FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Python: Model MCP and FastMCP server handler parameters as remote sources (#22702) by Tito0015 · Pull Request #22750 · github/codeql · GitHub

  1. github
  2. codeql

Repository navigation

Python: Model MCP and FastMCP server handler parameters as remote sources (#22702) - #22750

Open
Tito0015 wants to merge 1 commit into
github:mainfrom
Tito0015:feature/python-mcp-remote-sources
ConversationCommits (1)ChecksFindingsFiles changed
Open

Python: Model MCP and FastMCP server handler parameters as remote sources (#22702)#22750
Tito0015 wants to merge 1 commit into
github:mainfrom
Tito0015:feature/python-mcp-remote-sources

Conversation

Tito0015 commented Oct 4, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes #22702.

This PR adds QL framework modeling for Python MCP (Model Context Protocol) and fastmcp server handler parameters as RemoteFlowSources.

Why QL Modeling instead of Models-as-Data (YAML)

Existing open PR #22703 models MCP via Models-as-Data (MaD) YAML (ThreatModelSource of kind remote). However, several legacy Python security queries (such as py/nosql-injection, py/xml-bomb, and py/xxe) query RemoteFlowSource::Range directly and do not consume MaD sources. Additionally, MaD currently misses tool handlers wrapped behind stacked custom decorators.

Modeling via Mcp.qll extending RemoteFlowSource::Range resolves both gaps natively.

What is Modeled

  • @mcp.tool(), @mcp.prompt(), @mcp.resource() (called and bare forms) across FastMCP and MCPServer (MCP 2.x).
  • Standalone fastmcp @tool, @prompt, @resource, and fastmcp.tools.tool.
  • Function registration via add_tool(...).
  • def and async def functions, methods registered via @self.mcp.tool(), and stacked decorators (@other above @mcp.tool()).

Exclusions

  • Method receivers (self / cls).
  • Parameters type-annotated as Context (or Context | None / Optional[Context]).

Testing

  • Added unit tests under python/ql/test/library-tests/dataflow/remote-flow-sources/ covering sync/async, bare/called decorators, keyword-only args, stacked decorators, and negative exclusion cases.
  • All tests pass locally via codeql test run.

Tito0015 requested review from a team as code owners October 4, 2026 05:43
Alex-Hofer added a commit to Alex-Hofer/mcp-vulnbench that referenced this pull request Oct 4, 2026
docs: measure the model rows next to the QL class of github/codeql#22750
6a11840 


Both proposals for Python MCP sources on the 28 Python cases: the class detects 9, the rows 13, both 13. Records what each covers that the other does not, the method (derived image, checks) and the limits of the comparison.
Alex-Hofer mentioned this pull request Oct 4, 2026
Open
Tito0015 force-pushed the feature/python-mcp-remote-sources branch from 2771182 to ec38c23 Compare October 5, 2026 19:46

Tito0015 commented Oct 5, 2026

Copy link
Copy Markdown
Contributor Author

Hi @geoffw0 — hope you are well.

You reviewed and merged my earlier C++ MMIO PR (#22438); thank you again for that. When you have a moment, I would appreciate a look at this Python follow-up for #22702.

It models MCP / FastMCP server handler parameters as RemoteFlowSources in QL (Mcp.qll), mainly so queries that still take RemoteFlowSource directly (e.g. py/xxe, py/xml-bomb, py/nosql-injection) can see MCP tool/prompt/resource args, and so stacked custom decorators on handlers are covered via getADecorator() (similar to Flask routing).

There is already open MaD coverage in #22703; this PR is intentionally QL-only and complementary. Library tests are under python/ql/test/library-tests/dataflow/remote-flow-sources/ and pass locally with codeql test run.

No rush — happy to adjust based on team preference (QL vs MaD, scope, naming). Thanks for any pointers.

github-advanced-security Bot found potential problems Oct 6, 2026
View reviewed changes
Comment thread python/ql/lib/semmle/python/frameworks/Mcp.qll
*/

private import python
private import semmle.python.dataflow.new.DataFlow

geoffw0 commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Hi, this looks reasonable at a glance (though I was a little surprised to see QL-modelled sources rather than MaD models). In any case I've started the tests and am handing over to another member of the team.

Tito0015 force-pushed the feature/python-mcp-remote-sources branch from ec38c23 to c4f70d0 Compare October 6, 2026 19:40
Tito0015 force-pushed the feature/python-mcp-remote-sources branch from c4f70d0 to f188c3f Compare October 7, 2026 17:26

This branch has not been deployed

No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

documentation external-contribution Python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Python: model MCP server handler parameters (mcp, fastmcp) as remote sources

3 participants

Back | FazBrowse Home | New Git URL