Graphify-Labs/graphify

At a glance

What to fix first

12 issues, most severe first. Each one points to the exact code, with the recommended fix and a prompt you can paste into your coding agent.

1. 1CriticalOAuth 2.1 + PKCE Correctness (MCP Authorization)Declared behavior
   mcp-server (MCP server) · ATR-M0005
   The server exposes a remote transport (streamable_http, graphify/serve.py serve_http/_build_http_app) but implements no OAuth 2.1 authorization flow of any kind -- only an optional static API-key / Bearer-token header check (_ApiKeyMiddleware, lines 2756-2794). There is no authorization-server metadata endpoint, no PKCE, no per-user token issuance. Per the MCP Authorization spec (2025-06-18), a remote MCP server is expected to use OAuth 2.1; static API-key auth with no OAuth layer is a documented gap, not grounds for NOT_APPLICABLE since the component has a genuine remote transport. The API key itself is also optional (serve_http defaults api_key=None), compounding the gap.

   Show more
   graphify/serve.py:2756–2770 ↗

   class _ApiKeyMiddleware:
       """Pure-ASGI API-key gate for the HTTP transport.
       ..."""
       def __init__(self, app, api_key: str) -> None:
           self.app = app
           self._expected = api_key.encode("utf-8")
   
       async def __call__(self, scope, receive, send) -> None:
           if scope["type"] != "http":
               await self.app(scope, receive, send)
               return
           import hmac
           headers = dict(scope.get("headers") or [])
           provided = headers.get(b"x-api-key")

   Show 1 more location

   graphify/serve.py:2896–2900 ↗

   ``api_key`` (or the ``GRAPHIFY_API_KEY`` env var) enables a simple header
   check (``Authorization: Bearer <key>`` or ``X-API-Key: <key>``). OAuth is a
   deliberate follow-up. Binding ``0.0.0.0`` exposes the server beyond
   localhost — set an api_key when you do.

   Recommended fix

   Implement MCP's OAuth 2.1 + PKCE authorization flow for the streamable_http transport, or clearly document the server as intended ONLY for trusted, network-isolated deployments and make the API key mandatory (not optional) whenever the transport is http.

   Create fix promptCopy finding JSON
2. 2HighDependency Risk & Supply Chain
   Repository-wide · ATR-C0007
   Trivy fs scan of uv.lock identified 2 CRITICAL and 14 HIGH known-CVE vulnerabilities in exactly-pinned dependencies, most severely pyjwt==2.13.0 (CVE-2026-102268 CRITICAL JWT authentication bypass via improper public-key validation, plus CVE-2026-102266/102267/102271/102272/102273 -- 5 more HIGH pyjwt auth-bypass/token-forgery bugs), anyio==4.13.0 (CVE-2026-63374 CRITICAL TLS cert spoofing), cryptography==49.0.0 (CVE-2026-69247 HIGH Bleichenbacher oracle), fsspec==2026.4.0 (CVE-2026-104851 HIGH RCE via crafted reference documents), pypdf==6.18.1 (3 HIGH DoS CVEs), soupsieve==2.8.3 (2 HIGH DoS CVEs), urllib3==2.7.0 (2 HIGH CVEs). All fixes are already published upstream (2.14.0/4.14.2/50.0.0/2026.6.0/6.19.0/2.8.4/2.8.0 respectively) but the lockfile still pins the vulnerable versions.

