Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
firecrawl/firecrawl-mcp-server
main @ 8c93c56
7
Fixes
0
CVEs
HIGH
Peak severity
85.7%
Coverage
Highlights
Auth Bypass: 5 prior fixes. Scrutinize any change in this area.
src/index.ts: most-fixed (5 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple bypasses in the core authentication flow: invalid credentials silently downgraded to keyless access, OAuth tokens without audience binding were accepted, and API key introspection was bypassed. These indicate the authentication logic has repeatedly failed to enforce strict validation.
Auth Bypass: Client-supplied spoofing of the legacy key-in-path transport marker could bypass authentication. The fix added an internal header to distinguish legitimate proxy traffic from client-forged requests.
Auth Bypass: Shared-secret confusion between the delegated credential signing secret and the keyless proxy secret could allow credential forgery. Separation of secrets is critical to prevent unauthorized delegation.