WirLernenOnline

Search German open educational resources from WirLernenOnline.de.

GitHub

0/100

Critical

0Tools

9Findings

0Stars

—Downloads

Mar 22, 2026Last Scanned

Score Breakdown5 categories

</>Code

⚙Dependencies

☰Config

✎Description

100

◉Behavior

100

OWASP MCP Top 10 Coverage

MCP10-supply-chainMCP10-supply-chainFail

MCP02-tool-poisoningMCP02-tool-poisoningFail

MCP07-insecure-configMCP07-insecure-configFail

MCP08-dependency-vulnMCP08-dependency-vulnFail

MCP01-prompt-injectionMCP01-prompt-injectionPass

MCP03-command-injectionMCP03-command-injectionFail

MCP04-data-exfiltrationMCP04-data-exfiltrationFail

MCP09-logging-monitoringMCP09-logging-monitoringPass

MCP05-privilege-escalationMCP05-privilege-escalationPass

MCP06-excessive-permissionsMCP06-excessive-permissionsPass

Findings9

2critical

5high

1medium

1low

0informational

criticalC1Command InjectionMCP03-command-injectionAML.T0054

Pattern "`[^`]+`" matched in source_code: "`Search WirLernenOnline (WLO) for Sammlungen (= Themenseiten). In WLO, a "Sammlung" is the same as a "Themenseite": a curated thematic page that bundles educational content items in swimlanes (Schwimmlinien/Karussells) grouped by topic, subject or level. Users may ask for "Themenseite Algebra", "Sammlung Klimawandel" or "Portal Mathematik" – these all refer to collections. Use the returned nodeId with get_collection_contents to retrieve the actual content items. Filters accept both German labels (e.g. "Mathematik", "Grundschule", "Lehrer/in") and full URIs.`" (at position 2354)

Replace exec()/execSync() with execFile() and pass arguments as an array, never as a string. Validate all inputs against an allowlist before use in any shell context. For subprocess.run, always pass a list and shell=False.

criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054

Pattern "["']@modelcontextprotocol/sdk["']\s*:\s*["'](?:\^|~|\*|latest)" matched in source_code: ""@modelcontextprotocol/sdk": "^" (at position 25910)

MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.

highO10Privacy-Violating TelemetryMCP04-data-exfiltrationAML.T0057

Minimize data collection to only what is strictly necessary for tool functionality. Never collect OS fingerprints, hardware IDs, network interface details, or unique device identifiers without explicit user consent. Remove all tracking pixels, analytics beacons, and behavioral profiling code. If telemetry is needed, make it opt-in only, clearly documented, and limited to non-identifying aggregated metrics. Comply with GDPR data minimization (Art. 5(1)(c)) and EU AI Act transparency requirements (Art. 52).

highD1Known CVEs in DependenciesMCP08-dependency-vuln

Dependency "@modelcontextprotocol/sdk@1.10.2" has known CVEs:

Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.

highK13Unsanitized Tool OutputMCP02-tool-poisoningAML.T0054

Sanitize all external data before including in tool responses. Implement output encoding that neutralizes prompt injection patterns. Truncate excessively long content. Validate structure before passing database results. Apply the principle: treat all external data as untrusted, even in tool outputs. Required by CoSAI MCP-T4.

highD1Known CVEs in DependenciesMCP08-dependency-vuln

Dependency "express@4.19.2" has known CVEs:

Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.

highK19Missing Runtime Sandbox EnforcementMCP07-insecure-configAML.T0054

Run MCP servers in sandboxed containers with: (1) No --privileged flag, (2) Minimal Linux capabilities (drop ALL, add only needed), (3) Read-only root filesystem, (4) Non-root user, (5) Seccomp/AppArmor profiles enabled, (6) No host mounts except data volumes. CoSAI warns containers alone are insufficient — add seccomp profiles. Required by CoSAI MCP-T8 and ISO 27001 A.8.22.

mediumK17Missing Timeout or Circuit BreakerMCP07-insecure-configAML.T0054

Add timeouts to ALL external calls: HTTP requests (30s), database queries (10s), subprocess execution (60s), and MCP tool calls (30s). Implement circuit breakers that open after N consecutive failures (e.g., opossum, cockatiel). Use AbortSignal for cancellable operations. Required by EU AI Act Art. 15 and OWASP ASI08.

lowF4MCP Spec Non-ComplianceMCP07-insecure-config

Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions

Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.

Security Category Deep Dive

Sub-Category Tree · Remediation Roadmap · Attack Stories · Compliance Overlay · ATLAS Techniques · Maturity Model

⚡

Prompt Injection

Prompt & context manipulation attacks

MATURITY

RULES

SUB-CATS

GAPS

64%

IMPL.

TESTS

STORIES

PI-DIRDirect Input Injection

100%3 rules

Injection via tool descriptions and parameter fields

GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules

PI-INDIndirect / Gateway Injection

100%4 rules

Hidden instructions via external content and tool responses

PI-CTXContext Manipulation

100%2 rules

Context window saturation and prior-approval exploitation

PI-ENCEncoding & Obfuscation

100%3 rules

Payload hiding via invisible chars, base64, schema fields

PI-TPLTemplate & Output Poisoning

100%2 rules

Injection via prompt templates and runtime tool output