codesight-mcp is an MCP server -- it runs locally and exposes tools to a connected AI model. There are multiple threat vectors: the connected AI may be manipulated via prompt injection (from source code, docstrings, or human input) into making malicious tool calls, a human actor may craft adversarial inputs directly, and indexed repositories may contain content designed to exploit the system. All tool inputs are treated as untrusted regardless of source.

The threat model assumes:

• Tool arguments may attempt path traversal (from AI or direct callers)
• Indexed data may be poisoned with traversal sequences or injection payloads
• Source code may contain prompt injection targeting the AI (indirect injection via repositories)
• Human users may craft inputs containing injection phrases or adversarial content
• Docstrings or summaries may contain injection phrases targeting the host LLM
• Error messages may leak filesystem structure
• Symlinks in indexed directories may point outside the expected root
• Secrets embedded in source code may be exfiltrated if not redacted
• Crafted file/directory names may carry injection content through tool responses
• Compromised dependencies may manipulate environment variables at runtime

Every file access runs through validate_path() in core/validation.py, which applies NFC normalization before the 6-step chain:

0. NFC normalization -- Unicode NFC normalization to canonical form; BOM (U+FEFF) stripping; backslash rejection
1. Control character rejection -- Reject paths containing control bytes (0x01–0x1F, 0x7F, 0x80–0x9F)
2. Segment safety -- Reject .. traversal and dot-prefixed segments (hidden files)
3. Length and depth limits -- Max 512 characters, max 10 directory levels
4. Path resolution -- Path.resolve() to canonical absolute form
5. Containment check -- Resolved path must start with root + os.sep (strict prefix)
6. Symlink parent walk -- lstat every parent directory from file up to root; reject any symlinks

Step 0 runs first to ensure all subsequent checks operate on normalized input. Steps 1-3 run on the raw (post-normalization) input before resolution. Steps 4-6 run on the resolved path. This ordering prevents TOCTOU races where resolution could change what steps 1-3 validated.

All file opens use O_NOFOLLOW to prevent symlink races at the OS level.

All limits are defined in core/limits.py and enforced server-side:

All untrusted fields returned by tools are individually wrapped in boundary markers with cryptographically random tokens:

<<<UNTRUSTED_CODE_a1b2c3d4e5f6...>>>
(source code here)
<<<END_UNTRUSTED_CODE_a1b2c3d4e5f6...>>>

Each response uses a fresh 32-character hex token (128 bits of entropy) generated with secrets.token_hex(16). This makes it computationally infeasible for content to forge a matching end marker. This is based on Microsoft's spotlighting research, which reduced successful prompt injection from >50% to <2%.

Every string field from untrusted sources — including id, name, file, signature, summary, docstring, decorator, query, context_before, and context_after — is individually wrapped. Tools that return source code also include _meta envelopes marking content as untrusted.

Symbol summaries are scanned for injection phrases before storage. Any summary containing phrases like "ignore", "system:", "IMPORTANT:", "override", "execute", and similar is stripped to an empty string. The check uses substring matching (not prefix-only) against the full summary text.

Files matching _SECRET_FILE_PATTERNS (.env, *_key, *.pem, id_rsa, etc.) are excluded from indexing entirely.

The sanitize_signature_for_api() function applies _INLINE_SECRET_RE to signatures, docstrings, and source code. Patterns cover:

• API keys: sk_live_, sk-, xoxb-, xoxp-
• Bearer tokens
• AWS keys (AKIA), GCP keys (AIza), HuggingFace (hf_), npm (npm_), PyPI (pypi-)
• Passwords and credentials in common key=value patterns

Matched secrets are replaced with <REDACTED>.

search_text runs matching against redacted file content, not raw file bytes, and rejects queries for the internal redaction marker <REDACTED>. When CODESIGHT_NO_REDACT=1 is set, search_text is disabled entirely to prevent exposing secrets.

All tools are rate-limited at 60 calls per minute per tool and 300 calls per minute globally. The limits are enforced at the dispatcher level in server.py using a persistent file-backed sliding window stored under the index directory, so they survive process restarts. If the default home-directory state path is unavailable, the server falls back to a private per-user temp directory.

