp-auth-2026-08-07.md — Full audit report with line references, attack chains, and recommendations

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Note

Add security audit document for MCP tool handlers, platform tools, and auth patterns

Adds security-audit-mcp-auth-2026-08-07.md, a new audit document covering MCP server tool handlers and auth patterns across TypeScript, Python, and Go SDKs. The document includes an executive summary, eight findings with affected files and line references, auth pattern analysis, retry and credential rotation notes, and a summary table of positive observations.

^{Macroscope summarized f3f3f15.}