open/llm-security
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

fix(llm-security): post-mcp-verify reads live PostToolUse tool_response field

Browse source 
The PostToolUse hook read input.tool_output, but live Claude Code delivers the tool result as tool_response — so the indirect-injection scan on MCP tool output silently never fired outside the test harness (which sent tool_output). The hook now reads tool_response with a tool_output fallback for older harnesses/fixtures. +3 tests covering string and object tool_response and the precedence. Found via a live-session check during the v7.8.3 sweep; not one of the 52 MEDIUM-tier findings. Suite 2016/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ
This commit is contained in:
Kjell Tore Guttormsen 2026-07-18 11:00:34 +02:00
commit 32199965f2
4 changed files with 54 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hooks/scripts/post-mcp-verify.mjs
View file

@ -186,7 +186,9 @@ try {
const toolName = input?.tool_name ?? '';
const toolInput = input?.tool_input ?? {};
const toolOutput = input?.tool_output ?? '';
// Live Claude Code PostToolUse sends the output as `tool_response`;
// `tool_output` is kept as fallback for older harnesses/fixtures.
const toolOutput = input?.tool_response ?? input?.tool_output ?? '';
const command = toolInput?.command ?? '';
// Convert tool_output to string if it isn't already (some hooks pass objects)