   Show more
   uv.lock:2225–2239 ↗

   name = "mcp"
   version = "1.29.0"
   source = { registry = "https://pypi.org/simple" }
   dependencies = [
       { name = "anyio" },
       { name = "httpx" },
       { name = "httpx-sse" },
       { name = "jsonschema" },
       { name = "pydantic" },
       { name = "pydantic-settings" },
       { name = "pyjwt", extra = ["crypto"] },
       { name = "python-multipart" },

   Show 2 more locations

   uv.lock:3299–3306 ↗

   name = "pyjwt"
   version = "2.13.0"
   source = { registry = "https://pypi.org/simple" }
   sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }

   uv.lock:3299–3300 ↗

   name = "pyjwt"
   version = "2.13.0"

   +28 more locations in the finding JSON

   Recommended fix

   Upgrade pinned versions: pyjwt>=2.14.0, anyio>=4.14.2, cryptography>=50.0.0, fsspec>=2026.6.0, pypdf>=6.19.0, soupsieve>=2.8.4, urllib3>=2.8.0, then re-run uv lock --upgrade-package <pkg> for each and re-scan with Trivy to confirm resolution. Consider adding exclude-newer dependency-cooldown guidance from the separate uv-missing-dependency-cooldown semgrep finding to reduce future typosquat/compromised-release exposure.

   Create fix promptCopy finding JSON
3. 3HighMissing or Inadequate Input Validation
   Repository-wide · ATR-C0008
   The MCP tool input schemas (query_graph, get_node, etc., graphify/serve.py:2155-2172) declare types but do not enforce strict validation: there are no length or pattern bounds on string fields such as question, and unknown/extra properties are not rejected (no additionalProperties:false enforcement). A caller-supplied question is forwarded unchanged into the query/tokenization and regex-processing pipeline (graphify/serve.py:2310-2323 through the token-budget cutting logic) with no size cap before that processing begins. The call_tool dispatcher's broad try/except only converts an exception into an error response after the unbounded work has started, so it does not prevent resource exhaustion from an oversized or adversarially crafted question.

   Show more
   graphify/serve.py:2155–2172 ↗

               types.Tool(
                   name="query_graph",
                   description="Search the knowledge graph using BFS or DFS. Returns relevant nodes and edges as text context.",
                   inputSchema={
                       "type": "object",
                       "properties": {
                           "question": {"type": "string", "description": "Natural language question or keyword search"},
                           "mode": {"type": "string", "enum": ["bfs", "dfs"], "default": "bfs",
                                    "description": "bfs=broad context, dfs=trace a specific path"},
                           "depth": {"type": "integer", "default": 3, "description": "Traversal depth (1-6)"},
                           "token_budget": {"type": "integer", "default": 2000, "description": "Max output tokens"},
                           "context_filter": {
                               "type": "array",
                               "items": {"type": "string"},
   …

   Show 2 more locations

   graphify/serve.py:2310–2323 ↗

       def _tool_query_graph(arguments: dict) -> str:
           import time as _time
           from graphify import querylog
           question = arguments["question"]
           mode = arguments.get("mode", "bfs")
           depth = min(int(arguments.get("depth", 3)), 6)
           budget = int(arguments.get("token_budget", 2000))
           context_filter = arguments.get("context_filter")
           _t0 = _time.perf_counter()
           result = _query_graph_text(
               G,
               question,
               mode=mode,
               depth=depth,

   graphify/serve.py:305–324 ↗

   def _query_terms(question: str) -> list[str]:
       """Split a query into searchable terms, segmenting Chinese text, then drop
       question/filler words (`_QUERY_STOPWORDS`, English plus common German/
       Romance-language fillers) so content words drive seeding. Falls back to the
       unfiltered terms if the query is all stopwords, so a question like "how does
       it work" or "wie funktioniert das" still seeds on something."""
       terms: list[str] = []
       for raw in question.split():
           if _has_chinese(raw):
               for seg in _segment_chinese(raw.lower().strip()):
                   seg = seg.strip()
                   if seg and _is_searchable(seg):
                       terms.append(seg)
           else:
   …

   +1 more location in the finding JSON

   Recommended fix

   Add explicit length/pattern bounds (e.g. maxLength) to the question and other free-text schema properties, reject unknown properties (additionalProperties:false or equivalent validation), and enforce a size cap on question before it reaches tokenization/regex processing in call_tool.

