Canary: credential-exfiltration probe against the remote MCP endpoint #962

New Issue

2026-07-28T02:55:55-05:00

jcwalker3 commented

2026-07-28 02:55:55 -05:00

Parent epic: #929.
Cross-link: #700, #955 (certification umbrella).
Depends on: #938, #957, #958, #959, #961.

Goal supported: secure isolation.

Problem

Every redaction and authorization control is asserted by unit tests written by the same author as the control. #700 is a live incident in which a session's final report asserted no credential leak while its own trace showed token material on a command line — self-assessment is demonstrably untrustworthy here. Nothing adversarially probes the assembled system.

Current evidence

#700 behavior class 5, verbatim: a false "no credential leaked" report contradicted by the session's own trace.
#938's redaction test spans logs, health output, tool results, and error messages, authored alongside the endpoint.

Scope

A repeatable adversarial canary attempting credential extraction through:

Malformed requests.
Oversized and malformed arguments.
Prompt-injection payloads in every free-text field reaching a tool.
Deliberately rejected operations.
Every error path.
Logs, traces, and health output.
Host process inspection.

Every attempt is asserted to fail and to be audited.

Non-goals

Penetration-testing Gitea itself.
Testing the local fleet.
Replacing unit-level redaction tests.

Security and concurrency boundaries

This canary runs against the deployed endpoint from outside the credential boundary. It must never be granted privileged access in order to pass.

Acceptance criteria

The canary runs as one command and produces a pass/fail report naming every probe.
Every probe fails to obtain credential material.
Every probe is present in the audit record.
A deliberately weakened build fails the canary, proving it can detect a real leak.
The canary is a required gate before unattended scheduling.

Required positive tests

A clean run against the hardened build.

Required negative and adversarial tests

The whole issue is adversarial by construction.
Plus a mutation-testing step that removes one redaction call and asserts the canary catches it.

Deployment and migration requirements

Runs against the deployed endpoint, not a mock.

Rollback and recovery requirements

Not applicable — the canary performs no mutation of durable state.

Observability and audit requirements

The report is retained as certification evidence.

Definition of done

Green against the deployed endpoint and proven capable of failing.

Parent epic: #929. Cross-link: #700, #955 (certification umbrella). Depends on: #938, #957, #958, #959, #961. **Goal supported:** secure isolation. ## Problem Every redaction and authorization control is asserted by unit tests written by the same author as the control. #700 is a live incident in which a session's final report asserted no credential leak while its own trace showed token material on a command line — self-assessment is demonstrably untrustworthy here. Nothing adversarially probes the assembled system. ## Current evidence - #700 behavior class 5, verbatim: a false "no credential leaked" report contradicted by the session's own trace. - #938's redaction test spans logs, health output, tool results, and error messages, authored alongside the endpoint. ## Scope A repeatable adversarial canary attempting credential extraction through: - Malformed requests. - Oversized and malformed arguments. - Prompt-injection payloads in every free-text field reaching a tool. - Deliberately rejected operations. - Every error path. - Logs, traces, and health output. - Host process inspection. Every attempt is asserted to fail and to be audited. ## Non-goals - Penetration-testing Gitea itself. - Testing the local fleet. - Replacing unit-level redaction tests. ## Security and concurrency boundaries This canary runs against the deployed endpoint from outside the credential boundary. It must never be granted privileged access in order to pass. ## Acceptance criteria - The canary runs as one command and produces a pass/fail report naming every probe. - Every probe fails to obtain credential material. - Every probe is present in the audit record. - A deliberately weakened build **fails** the canary, proving it can detect a real leak. - The canary is a required gate before unattended scheduling. ## Required positive tests - A clean run against the hardened build. ## Required negative and adversarial tests - The whole issue is adversarial by construction. - Plus a mutation-testing step that removes one redaction call and asserts the canary catches it. ## Deployment and migration requirements Runs against the deployed endpoint, not a mock. ## Rollback and recovery requirements Not applicable — the canary performs no mutation of durable state. ## Observability and audit requirements The report is retained as certification evidence. ## Definition of done Green against the deployed endpoint and proven capable of failing.