Repository navigation
Guard MCP prompt retrieval with DIFC - #14934
Merged
Merged
Conversation
Route prompts/get through session initialization, prompt allowlisting, agent authorization, and the shared DIFC reference-monitor phases. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dfbccdd1-a318-40cd-9460-9709bcdb1f53
Contributor
🔒 mcpg Read-Only Stress — defaultSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Overall: INCONCLUSIVE No write leaked in any part (0 reactions, stars, issues, comments, branches, files, or PRs created). However:
No security gap found; the inconclusive rows reflect methodology limits of this probe on this runtime, not evidence of a weakened guarantee.
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved security and compatibility issues remain in the prompt response pipeline.
5 open findings
What changed in this PR
Adds DIFC mediation to MCP prompt retrieval, bringing prompts into the gateway’s authorization and response-filtering pipeline.
Changes:
- Adds session checks, authorization, prompt allowlists, and DIFC processing.
- Adds prompt-handling and configuration regression tests.
- Documents prompt configuration, labeling semantics, and the security change.
| File | Description |
|---|---|
| internal/server/unified.go | Initializes prompt allowlist state. |
| internal/server/tool_registry.go | Filters discovery and registers guarded handlers. |
| internal/server/tool_registry_helpers.go | Builds per-server prompt allowlists. |
| internal/server/register_prompts_test.go | Tests discovery filtering and handler behavior. |
| internal/server/prompt_call.go | Implements mediated prompt retrieval. |
| internal/server/prompt_call_test.go | Tests authorization, filtering, and propagation. |
| internal/config/config_stdin.go | Adds JSON prompt allowlist parsing and conversion. |
| internal/config/config_stdin_test.go | Tests HTTP and stdio allowlist conversion. |
| internal/config/config_core.go | Adds prompt allowlists to server configuration. |
| docs/RELEASE_NOTES.md | Records the prompt mediation security change. |
| docs/GUARD_RESPONSE_LABELING.md | Describes prompt response-labeling semantics. |
| docs/CONFIGURATION.md | Documents the prompt allowlist option. |
| config.example.toml | Adds commented prompt allowlist examples. |
🧠 Review effort: Max
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if err != nil { | ||
| return nil, fmt.Errorf("response labeling failed: %w", err) | ||
| } | ||
| filterResult, err := difc.FilterAndConvertLabeledData( |
| finalResult := backendResult | ||
| if labeledData != nil { | ||
| finalResult = filterResult.FinalResult | ||
| if _, ok := labeledData.(*difc.CollectionLabeledData); ok { |
Comment on lines
+138
to
+141
| filteredMap := make(map[string]interface{}, len(resultMap)) | ||
| for key, value := range resultMap { | ||
| filteredMap[key] = value | ||
| } |
| Tools []string `json:"tools,omitempty"` | ||
|
|
||
| // Prompts is an optional list of prompts to filter/expose | ||
| Prompts []string `json:"prompts,omitempty"` |
Comment on lines
+119
to
+121
| if filterResult.Blocked { | ||
| return nil, fmt.Errorf("DIFC policy violation: prompt response contains data that is not accessible to this agent") | ||
| } |
This was referenced Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the private advisory GHSA-4m9j-r78h-2grr by removing the direct
prompts/getbackend-forwarding path. Prompt retrieval now passes through session initialization, authorization, allowlisting, and the shared DIFC reference-monitor phases before a result reaches the client.Advisory condition mapping
prompts/getskipped session initializationrequireSessionbefore dispatchTestPromptHandlerRunsSessionAndDIFCPipelineverifies the session is createdpromptsconfiguration, filtersprompts/list, and rejects non-allowed runtime dispatchTestRegisterPromptsFromBackend_RegistersPrompts;TestCallBackendPromptRejectsPromptOutsideAllowlistTestCallBackendPromptEnforcesAgentServerAuthorizationLabelAgentnever initializedcallBackendPromptresolves the session guard and callsensureGuardInitializedTestPromptHandlerRunsSessionAndDIFCPipelineassertsLabelAgentinvocationRunPipelinePrePhasesbefore backend execution and returns canonical DIFC denial errorsTestCallBackendPromptCoarseDenyPreventsBackendExecutionverifies the backend is not calledRunPipelinePhase4andFilterAndConvertLabeledData; prompt collection labels apply to themessagesarrayTestCallBackendPromptFiltersMessagesWithoutDisclosingDeniedContentverifies inaccessible prompt content is absentLabelResponsereturns nilRunPipelinePhase6after successful prompt filteringTestCallBackendPromptPropagateAccumulatesLabelsverifies agent secrecy accumulationsdk.GetPromptResultand backend errors remain wrappedTestPromptHandlerRunsSessionAndDIFCPipeline; existing prompt invocation/error testsPrompt names are passed to the guard as the operation name. Custom guards can therefore add prompt-specific resource and response labeling; guards without prompt-specific rules retain their normal default labeling behavior.
Documentation
promptsallowlist in JSON/TOML configuration.Validation
make agent-finished(format, build, lint, full Go tests, 676 Rust guard tests)