   Create fix promptCopy finding JSON
4. 4HighPath Traversal & Symlink Bypass (Filesystem Tools)
   Repository-wide · ATR-C0011
   graphify/serve.py does not import or call validate_graph_path for MCP tool graph loads. Every registered tool accepts a caller-supplied project_path argument; call_tool forwards it through _resolve_graph_path, which appends graphify-out/graph.json and resolves the path, and then through _load_ctx/_read_graph to Path.resolve()/read_text() with no base-directory containment check, authorization check, or symlink restriction. A caller can therefore supply an absolute project_path pointing at another project's graphify-out/graph.json and read its contents, including node labels, source paths, and attributes.

   Show more
   graphify/serve.py:2290–2306 ↗

           # Multi-project support: every tool accepts an optional project_path.
           # Injected here (rather than repeated in 11 literal schemas) so the set
           # stays in lockstep as tools are added. Omitting it keeps the historical
           # single-graph behaviour, so this is purely additive for existing callers.
           for _t in _tools:
               # The constructor accepts the camelCase alias in both majors, but
               # attribute access is inputSchema on mcp 1.x and input_schema on 2.x.
               _schema = getattr(_t, "inputSchema", None)
               if _schema is None:
                   _schema = _t.input_schema
               _schema.setdefault("properties", {})["project_path"] = {
                   "type": "string",
                   "description": (
                       "Absolute path to a project directory containing "
   …

   Show 2 more locations

   graphify/serve.py:2120–2127 ↗

       def _resolve_graph_path(project_path) -> str:
           """Map an optional project_path to a concrete graph.json path. ``None``
           keeps the server's default graph (backward-compatible); a project_path
           resolves to ``<project_path>/<GRAPHIFY_OUT>/graph.json``, honouring the
           GRAPHIFY_OUT override so worktree/shared-output setups keep working."""
           if not project_path:
               return _default_graph_path
           return str(Path(project_path) / _paths.GRAPHIFY_OUT / "graph.json")

   graphify/serve.py:44–55 ↗

   def _read_graph(graph_path: str) -> nx.Graph:
       """Load graph.json exactly as the MCP server does, raising on a bad path
       or file (ValueError, FileNotFoundError, json.JSONDecodeError) so a library
       caller such as the benchmark can handle it."""
       resolved = Path(graph_path).resolve()
       if resolved.suffix != ".json":
           raise ValueError(f"Graph path must be a .json file, got: {graph_path!r}")
       if not resolved.exists():
           raise FileNotFoundError(f"Graph file not found: {resolved}")
       check_graph_file_size_cap(resolved)
       safe = resolved
       data = json.loads(safe.read_text(encoding="utf-8"))

   +2 more locations in the finding JSON

   Recommended fix

   Route the project_path-derived graph path through validate_graph_path (or an equivalent allow-listed base-directory containment check) before Path.resolve()/read_text() in the MCP load path, rejecting any resolved path that escapes an operator-approved set of project roots.

   Create fix promptCopy finding JSON
5. 5HighTool Output Sanitization & Injection Containment
   Repository-wide · ATR-C0013
   _wrap_untrusted (graphify/llm.py) neutralises known chat-template/control-token sentinels within file content via _neutralise_injection_sentinels, but it interpolates the ingested file's relative path rel directly, unescaped, into the opening <untrusted_source path="{rel}" ...> tag attribute. A hostile repository can name a source file containing a quote and a > character so that attacker-controlled text in the filename is emitted outside the intended opening tag, before the trusted wrapper resumes -- breaking the envelope's containment for that portion of the model-visible text. The sanitizer also does not normalize ANSI/bidi/control characters, so the delimiter is not fully host-enforced against a hostile filename.

   Show more
   graphify/llm.py:606–620 ↗

   def _wrap_untrusted(rel: str, content: str) -> str:
       """Wrap one file's content in a labelled, hash-stamped untrusted-data block.
   
