open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

fix(llm-security): post-mcp-verify reads live PostToolUse tool_response field

Browse source 
The PostToolUse hook read input.tool_output, but live Claude Code delivers the tool result as tool_response — so the indirect-injection scan on MCP tool output silently never fired outside the test harness (which sent tool_output). The hook now reads tool_response with a tool_output fallback for older harnesses/fixtures. +3 tests covering string and object tool_response and the precedence. Found via a live-session check during the v7.8.3 sweep; not one of the 52 MEDIUM-tier findings. Suite 2016/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ
This commit is contained in:
Kjell Tore Guttormsen 2026-07-18 11:00:34 +02:00
commit 32199965f2
4 changed files with 54 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
CHANGELOG.md
View file

@ -55,6 +55,13 @@ MEDIUM on re-verification. 2013 tests, 0 fail.
`driver.version` now reflects the real plugin version; the pathguard matcher
and persistence-detection documentation were corrected; dangling `ROADMAP.md`
references removed.
- **MCP output-injection scan was inert in live sessions**
(`hooks/scripts/post-mcp-verify.mjs`). The hook read the PostToolUse
`tool_output` field, but live Claude Code delivers the tool result as
`tool_response`, so the indirect-injection scan on MCP output never ran
outside the test harness; it now reads `tool_response` and falls back to
`tool_output`. Found via a live-session check during the sweep, not part of
the MEDIUM-tier triage.
### Deferred (to v8)