From fd8b66cce27a14030de636df5a315eddab0d382c Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:11:42 -0400 Subject: [PATCH 1/6] fix(adb-mysql-mcp-server): force cryptography>=50.0.0 Grype flags cryptography 48.0.1 for GHSA-g6cj-pr64-35w5 (High): the PKCS#7 EnvelopedData decryption path exposes a Bleichenbacher oracle through distinguishable errors and timing. The affected range is >=44.0.0,<50.0.0 and the fix is 50.0.0. alibabacloud-tea-openapi caps cryptography <49.0.0 for python>=3.9, which excludes the fixed version, so the constraint is needed to pull it forward. This is not a regression from the mcp<2 constraint; cryptography resolves to 48.0.1 with and without it. .grype.yaml treats runtime dependencies under /opt/uv-tools as not ignorable, so an ignore rule is not the right instrument here. Asking upstream to raise the cap is the more correct long-term fix but is not something we control. Verified locally: image installs cryptography 50.0.0 and mcp 1.29.0, grype --fail-on high --only-fixed reports no vulnerabilities, the container starts and activates 3 tools plus 4 resources, and the MCP security scan passes with all tools SAFE. Residual risk: imports and the RSA signing primitive are covered, but not live API calls against AnalyticDB, which need credentials. Fixes #828 Co-Authored-By: Claude Opus 5 (1M context) --- uvx/adb-mysql-mcp-server/spec.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/uvx/adb-mysql-mcp-server/spec.yaml b/uvx/adb-mysql-mcp-server/spec.yaml index 6a53b905..c6a3dda5 100644 --- a/uvx/adb-mysql-mcp-server/spec.yaml +++ b/uvx/adb-mysql-mcp-server/spec.yaml @@ -19,6 +19,13 @@ spec: mcp 2.0.0 removed the mcp.server.fastmcp module the server imports at startup, so the container fails immediately with ModuleNotFoundError. Cap it below 2 until upstream pins the dependency themselves. + - spec: "cryptography>=50.0.0" + reason: | + alibabacloud-tea-openapi caps cryptography <49.0.0 for python>=3.9, but + the fix for GHSA-g6cj-pr64-35w5 (High, Bleichenbacher oracle in PKCS#7 + EnvelopedData decryption) is cryptography 50.0.0. Verified that the + server's imports and the RSA signing primitive the SDK uses still work + with 50.0.0. provenance: repository_uri: "https://github.com/aliyun/alibabacloud-adb-mysql-mcp-server" From d30776391464342674bdc3c5e810dc7d80307c9e Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:17:28 -0400 Subject: [PATCH 2/6] fix(chroma-mcp): constrain mcp[cli] to >=1.28.1 for 5 HIGH CVEs chroma-mcp 0.2.6 exact-pins mcp[cli]==1.6.0, which excludes the fix for all five HIGH advisories Grype reports against the published image: GHSA-3qhf-m339-9g5v (fixed 1.9.4), GHSA-j975-95f5-7wqh (1.10.0), GHSA-9h52-p55h-vw2f (1.23.0), GHSA-jpw9-pfvf-9f58 (1.27.2) and GHSA-vj7q-gjh5-988w (1.28.1). 1.28.1 is the lowest floor that clears all five. A smaller bump to 1.23.0 would newly expose GHSA-hvrp-rf83-w775 (HIGH, affects >=1.23.0,<=1.27.1), which the pinned 1.6.0 predates. The constraint is capped <2 so uv cannot resolve the mcp 2.x major. chroma-mcp imports only mcp.server.fastmcp.FastMCP, which is stable across the 1.x line, so this stays well inside same-major territory. Verified: image builds, resolves mcp 1.29.0, grype --fail-on high --only-fixed reports no vulnerabilities, and the mcp-scan enumerates all 13 chroma_* tools with no findings. Refs #830 Co-Authored-By: Claude Opus 5 (1M context) --- uvx/chroma-mcp/spec.