Garita MCP

Centinela de Autenticación

detect_missing_auth_risk

Analiza el código que arma el transporte HTTP/SSE de un servidor MCP (el endpoint que un cliente usa para hablarle por JSON-RPC — "/mcp", "/sse", "/messages") en busca de la ausencia de CUALQUIER verificación de autenticación antes de despachar la petición (CWE-306): sin login, sin llave de API, sin token, cualquiera que sepa la URL puede invocar las herramientas del servidor. Es distinto de validar el header Origin (detect_dns_rebinding_risk): ahí el problema es DE DÓNDE viene la petición; aquí es que no se verifica QUIÉN la hace, en absoluto. No es un caso aislado — es el patrón MÁS repetido entre los CVEs de MCP de 2026: CVE-2026-44895 (CVSS 9.1, crítico) en @yoda.digital/gitlab-mcp-server, donde el transporte SSE no verificaba autenticación en ningún code path y además respondía con "Access-Control-Allow-Origin: *", permitiendo a cualquier llamador no autenticado invocar las 86 herramientas de GitLab del servidor — incluido borrar repositorios — usando el token de acceso personal del operador; el mismo patrón (CWE-306) confirmado también en Azure MCP Server de Microsoft (CVE-2026-32211), deepseek-mcp-server (CVE-2026-55605), NetLicensing-MCP (CVE-2026-54446), obsidian-web-mcp (CVE-2026-54618) y mcp-documentation-server (CVE-2026-54504). Detecta además una regla propia de Garita: cuando además de faltar la autenticación el CORS está completamente abierto ("Access-Control-Allow-Origin: *" o un middleware cors() sin restringir origen), el riesgo es estrictamente peor — es exactamente la combinación que hizo explotable a CVE-2026-44895 desde cualquier página web. Es un análisis estático por patrones de texto (no ejecuta nada, no abre ningún puerto) — mismo enfoque que detect_dns_rebinding_risk y detect_command_injection_risk. Requiere una llave de acceso válida (usos gratis o créditos) — ver POST /crear-llave.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "codigo": "<codigo>"
    },
    "name": "detect_missing_auth_risk"
  }
}

Input Schema

Name	Required	Description	Default
`codigo`	Yes	El código que arma el transporte HTTP/SSE del servidor MCP (constructor de transporte o registro de la ruta), en texto plano.
`lenguaje`	No	Solo informativo (ej. "python", "javascript") — la detección ya cubre varios lenguajes a la vez, este campo no cambia el resultado.

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 10, 2026

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden well: it discloses that this is static text-pattern analysis, executes nothing and opens no ports, that it adds a proprietary rule for open CORS combined with missing auth, and that a valid access key/credits are required (pointing to POST /crear-llave). It does not say what the finding/response looks like (fields, severity), which is the main undisclosed behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and the sibling distinction are front-loaded, but the CVE enumeration (six product names, versions, CVSS scores, the 86-tools anecdote) consumes a large block of text that an agent does not need in order to select or call the tool. It is one oversized sentence chain rather than structured guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter static analyzer with no output schema, it covers what gets analyzed, the finding class, the tool's non-executing nature, and the auth prerequisite. The remaining gap is the shape/severity of the result, which an agent must infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters are documented there, including that lenguaje is 'solo informativo'. The description restates the codigo scope (transporte HTTP/SSE, endpoint '/mcp', '/sse', '/messages') without adding format or syntax guidance, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb (analiza) and resource (el código que arma el transporte HTTP/SSE del servidor MCP) and pins the exact defect class (ausencia total de verificación de autenticación antes de despachar, CWE-306). It explicitly separates itself from detect_dns_rebinding_risk (origen vs. identidad), so an agent can route without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit contrast condition with a named sibling ('distinto de validar el header Origin: ahí el problema es DE DÓNDE viene... aquí es que no se verifica QUIÉN') and states the input is transport-constructor/route-registration code. It stops short of stating when not to use it at all (e.g. stdio-based servers, where auth checks don't apply the same way), leaving a gap for a tool with 30+ risk siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Garita MCP tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?