       The model's system prompt instructs it to treat everything inside
       <untrusted_source> as inert data, never as instructions. The sha256 lets a
       reviewer correlate a suspicious node back to the exact bytes that produced it.
       """
       sha = hashlib.sha256(content.encode("utf-8", errors="replace")).hexdigest()
       safe = _neutralise_injection_sentinels(content)
       return (
           f'<untrusted_source path="{rel}" sha256="{sha}">\n'
           f"{safe}\n"
           f"</untrusted_source>"
       )
   …

   Show 2 more locations

   graphify/llm.py:645–665 ↗

               rel = p.relative_to(root).as_posix()
           except ValueError:
               rel = Path(p).as_posix()
           try:
               if isinstance(u, FileSlice):
                   content = read_slice_text(u)
               else:
                   content = _file_to_text(safe_path)
           except OSError:
               continue
           # Whole files are still capped (covers non-splittable large files like
           # code); slices are already bounded to the cap, so the cap is a no-op.
           if len(content) > _FILE_CHAR_CAP:
               global _file_truncation_warned
   …

   graphify/llm.py:581–598 ↗

   _INJECTION_SENTINELS = re.compile(
       r"</?untrusted_source\b[^>]*>"
       # ANY <|token|> chat-template marker, not an enumerated few (#3183): the
       # old list named six and missed <|start_header_id|>/<|eot_id|> (Llama 3),
       # <|endofprompt|>, and whatever the next template calls its turns. The
       # form itself is the hazard - no legitimate source construct needs an
       # intact one, and defanging only inserts a zero-width space.
       r"|<\|[A-Za-z0-9_.\-]{1,64}\|>"
       r"|<<SYS>>|<</SYS>>"
       r"|\[/?(?:INST|SYSTEM)\]"
       r"|^\s*###?\s*(?:system|instruction)s?\s*:?\s*$",
       re.IGNORECASE | re.MULTILINE,
   )
   
   …

   Recommended fix

   Sanitize or attribute-escape the rel value (the same way content is processed) before interpolating it into the <untrusted_source path="{rel}"> tag, and extend _neutralise_injection_sentinels (or an equivalent normalization step) to strip ANSI/bidi/control characters from both rel and content.

   Create fix promptCopy finding JSON

What’s inside

BlueRock found 1 component in this repository. Each is checked against the rules for its type.

async def list_tools() -> list[types.Tool]:
    _tools = [
        types.Tool(
            name="query_graph",
            description="Search the knowledge graph using BFS or DFS. Returns relevant nodes and edges as text context.",
            inputSchema={
                "type": "object",
                "properties": {
                    "question": {"type": "string", "description": "Natural language question or keyword search"},
...

middleware = []
if api_key:
    middleware.append(Middleware(_ApiKeyMiddleware, api_key=api_key))

return Starlette(
    routes=[Route(path, endpoint=_MCPASGIApp(manager))],
    middleware=middleware,
    lifespan=lifespan,
)

    async def list_tools() -> list[types.Tool]:
        _tools = [
        types.Tool(name="query_graph", ...),
        types.Tool(name="get_node", ...),
        types.Tool(name="get_neighbors", ...),
        types.Tool(name="get_community", ...),
        types.Tool(name="god_nodes", ...),
        types.Tool(name="graph_stats", ...),
        types.Tool(name="shortest_path", ...),
        types.Tool(name="list_prs", ...),
        types.Tool(name="get_pr_impact", ...),
        types.Tool(name="triage_prs", ...),
                        "token_budget": {"type": "integer", "default": 2000, "description": "Max output tokens"},

types.Tool(
    name="query_graph",
    description="Search the knowledge graph using BFS or DFS. Returns relevant nodes and edges as text context.",

def sanitize_label(text: str | None) -> str:
    """Strip control characters and cap length.

