security scan

The scan an attacker would run first.

MCP servers sit near local files, credentials, shells, and model context. Throne turns that surface into findings a release process can act on: severity, line, reproduction, and fix.

THR-PATH-01

HIGH

Path traversal

Parameters escape the declared root through traversal, symlink, or path normalization gaps.

read_file({ "path": "../.ssh/id_rsa" })

const safe = path.resolve(root, input)
if (!safe.startsWith(root)) throw denied()

THR-EXEC-04

HIGH

Shell argument boundary

User input reaches a spawned process as a shell string instead of isolated arguments.

exec(`git show ${ref}`)

spawn("git", ["show", ref], { shell: false })

THR-PROMPT-07

MEDIUM

Prompt injection sink

Tool output enters the model context without delimiter guards, role separation, or provenance.

return fileContents

return { source, content, untrusted: true }

THR-SECRET-02

MEDIUM

Secret exposure

Tokens or environment values are echoed into descriptions, logs, traces, or tool output.

description: `using ${process.env.API_KEY}`

description: "uses the configured API token"

THR-RATE-09

LOW

Mutation rate limit

Write, delete, network, or payment tools can be called repeatedly with no limit or confirmation.

delete_file({ path })

guardMutation(user, "delete_file", path)

THR-VER-11

LOW

Vulnerable dependency

The shipped package includes a dependency with a known advisory or unsupported major version.

"glob": "7.1.6"

npm audit signatures
npm update glob

what ships in the finding

Not a warning label. A reproduction.

linesrc/tools/files.ts:41
input{ "path": "../private/key.pem" }
resultescaped declared root
fixresolve, normalize, compare against root, deny symlinks