_sanitize_arguments() in server.py enforces:

• String arguments: max 10,000 chars
• symbol_ids list: max 50 entries
• Empty query strings: rejected
• Boolean flags: explicitly coerced
• Integer arguments (max_results, context_lines, max_results): clamped to valid ranges
• byte_offset / byte_length: validated as positive int; ValidationError raised on violation

• Index storage root: ~/.code-index/ (or CODE_INDEX_PATH)
• Directory permissions: 0o700 (owner-only access)
• Index writes use 3-phase atomic write: content files first, then JSON .tmp, then rename
• O_NOFOLLOW on all file reads and writes to prevent symlink races
• load_index() validates schema: required fields, type checks, element-level type checks on symbol arrays, source_files path sanitization (rejects traversal sequences and control characters)
• CODESIGHT_ALLOWED_ROOTS: colon-separated allowlist; colons within paths are rejected
• Per-repository advisory lock files serialize save_index(), incremental_save(), and delete_index()
• Auxiliary state directories reject symlinks and are forced to 0o700
• Persistent rate-limit lock/state files use no-follow opens and atomic writes

• Nonces enforced in _parse_response: response must begin with RESP_{nonce}_START and end with RESP_{nonce}_END
• Missing end marker treated as parse failure (empty result), not degraded success
• Missing nonce delimiters entirely: returns empty summaries (no degraded-mode parsing of untrusted text)
• Batch size capped at MAX_BATCHES_PER_INDEX=50
• Symbol kind validated against _VALID_KINDS allowlist before prompt interpolation (prevents kind-injection attacks)
• Injection phrase blocklist: 20 phrases including "disregard", "forget", "override", "new instruction", "you must", "you are", "respond with", "reply with", "human:", "<|", "|>", "execute ", "run this"
• System/user prompt split uses per-batch nonce marker (<<<SPLIT_{nonce}>>>) to prevent signature injection of the static delimiter
• Signatures sanitized (newlines stripped, length capped) before inclusion in prompts
• trust_env=False on both httpx and Anthropic SDK clients
• ANTHROPIC_BASE_URL frozen at module import; runtime env var mutation cannot redirect summarization to attacker server

The test suite contains 1,818 tests across adversarial, security, integration, and unit categories covering:

• Control character and DEL byte injection in paths, repo IDs, and queries
• ../ traversal in direct arguments and via poisoned index entries
• Symlink escape (file symlinks, directory symlinks, parent chain symlinks)
• Unicode normalization and homoglyph bypass attacks
• Double-encoding attacks
• Oversized paths and deeply nested paths
• Repository identifier injection (slashes, dots, shell metacharacters, trailing newlines)
• Error message sanitization (no path leakage)
• Content boundary marker integrity and spotlighting on all untrusted fields
• Resource limit enforcement (file size, file count, search results, batch count)
• Secret file detection and inline secret redaction
• Binary file detection
• Atomic write and O_NOFOLLOW enforcement
• Schema validation in load_index (type checks, kind validation, hash format)
• Rate limit enforcement and symlink-resistant state file handling
• Gzip decompression bomb rejection
• Injection phrase blocklist (20 phrases, positive and negative cases)
• Env var freezing (ANTHROPIC_BASE_URL, GITHUB_TOKEN mutation after import)
• Nonce-based prompt splitting and delimiter protection
• Double-close fd prevention in safe_write_content
• Temp directory fallback hardening
• Git subprocess environment isolation
• Combined attack chains

All security-critical tests use real temporary directories and real filesystem operations. No mocking of security-critical code paths.

Four security issues were identified in the original jcodemunch-mcp and addressed in codesight-mcp:

1. Unvalidated file reads at retrieval time -- jcodemunch validated paths only during indexing. If an index file was modified (or crafted) after indexing, get_symbol and search_text would read arbitrary files. codesight-mcp validates every file path from the index at retrieval time via validate_file_access().

2. Unbounded context_lines parameter -- get_symbol accepted an arbitrary context_lines value, allowing the AI to request the entire file (defeating the purpose of symbol-level retrieval). codesight-mcp clamps context_lines to MAX_CONTEXT_LINES (100).

3. Raw error messages exposed to AI -- Exceptions were returned as-is, potentially leaking filesystem paths, usernames, and internal structure. codesight-mcp sanitizes all errors through sanitize_error(), which passes through only pre-approved ValidationError messages or known errno mappings.

4. No content boundary markers -- Source code was returned as plain text with no indication that it was untrusted. codesight-mcp wraps all source code and metadata fields in cryptographic boundary markers and includes _meta trust envelopes.

To report a security vulnerability, please open a GitHub Security Advisory at https://github.com/cmillstead/codesight-mcp/security/advisories/new