Security: Red Team Assessment — 16 findings (3 CRITICAL, 4 HIGH) with MCP integration

[alphaonedev]

Red Team Assessment — MCP Integration Security & Reliability

We performed a comprehensive red team assessment of the MCP integration in grok-cli while building ai-memory integration. Found 16 issues (3 CRITICAL, 4 HIGH, 5 MEDIUM, 4 LOW). We've fixed 10 of them in our fork and are reporting all findings upstream.

Fork with fixes: https://github.com/alphaonedev/grok-cli
Fix commit: a4d125d

---

CRITICAL (3)

RT-01: agent.cleanup() missing MCP disconnection

• src/agent/agent.ts line 809 — cleanup() doesn't close MCP connections. Server processes left as zombies.
• Fix: Add MCP disconnect to Promise.allSettled in cleanup.

RT-02: Telegram bridge agents never initialize MCP

• src/telegram/headless-bridge.ts line 67-101 — buildTelegramAgentFactory creates agents without MCP initialization. All MCP tools unavailable in Telegram sessions.
• Fix: Call connectMcp() after agent creation.

RT-03: SIGTERM exits without cleanup

• src/index.ts lines 37-41 — Signal handler calls process.exit(0) without cleanup. MCP processes left hanging.
• Note: Low real-world impact (OS kills child processes), but should be addressed for production.

HIGH (4)

RT-04: Exception/rejection handlers skip cleanup

• src/index.ts lines 43-51 — Same pattern as RT-03.

RT-05: MCP tool name collision allows built-in override

• src/agent/agent.ts — MCP tools merged via { ...baseTools, ...mcpTools }. A malicious MCP server could register "bash" and override the built-in shell tool.
• Fix: Validate MCP tool names against a reserved set before merging.

RT-06: MCP tool descriptions vulnerable to prompt injection

• src/mcp/runtime.ts line 63 — Tool descriptions from MCP servers injected unsanitized into system prompt context.
• Fix: Sanitize descriptions (strip injection patterns, cap length).

RT-07: Tags parameter type mismatch

• Specific to our memory integration, not upstream.

MEDIUM (5)

RT-08: AbortSignal type safety in tool execute calls
RT-09: Race condition — mcpConnecting promise never reset on error (should use finally block)
RT-10: No health check or reconnection if MCP process dies mid-session
RT-11: Child sub-agents don't inherit parent memory context
RT-12: Batch API path may lack memory context injection

LOW (4)

RT-13: No size validation on MCP tool schemas (DoS vector)
RT-14: Tool execution error messages from MCP unsanitized
RT-15: RESPONSES_SEARCH_MODEL hardcoded (acceptable by design)
RT-16: No validation that provider.tools.webSearch() exists before use

---

xAI API Alignment

We also verified full alignment with https://docs.x.ai/docs/guides/tools/overview:

• Tool declarations (web_search, x_search) — correct Responses API format via @ai-sdk/xai v3.0.67
• Model IDs, pricing, context windows — all match current xAI docs
• SDK tool conversion pipeline verified through source code trace

Recommendations

1. IMMEDIATE: Fix RT-01 and RT-02 (cleanup + telegram init)
2. HIGH: Add reserved tool name validation (RT-05) and description sanitization (RT-06) to src/mcp/runtime.ts
3. MEDIUM: Add MCP health check/reconnect and fix the mcpConnecting race condition

Happy to submit a PR with our fixes if desired.

[homanp]

@alphaonedev would be great if you could make a contribution here.