feat: echo serverFingerprint on MCP fetch/replace to guard against tool drift @W-23608280 - #325
Open
Christian-Vallejos wants to merge 1 commit into
Conversation
…nst tool drift Add the optional `serverFingerprint` field to the ApiCatalog MCP types so the fetch → review → replace round-trip can carry the drift token: - McpServerFetchOutput.serverFingerprint — echoed by POST /fetch; an opaque hash of the server's current tool definitions. - McpServerAssetReplaceInput.serverFingerprint — round-tripped into PUT /assets so the server can verify the reviewed definitions haven't drifted (OUT_OF_SYNC). Keeping an already-active drifted tool active without it is rejected with a 409. replaceMcpServerAssets already forwards the whole input, so no client logic change is needed — only the contract types. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the optional
serverFingerprintfield to the ApiCatalog MCP types so thefetch → review → replace round-trip can carry the tool-drift token. This is the
library layer consumed by the
--server-fingerprintflag added tosf agent mcp asset replacein the companionsalesforcecli/plugin-agentPR.Background — the rug pull. An EXTERNAL MCP server can silently change the
description of an already-active tool after an admin approved it. The
description is exactly what the LLM reads, so this is a prompt-injection /
exfiltration vector. The Connect API already supported an optimistic-concurrency
serverFingerprintonPUT /assets, butPOST /fetchnever echoed it back — sothe client had no value to round-trip and the check was always skipped. This PR
closes the client-side contract gap.
What's included
McpServerFetchOutput.serverFingerprint— echoed byPOST /fetch; an opaquehash of the server's current tool definitions.
McpServerAssetReplaceInput.serverFingerprint— round-tripped intoPUT /assetsso the server verifies the reviewed definitions haven't drifted(status
OUT_OF_SYNC). Keeping an already-active drifted tool active without itis rejected with a
409.replaceMcpServerAssetsalready forwards the wholeinputobject, so no clientlogic change is needed — only the contract types.
Test plan
yarn build(compile + lint) — clean.tsc --noEmit— clean.test/apiCatalog.test.tssuite unaffected (the client passes the inputthrough verbatim; the new field is additive and optional).
🤖 Generated with Claude Code