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/uvx/chroma-mcp/spec.yaml b/uvx/chroma-mcp/spec.yaml index a95946b2..860d263f 100644 --- a/uvx/chroma-mcp/spec.yaml +++ b/uvx/chroma-mcp/spec.yaml @@ -12,6 +12,18 @@ metadata: spec: package: "chroma-mcp" version: "0.2.6" + constraints: + - spec: "mcp[cli]>=1.28.1,<2" + reason: | + chroma-mcp 0.2.6 exact-pins mcp[cli]==1.6.0, which excludes every fix + for its 5 HIGH findings: GHSA-3qhf-m339-9g5v (1.9.4), + GHSA-j975-95f5-7wqh (1.10.0), GHSA-9h52-p55h-vw2f (1.23.0), + GHSA-jpw9-pfvf-9f58 (1.27.2) and GHSA-vj7q-gjh5-988w (1.28.1). + 1.28.1 is the lowest version clearing all five: a smaller bump to + 1.23.0 would newly expose GHSA-hvrp-rf83-w775 (HIGH, + >=1.23.0,<=1.27.1), which 1.6.0 predates. Capped <2 so uv cannot + resolve the mcp 2.x major. chroma-mcp only imports + mcp.server.fastmcp.FastMCP, which is stable across the 1.x line. provenance: repository_uri: "https://github.com/chroma-core/chroma-mcp" From 7970f5ebddb1e35d8c960ef51c935514985d20a5 Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:27:52 -0400 Subject: [PATCH 3/6] fix(brightdata-mcp): override SDK to 1.26.0 to clear 3 high CVEs @brightdata/mcp 2.9.0 exact-pins @modelcontextprotocol/sdk 1.21.2, which fails the Grype gate with three high findings: GHSA-w48q-cv73-mx4w DNS rebinding fixed 1.24.0 GHSA-8r9q-7v3j-jr4g ReDoS fixed 1.25.2 GHSA-345p-7cg4-v4c7 >=1.10.0,<=1.25.3, fixed 1.26.0 An exact pin below every fix, so this is the override shape #669 introduced. 1.26.0 is the lowest version clearing all three: 1.25.2 is still inside the GHSA-345p range. Same-major, no API break. Verified: grype --fail-on high --only-fixed exits 0 with no high/critical findings, npm resolves 1.26.0 for both the direct dependency and fastmcp's copy (deduped), and the container starts and enumerates its tool list over stdio. Refs #830 --- npx/brightdata-mcp/spec.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/npx/brightdata-mcp/spec.yaml b/npx/brightdata-mcp/spec.yaml index 6d92ddda..e5ec7dac 100644 --- a/npx/brightdata-mcp/spec.yaml +++ b/npx/brightdata-mcp/spec.yaml @@ -12,6 +12,16 @@ metadata: spec: package: "@brightdata/mcp" version: "2.9.0" + overrides: + - package: "@modelcontextprotocol/sdk" + version: "1.26.0" + reason: | + @brightdata/mcp exact-pins @modelcontextprotocol/sdk 1.21.2, which carries + GHSA-w48q-cv73-mx4w (DNS rebinding, fixed 1.24.0), GHSA-8r9q-7v3j-jr4g + (ReDoS, fixed 1.25.2) and GHSA-345p-7cg4-v4c7 (affects >=1.10.0,<=1.25.3, + fixed 1.26.0). 1.26.0 is the lowest version that clears all three: 1.25.2 + would still be inside the GHSA-345p range. Same-major, and the server's + tools still enumerate correctly. provenance: repository_uri: "https://github.com/brightdata/brightdata-mcp" From 8095cbeb6d1df1a7712d6ad207af7663afba488e Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:27:59 -0400 Subject: [PATCH 4/6] fix(mcp-jetbrains): override SDK to 1.26.0 to clear 2 high CVEs No code-scanning alerts landed for this server, so the findings were established by building the image and running grype locally: @modelcontextprotocol/sdk 1.7.0 GHSA-w48q-cv73-mx4w DNS rebinding fixed 1.24.0 high GHSA-8r9q-7v3j-jr4g ReDoS fixed 1.25.2 high @jetbrains/mcp-proxy 1.8.0 exact-pins the SDK at 1.7.0, so this is the same shape as onchain-mcp. 1.26.0 rather than 1.25.2 because GHSA-345p-7cg4-v4c7 affects >=1.10.0,<=1.25.3, which 1.7.0 predates; a smaller bump would trade two advisories for a third. Same-major. Verified: grype --fail-on high --only-fixed exits 0, npm reports @modelcontextprotocol/sdk@1.26.0 overridden, and the proxy completes the MCP initialize handshake. tools/list then returns "No working IDE endpoint available", which is the expected response with no JetBrains IDE to proxy to and the reason this server carries insecure_ignore. Refs #830 --- npx/mcp-jetbrains/spec.