    Safe for embedding in JSON data (inside <script> tags) and plain text.
    For direct HTML injection, wrap the result with html.escape().
    """
    if text is None:
        return ""
    text = _CONTROL_CHAR_RE.sub("", str(text))
    if len(text) > _MAX_LABEL_LEN:
        text = text[:_MAX_LABEL_LEN]
    return text

class _ApiKeyMiddleware:
    """Pure-ASGI API-key gate for the HTTP transport.
    ..."""
    Implemented as raw ASGI (not Starlette's BaseHTTPMiddleware) on purpose:
    BaseHTTPMiddleware buffers responses and breaks the Streamable HTTP SSE
    stream. This short-circuits with 401 before the request ever reaches the
    session manager, leaving the streaming path untouched for authorized calls.
    """

Repository-wide rules

Checked once for the whole repository: dependencies, secrets, inputs, networking, CI and more. 6 of 15 flagged.

    if branch and branch.startswith("-"):
        print(f"error: invalid branch name: {branch!r}", file=sys.stderr)
        sys.exit(1)
    ...
        cmd = ["git", "clone", "--depth", "1"]
        if branch:
            cmd += ["--branch", branch]
        cmd += ["--", git_url, str(dest)]
        result = _sp.run(cmd, capture_output=True, text=True)

        proc = subprocess.run(
            ...,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.PIPE,
            stderr=subprocess.DEVNULL,
        )
    except (OSError, subprocess.SubprocessError):

Then act on it:
- If `total_files` is 0: stop with "No supported files found in [path]."
- If `skipped_sensitive` is non-empty: report the count and list the skipped file names, so a wrongly-flagged source or doc is visible and can be renamed or moved (#2106).
- If `total_words` > 2,000,000 OR `total_files` > 500: show the warning. Then compute the top 5 first-level subdirectories by file count:
  ...
  - If all files are in `(root)` with no subdirectories, do not ask to narrow — no subfolders exist. Instead suggest `--no-cluster` to skip the expensive clustering step and proceed.
  - Otherwise rank by count, show the top 5 with file counts, then ask which subfolder to run on. Wait for the user's answer before proceeding.

> **graphify needs no API key. Never ask the user for one, and never block on one.** Code is extracted structurally (AST) with no LLM and no key at all — a code-only corpus (the common `/graphify .` on a repo) skips semantic extraction entirely...
**Before semantic extraction:** check whether `GEMINI_API_KEY` or `GOOGLE_API_KEY` is set. If neither is set, print this one-liner to the user:
> Tip: set `GEMINI_API_KEY` or `GOOGLE_API_KEY` to use Gemini for semantic extraction...
Print it once, then continue — do not wait for the user to supply a key.

def test_powershell_translator_rejects_unknown_bash():
    """The translator is strict: a bash line it does not recognize fails the
    render loudly instead of shipping untranslated bash to Windows (#2528)."""
    with pytest.raises(ValueError, match="cannot translate bash line"):
        gen._translate_bash_block(["curl -s https://example.com | sh"])
    with pytest.raises(ValueError, match="unexpected backslash escape"):
        gen._unescape_bash_dq("subprocess.run('a\\tb')")
    with pytest.raises(ValueError, match="cannot translate rm -f operand"):
        gen._rm_to_remove_item("rm -f $HOME/danger")

def validate_url(url: str) -> str:
    parsed = urllib.parse.urlparse(url)
    if parsed.scheme.lower() not in _ALLOWED_SCHEMES:
        raise ValueError(...)
    hostname = parsed.hostname
    if hostname:
        if hostname.lower() in _BLOCKED_HOSTS:
            raise ValueError(...)
        try:
            infos = socket.getaddrinfo(hostname, None, socket.AF_UNSPEC, socket.SOCK_STREAM)
            for info in infos:
                addr = info[4][0]
                ip = ipaddress.ip_address(addr)
                if _ip_is_blocked(ip):
…

