Root cause
Authentication & access control
🧩 refactor: Decouple MCP Config from Startup Config (#10689)
AI-assisted change: GitHub Copilot
AI-written code returned raw MCP server configs with unredacted secrets to non-owner users, exposing provider credentials.
How AI contributed: Flawed AI-written codePublished Jun 2, 2026 in 
danny-avila/librechat
Show full advisory descriptionHide advisory description
Information disclosure (CVE-2026-44653, CVSS 6.5, CWE-200/CWE-522): in LibreChat <= 0.8.3, GET /api/mcp/servers and GET /api/mcp/servers/:serverName returned the full MCP server config objects, including decrypted admin-managed secrets (apiKey.key and oauth.client_secret), to any authenticated user with only MCP USE or VIEW permission - including viewers of a shared MCP server who do not own it. The responses were raw registry/parsed configs with zero redaction, so non-owners could exfiltrate the underlying provider/API credentials. Fixed in 0.8.4 by redacting secrets from all server responses and validating configs.
Fix
Security fix
🪪 fix: MCP API Responses and OAuth Validation (#12217)
Fix by Danny Avila · no AI marker found
Case facts
- CVE ID
- CVE-2026-44653
- Published
- Jun 2, 2026
- Severity
- Not scored
- Language
- TypeScript
- AI tool
GitHub Copilot- AI role
- Flawed AI-written code
- Vulnerable release
- >=0
- Fixed release
- 0736ff26686e911c9785a237c63a799db1813f0b
AI-assisted change
AI-assisted changepackages/data-provider/src/types/mcpServers.tssource danny-avila/librechat@ef1b7f0157+32−1
@@ -1,4 +1,5 @@-import type { MCPOptions } from '../mcp';+import { PermissionBits } from '../accessPermissions';+import type { MCPOptions, MCPServerUserInput } from '../mcp';Show 9 hidden lines
/** * Base MCP Server interface@@ -19,3 +20,33 @@ export interface IMCPServerDB { * Similar to Agent type - includes populated author fields */ export type MCPServerDB = IMCPServerDB;++/**+ * Parameters for creating a new user-managed MCP server+ * Note: Only UI-editable fields are allowed (excludes server-managed fields)+ */+export type MCPServerCreateParams = {+ config: MCPServerUserInput; // UI fields only (title, description, url, oauth, iconPath)+};+Show 8 hidden lines
+/**+ * Parameters for updating an existing user-managed MCP server+ * Note: Only UI-editable fields are allowed (excludes server-managed fields)+ */+export type MCPServerUpdateParams = {+ config?: MCPServerUserInput; // UI fields only (title, description, url, oauth, iconPath)+};++/**+ * Response for MCP server list endpoint+ */+export type MCPServerDBObjectResponse = {+ _id?: string;+ mcp_id?: string;+ author?: string | null;Show 2 hidden lines
+ createdAt?: Date;+ updatedAt?: Date;+ effectivePermissions?: PermissionBits;+} & MCPOptions;++export type MCPServersListResponse = Record<string, MCPServerDBObjectResponse>;Adds the MCP server create/update parameter types and permission bits that the decoupled config API returns to clients.
AI-assisted changepackages/data-provider/src/keys.tssource danny-avila/librechat@ef1b7f0157+2−0
@@ -57,6 +57,8 @@ export enum QueryKeys { resourcePermissions = 'resourcePermissions', effectivePermissions = 'effectivePermissions', graphToken = 'graphToken',+ /* MCP Servers */+ mcpServers = 'mcpServers', } Show 1 hidden lines
// Dynamic query keys that require parametersFirst writer of the vulnerable response behavior: PR #10689 'refactor: Decouple MCP Config from Startup Config' (commits 1b0b27b30cc63a4c8b1ba65cc2146c7857008439 for the packages/api registry pieces and ef1b7f0157091f56ad1e6c4fd8133e4c191eed12 for api/server, both Atef Bellaaj <[email protected]>, 2025-11-26) introduced the GET /api/mcp/servers list endpoint; getMCPServersList at introduction returns res.json(serverConfigs) where serverConfigs = mcpServersRegistry.getAllServerConfigs(userId) '(YAML + DB)' - i.e. admin-managed YAML configs AND user DB configs, secrets included, with only requireJwtAuth and no redaction. Parent 98b188f26c5b61c60bc3e1f79f18dd0f00341c32 has no getMCPServersList and no '/servers' route in api/server/routes/mcp.js (grep count 0 for both route and controller) -> vulnerable behavior absent -> atomic introducer. The second affected endpoint GET /api/mcp/servers/:serverName (plus canAccessMCPServerResource VIEW middleware that lets non-owners read shared servers) was added by PR #10787 (1edec579a597073a20ae5bed1eec0dd985037707 / 99f8bd2ce, same contributor, 2025-12-04), which likewise returned parsedConfig raw without redaction - same missing-redaction flaw carried forward. The introducer commit's own message documents AI-assisted development: bullet 'Chore: Work on AI Review and Copilot Comments' with '- copilot comments addressed' and 'added unit tests for route /api/mcp/servers'.
AI-assisted changepackages/data-provider/src/data-service.tssource danny-avila/librechat@ef1b7f0157+13−0
@@ -6,6 +6,7 @@ import * as ag from './types/agents'; import * as m from './types/mutations'; import * as q from './types/queries'; import * as f from './types/files';Show 13 hidden lines
+import * as mcp from './types/mcpServers'; import * as config from './config'; import request from './request'; import * as s from './schemas';@@ -538,6 +539,18 @@ export const deleteAgentAction = async ({ }), ); +/**+ * MCP Servers+ */++/**+ *+ * Ensure and List loaded mcp server configs from the cache Enriched with effective permissions.+ */+export const getMCPServers = async (): Promise<mcp.MCPServersListResponse> => {+ return request.get(endpoints.mcp.servers);+};+Show 3 hidden lines
/** * Imports a conversations file. *Adds the getMCPServers data-service call that fetches cached MCP server configs with effective permissions.
Security fix
Fixpackages/api/src/mcp/utils.tssource danny-avila/librechat@fa9e1b228a+60−0
@@ -1,6 +1,66 @@ import { Constants } from 'librechat-data-provider';+import type { ParsedServerConfig } from '~/mcp/types'; export const mcpToolPattern = new RegExp(`^.+${Constants.mcp_delimiter}.+$`);++/**+ * Allowlist-based sanitization for API responses. Only explicitly listed fields are included;+ * new fields added to ParsedServerConfig are excluded by default until allowlisted here.+ *+ * URLs are returned as-is: DB-stored configs reject ${VAR} patterns at validation time+ * (MCPServerUserInputSchema), and YAML configs are admin-managed. Env variable resolution+ * is handled at the schema/input boundary, not the output boundary.+ */+export function redactServerSecrets(config: ParsedServerConfig): Partial<ParsedServerConfig> {+ const safe: Partial<ParsedServerConfig> = {+ type: config.type,+ url: config.url,+ title: config.title,Show 28 hidden lines
+ description: config.description,+ iconPath: config.iconPath,+ chatMenu: config.chatMenu,+ requiresOAuth: config.requiresOAuth,+ capabilities: config.capabilities,+ tools: config.tools,+ toolFunctions: config.toolFunctions,+ initDuration: config.initDuration,+ updatedAt: config.updatedAt,+ dbId: config.dbId,+ consumeOnly: config.consumeOnly,+ inspectionFailed: config.inspectionFailed,+ customUserVars: config.customUserVars,+ serverInstructions: config.serverInstructions,+ };++ if (config.apiKey) {+ safe.apiKey = {+ source: config.apiKey.source,+ authorization_type: config.apiKey.authorization_type,+ ...(config.apiKey.custom_header && { custom_header: config.apiKey.custom_header }),+ };+ }++ if (config.oauth) {+ const { client_secret: _secret, ...safeOAuth } = config.oauth;+ safe.oauth = safeOAuth;+ }++ return Object.fromEntries(+ Object.entries(safe).filter(([, v]) => v !== undefined),+ ) as Partial<ParsedServerConfig>;+}++/** Applies allowlist-based sanitization to a map of server configs. */+export function redactAllServerSecrets(+ configs: Record<string, ParsedServerConfig>,+): Record<string, Partial<ParsedServerConfig>> {+ const result: Record<string, Partial<ParsedServerConfig>> = {};+ for (const [key, config] of Object.entries(configs)) {+ result[key] = redactServerSecrets(config);+ }Show 6 hidden lines
+ return result;+}+ /** * Normalizes a server name to match the pattern ^[a-zA-Z0-9_.-]+$ * This is required for Azure OpenAI models with Tool CallingAdds allowlist-based redactServerSecrets(), which includes only explicitly listed fields in MCP server API responses.
Fixpackages/api/src/mcp/oauth/handler.tssource danny-avila/librechat@fa9e1b228a+26−6
@@ -24,6 +24,7 @@ import { selectRegistrationAuthMethod, inferClientAuthMethod, } from './methods';+import { isSSRFTarget, resolveHostnameSSRF } from '~/auth'; import { sanitizeUrlForLogging } from '~/mcp/utils'; /** Type for the OAuth metadata from the SDK */Show 82 hidden lines
@@ -144,7 +145,9 @@ export class MCPOAuthHandler { resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, {}, fetchFn); if (resourceMetadata?.authorization_servers?.length) {- authServerUrl = new URL(resourceMetadata.authorization_servers[0]);+ const discoveredAuthServer = resourceMetadata.authorization_servers[0];+ await this.validateOAuthUrl(discoveredAuthServer, 'authorization_server');+ authServerUrl = new URL(discoveredAuthServer); logger.debug( `[MCPOAuth] Found authorization server from resource metadata: ${authServerUrl}`, );@@ -200,6 +203,19 @@ export class MCPOAuthHandler { logger.debug(`[MCPOAuth] OAuth metadata discovered successfully`); const metadata = await OAuthMetadataSchema.parseAsync(rawMetadata); + const endpointChecks: Promise<void>[] = [];+ if (metadata.registration_endpoint) {+ endpointChecks.push(+ this.validateOAuthUrl(metadata.registration_endpoint, 'registration_endpoint'),+ );+ }+ if (metadata.token_endpoint) {+ endpointChecks.push(this.validateOAuthUrl(metadata.token_endpoint, 'token_endpoint'));+ }+ if (endpointChecks.length > 0) {+ await Promise.all(endpointChecks);+ }+ logger.debug(`[MCPOAuth] OAuth metadata parsed successfully`); return { metadata: metadata as unknown as OAuthMetadata,@@ -355,10 +371,14 @@ export class MCPOAuthHandler { logger.debug(`[MCPOAuth] Generated flowId: ${flowId}, state: ${state}`); try {- // Check if we have pre-configured OAuth settings if (config?.authorization_url && config?.token_url && config?.client_id) { logger.debug(`[MCPOAuth] Using pre-configured OAuth settings for ${serverName}`); + await Promise.all([+ this.validateOAuthUrl(config.authorization_url, 'authorization_url'),+ this.validateOAuthUrl(config.token_url, 'token_url'),+ ]);+ const skipCodeChallengeCheck = config?.skip_code_challenge_check === true || process.env.MCP_SKIP_CODE_CHALLENGE_CHECK === 'true';@@ -410,10 +430,11 @@ export class MCPOAuthHandler { code_challenge_methods_supported: codeChallengeMethodsSupported, }; logger.debug(`[MCPOAuth] metadata for "${serverName}": ${JSON.stringify(metadata)}`);+ const redirectUri = this.getDefaultRedirectUri(serverName); const clientInfo: OAuthClientInformation = { client_id: config.client_id, client_secret: config.client_secret,- redirect_uris: [config.redirect_uri || this.getDefaultRedirectUri(serverName)],+ redirect_uris: [redirectUri], scope: config.scope, token_endpoint_auth_method: tokenEndpointAuthMethod, };@@ -422,7 +443,7 @@ export class MCPOAuthHandler { const { authorizationUrl, codeVerifier } = await startAuthorization(serverUrl, { metadata: metadata as unknown as SDKOAuthMetadata, clientInformation: clientInfo,- redirectUrl: clientInfo.redirect_uris?.[0] || this.getDefaultRedirectUri(serverName),+ redirectUrl: redirectUri, scope: config.scope, }); @@ -462,8 +483,7 @@ export class MCPOAuthHandler { `[MCPOAuth] OAuth metadata discovered, auth server URL: ${sanitizeUrlForLogging(authServerUrl)}`, ); - /** Dynamic client registration based on the discovered metadata */- const redirectUri = config?.redirect_uri || this.getDefaultRedirectUri(serverName);+ const redirectUri = this.getDefaultRedirectUri(serverName); logger.debug(`[MCPOAuth] Registering OAuth client with redirect URI: ${redirectUri}`); const clientInfo = await this.registerOAuthClient(@@ -672,6 +692,24 @@ export class MCPOAuthHandler { return randomBytes(32).toString('base64url'); }Validates discovered OAuth metadata URLs against SSRF checks before using the authorization, registration, and token endpoints.
Fixapi/server/routes/mcp.jssource danny-avila/librechat@fa9e1b228a+48−26
@@ -50,6 +50,18 @@ const router = Router(); const OAUTH_CSRF_COOKIE_PATH = '/api/mcp'; +const checkMCPUsePermissions = generateCheckAccess({+ permissionType: PermissionTypes.MCP_SERVERS,+ permissions: [Permissions.USE],+ getRoleByName,+});++const checkMCPCreate = generateCheckAccess({+ permissionType: PermissionTypes.MCP_SERVERS,+ permissions: [Permissions.USE, Permissions.CREATE],+ getRoleByName,+});Show 75 hidden lines
+ /** * Get all MCP tools available to the user * Returns only MCP tools, completely decoupled from regular LibreChat tools@@ -470,69 +482,75 @@ router.post('/oauth/cancel/:serverName', requireJwtAuth, async (req, res) => { * Reinitialize MCP server * This endpoint allows reinitializing a specific MCP server */-router.post('/:serverName/reinitialize', requireJwtAuth, setOAuthSession, async (req, res) => {- try {- const { serverName } = req.params;- const user = createSafeUser(req.user);+router.post(+ '/:serverName/reinitialize',+ requireJwtAuth,+ checkMCPUsePermissions,+ setOAuthSession,+ async (req, res) => {+ try {+ const { serverName } = req.params;+ const user = createSafeUser(req.user); - if (!user.id) {- return res.status(401).json({ error: 'User not authenticated' });- }+ if (!user.id) {+ return res.status(401).json({ error: 'User not authenticated' });+ } - logger.info(`[MCP Reinitialize] Reinitializing server: ${serverName}`);+ logger.info(`[MCP Reinitialize] Reinitializing server: ${serverName}`); - const mcpManager = getMCPManager();- const serverConfig = await getMCPServersRegistry().getServerConfig(serverName, user.id);- if (!serverConfig) {- return res.status(404).json({- error: `MCP server '${serverName}' not found in configuration`,- });- }+ const mcpManager = getMCPManager();+ const serverConfig = await getMCPServersRegistry().getServerConfig(serverName, user.id);+ if (!serverConfig) {+ return res.status(404).json({+ error: `MCP server '${serverName}' not found in configuration`,+ });+ } - await mcpManager.disconnectUserConnection(user.id, serverName);- logger.info(- `[MCP Reinitialize] Disconnected existing user connection for server: ${serverName}`,- );+ await mcpManager.disconnectUserConnection(user.id, serverName);+ logger.info(+ `[MCP Reinitialize] Disconnected existing user connection for server: ${serverName}`,+ ); - /** @type {Record<string, Record<string, string>> | undefined} */- let userMCPAuthMap;- if (serverConfig.customUserVars && typeof serverConfig.customUserVars === 'object') {- userMCPAuthMap = await getUserMCPAuthMap({- userId: user.id,- servers: [serverName],- findPluginAuthsByKeys,+ /** @type {Record<string, Record<string, string>> | undefined} */+ let userMCPAuthMap;+ if (serverConfig.customUserVars && typeof serverConfig.customUserVars === 'object') {+ userMCPAuthMap = await getUserMCPAuthMap({+ userId: user.id,+ servers: [serverName],+ findPluginAuthsByKeys,+ });+ }++ const result = await reinitMCPServer({+ user,Adds permission checks for MCP server use and create routes.
Patch fingerprints
AI-assisted change be70de63eec873e92c85d5dec197a8928f69efd6d37658308dda1e6c80cce4d6 · Fix 0eae7472f24c0307e50423f1f12a5904e575573c7119285e4dd9e981d9c83635