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/npx/mcp-jetbrains/spec.yaml b/npx/mcp-jetbrains/spec.yaml index 8e2d3930..a267c443 100644 --- a/npx/mcp-jetbrains/spec.yaml +++ b/npx/mcp-jetbrains/spec.yaml @@ -12,6 +12,16 @@ metadata: spec: package: "@jetbrains/mcp-proxy" version: "1.8.0" + overrides: + - package: "@modelcontextprotocol/sdk" + version: "1.26.0" + reason: | + @jetbrains/mcp-proxy exact-pins @modelcontextprotocol/sdk 1.7.0, which + carries GHSA-w48q-cv73-mx4w (DNS rebinding, fixed 1.24.0) and + GHSA-8r9q-7v3j-jr4g (ReDoS, fixed 1.25.2). 1.26.0 rather than 1.25.2 + because GHSA-345p-7cg4-v4c7 affects >=1.10.0,<=1.25.3, which the pinned + 1.7.0 predates, so a smaller bump would trade two advisories for a third. + Same-major, and the proxy still starts and serves its tool list. provenance: repository_uri: "https://github.com/JetBrains/mcp-jetbrains" From d242e55a6d9c3cf47177d27034042e60c6e99827 Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:28:09 -0400 Subject: [PATCH 5/6] fix(astra-db-mcp): override undici to 6.28.0 to clear 3 high CVEs undici 5.29.0 reaches the image through astra-db-mcp -> mcp-evals -> @actions/core -> @actions/http-client, which caps it at ^5.25.4: GHSA-vrm6-8vpv-qv8q fixed 6.24.0 high GHSA-v9p9-hfj2-hcw8 fixed 6.24.0 high GHSA-vxpw-j846-p89q fixed 6.27.0 high The 5.x line is end of life, so no 5.x release can carry these fixes and the cap excludes every fix. 6.28.0 is the last 6.x release; no high advisory affects >=6.27.0 on that line, and stopping at 6.x avoids the 7.x-only advisories (GHSA-hm92-r4w5-c3mj, GHSA-vmh5-mc38-953g, GHSA-4cwx-7wf7-3272). This is a cross-major force, so worth flagging. It is low risk here: @actions/http-client 4.0.1 upstream has itself moved to undici ^6.23.0, and the consumer is the mcp-evals harness rather than the server's request path. Verified: grype --fail-on high --only-fixed exits 0 with only medium and low findings remaining, npm reports undici@6.28.0 overridden, and scripts/mcp-scan/run_scan.py exits 0 with all 19 tools enumerated and SAFE. Refs #830 --- npx/astra-db-mcp/spec.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/npx/astra-db-mcp/spec.yaml b/npx/astra-db-mcp/spec.yaml index 2606c5f5..a366d626 100644 --- a/npx/astra-db-mcp/spec.yaml +++ b/npx/astra-db-mcp/spec.yaml @@ -12,6 +12,20 @@ metadata: spec: package: "@datastax/astra-db-mcp" version: "1.2.2" + overrides: + - package: "undici" + version: "6.28.0" + reason: | + undici 5.29.0 arrives via astra-db-mcp -> mcp-evals -> @actions/core -> + @actions/http-client, which caps it at ^5.25.4. The 5.x line is end of + life, so the fixes for GHSA-vrm6-8vpv-qv8q and GHSA-v9p9-hfj2-hcw8 + (both 6.24.0) and GHSA-vxpw-j846-p89q (6.27.0) only exist in 6.x. + 6.28.0 is the last 6.x release and no high advisory affects >=6.27.0 + on that line, so it clears all three without stepping into the 7.x + advisories (GHSA-hm92-r4w5-c3mj, GHSA-vmh5-mc38-953g, GHSA-4cwx-7wf7-3272). + Cross-major force, but @actions/http-client 4.0.1 upstream has itself + moved to undici ^6.23.0, so 6.x is a supported target for this consumer, + and the tool list still enumerates. provenance: repository_uri: "https://github.com/datastax/astra-db-mcp" From ab1e2cd383cabad3e224561ca61cd52605f7f0b7 Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:28:21 -0400 Subject: [PATCH 6/6] fix(browserbase-mcp-server): override sharp and undici to clear 4 high CVEs Grype reports two capped dependencies, not just the sharp one #830 recorded: sharp 0.33.5 (capped ^0.33.0) GHSA-f88m-g3jw-g9cj libvips CVEs, affects <0.35.0 high undici 5.29.0 (capped ^5.29.0 by @ai-sdk/provider-utils, reached via @browserbasehq/stagehand -> @ai-sdk/amazon-bedrock) GHSA-vrm6-8vpv-qv8q fixed 6.24.0 high GHSA-v9p9-hfj2-hcw8 fixed 6.24.0 high GHSA-vxpw-j846-p89q fixed 6.27.0 high Both caps exclude every fix. sharp goes to 0.35.3, the newest 0.35.x and the only sharp advisory in play. undici goes to 6.28.0, the last 6.x release, which clears all three without stepping into the 7.x-only advisories. Both are effectively cross-major forces: sharp 0.x minors are breaking by convention, and undici 5 to 6 is a real major. Mitigating evidence is that @ai-sdk/provider-utils 5.x upstream now uses undici ^7.28.0, so that consumer tracks well past 6.x. Verified: grype --fail-on high --only-fixed reports "No vulnerabilities found" and exits 0; sharp loads in the container against libvips 8.18.3 and round-trips a create/resize/re-encode; the server completes the MCP initialize handshake and enumerates its tool list over stdio. Note, unrelated to this change: @browserbasehq/mcp-server-browserbase 2.4.3 is currently uninstallable from a clean npm cache. Its transitive ai@5.0.228 exact-pins @ai-sdk/gateway@2.0.127, which does not exist in the registry. This reproduces with a bare `npm install` and no overrides, and is the likely cause of the intermittent build-step failures. CI will keep failing at npm install until upstream publishes a fixed release. Refs #830 --- npx/browserbase-mcp-server/spec.yaml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/npx/browserbase-mcp-server/spec.yaml b/npx/browserbase-mcp-server/spec.yaml index fa6e64e3..ffaca26a 100644 --- a/npx/browserbase-mcp-server/spec.yaml +++ b/npx/browserbase-mcp-server/spec.yaml @@ -12,6 +12,29 @@ metadata: spec: package: "@browserbasehq/mcp-server-browserbase" version: "2.4.3" + overrides: + - package: "sharp" + version: "0.35.3" + reason: | + @browserbasehq/mcp-server-browserbase caps sharp at ^0.33.0, resolving + 0.33.5. GHSA-f88m-g3jw-g9cj (inherited libvips CVE-2026-33327, + CVE-2026-33328, CVE-2026-35590, CVE-2026-35591) affects all sharp <0.35.0, + so no 0.33.x or 0.34.x release can fix it. 0.35.3 is the newest 0.35.x + and is the only sharp advisory in play. sharp 0.x minors are breaking by + convention, so this is effectively a cross-major force; verified in the + container that sharp loads and round-trips a resize on the pinned version. + - package: "undici" + version: "6.28.0" + reason: | + undici 5.29.0 arrives via @browserbasehq/stagehand -> + @ai-sdk/amazon-bedrock -> @ai-sdk/provider-utils, which caps it at + ^5.29.0. The 5.x line is end of life, so the fixes for + GHSA-vrm6-8vpv-qv8q and GHSA-v9p9-hfj2-hcw8 (both 6.24.0) and + GHSA-vxpw-j846-p89q (6.27.0) only exist in 6.x. 6.28.0 is the last 6.x + release and no high advisory affects >=6.27.0 on that line, so it clears + all three without stepping into the 7.x advisories. Cross-major force, + but @ai-sdk/provider-utils 5.x upstream has itself moved to undici + ^7.28.0, so this consumer tracks well past 6.x. provenance: repository_uri: "https://github.com/browserbase/mcp-server-browserbase"