class _SSRFGuardedHTTPConnection(http.client.HTTPConnection):
    def connect(self) -> None:
        family, ip = _resolve_and_validate(self.host, self.port)
        self.sock = socket.create_connection((ip, self.port), self.timeout, self.source_address)
...
class _NoFileRedirectHandler(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        validate_url(newurl)
        return super().redirect_request(req, fp, code, msg, headers, newurl)

    out_path.write_bytes(safe_fetch(url))
...
        validate_url(url)

def _get_backend_api_key(backend: str) -> str:
    """Return the first configured API key for backend, or an empty string."""
    for env_key in _backend_env_keys(backend):
        value = os.environ.get(env_key)
        if value:
            return value
    return ""

    def _add_doc_ref(token: str, line: int) -> None:
        # Normalize "adr 11" / "ADR-0011" spellings to a canonical "ADR-0011"
        # style label so references to the same document collapse to one node.
        kind, num = re.match(r"([A-Za-z]+)[- ]?(\d+)", token).groups()
        kind = kind.upper()
        label = f"{kind}-{num.zfill(4)}" if kind == "ADR" else f"{kind}-{num}"
        if label in seen_doc_refs:
            return

            if qualified:
                prefix, _, ref_token = [REDACTED](".")
            else:
                prefix = ""
                ref_token = base_type
            if ref_token:
                tgt_nid = _make_id(ref_token)
                if tgt_nid and tgt_nid not in seen_ids:
                    seen_ids.add(tgt_nid)
                    nodes.append({
                        "id": tgt_nid,
                        "label": ref_token,
                        "file_type": "code",
                        "source_file": "",
…

    text = path.read_text(encoding="utf-8")
    data = yaml.safe_load(text)

# pull_request_target is used so the token can label/comment on PRs from forks;
# neither job checks out or executes PR code, so this is safe.

on:
  pull_request_target:
...

permissions:
  pull-requests: write
            ...
            await github.rest.issues.addLabels({...});

      - uses: actions/github-script@v7
        with:
          script: |
            const isPR = context.eventName === 'pull_request_target';
            const payload = isPR ? context.payload.pull_request : context.payload.issue;
            const author = payload.user.login;
            ...
            await github.rest.issues.createComment({...body});

      - uses: actions/setup-python@...
        with:
          python-version: ${{ matrix.python-version }}

def safe_fetch(url: str, max_bytes: int = _MAX_FETCH_BYTES, timeout: int = 30) -> bytes:
    ...
        chunks: list[bytes] = []
        total = 0
        while True:
            chunk = resp.read(65_536)
            if not chunk:
                break
            total += len(chunk)
            if total > max_bytes:
                raise OSError(
                    f"Response from {url!r} exceeds size limit "
                    f"({max_bytes // 1_048_576} MB). Aborting download."
                )
…

class _GraphContextCache:
    """Thread-safe graph contexts: one pinned default plus an LRU of projects."""
    def __init__(self, max_contexts: int):
        self._max_contexts = max_contexts
    ...
                while len(self._entries) > self._max_contexts:

    workers = max(1, min(max_concurrency, total))
    ...
        with ThreadPoolExecutor(max_workers=workers) as pool:

def _sanitize_metadata_string(value: object) -> str:
    """Return a control-character-free, HTML-escaped, bounded string."""
    text = _CONTROL_CHAR_RE.sub("", str(value))
    text = html.escape(text, quote=True)
    if len(text) > _METADATA_MAX_VALUE_LEN:
        text = text[:_METADATA_MAX_VALUE_LEN]
    return text

        max_concurrency = 1
    ...
    workers = max(1, min(max_concurrency, total))
    ...
        with ThreadPoolExecutor(max_workers=workers) as pool:

def _subgraph_to_text(G: nx.Graph, nodes: set[str], edges: list[tuple], token_budget: int = 2000, *, seeds: list[str] | None = None) -> str: