Vulnerability disclosure
Report a problem in mcpprobe, and how we report problems in yours.
Two directions, one standard: private first, fixed before public, and nobody named while they are still exposed.
Last updated
Reporting a vulnerability in mcpprobe
Email security@mcpprobe.tech with the affected component (CLI, GitHub Action, hosted service or this website), the steps to reproduce, and what an attacker could do with it. A proof of concept helps; a working exploit against other customers does not, and is out of bounds.
What we commit to
- Acknowledge your report within 2 business days.
- Agree a fix timeline with you once we have reproduced the issue.
- Keep you informed until it is fixed, and credit you in the changelog if you want credit.
- Not pursue legal action for research that follows this page in good faith.
In scope
- The mcpprobe CLI and its published packages and container image
- The GitHub Action
- The hosted service and its API, using only an account you own
- This website, including the badge and status endpoints
Out of scope
- Denial of service, volumetric testing, or anything that degrades the service for others
- Accessing, changing or deleting data that is not yours
- Social engineering of anyone, and physical attacks
- Reports generated only by automated scanners, without a demonstrated impact
Vulnerabilities we find in other people's servers
Our public research runs only against open-source packages in a local sandbox we control, never against third-party hosts. When it finds a vulnerability in someone else's server:
- We report it privately to the maintainer within 72 hours.
- We give 90 days before any public mention, longer if a fix is in progress.
- We never name an unpatched server in aggregate reports.
- We request a CVE on the maintainer's behalf if they want one.
Customer scan results are never part of this research. They belong to the customer, and we do not publish or aggregate them under any name. How scans themselves are authorised is set out in the scanning policy.