GHSA-63gr-g7jc-v8rg

# AgenticMail MCP HTTP authorization bypass ## Summary `@agenticmail/mcp` exposes a Streamable HTTP transport when started with `--http` or `MCP_HTTP=1`. In that mode, the `/mcp` endpoint accepts requests without any HTTP authentication layer. A remote client can initialize a session and call tools directly. The problem is that the MCP server also exposes tools documented as requiring `AGENTICMAIL_MASTER_KEY`, and the server process forwards those calls using its own configured master key. As a result, any client that can reach the MCP HTTP port can invoke master-only operations without knowing the master key. ## Impact An unauthenticated network client can invoke master-key-only MCP tools through the server, including administrative and gateway actions. Confirmed with a read-only tool: - `setup_guide` The same path reaches higher-impact tools such as: - `setup_email_relay` - `setup_email_domain` - `delete_agent` - `cleanup_agents` - `send_test_email` ## Affected Code - `packages/mcp/src/index.ts` - `packages/mcp/src/tools.ts` - `packages/mcp/README.md` Relevant observations: - `packages/mcp/src/index.ts` starts an HTTP server for `/mcp` without checking an Authorization header. - `packages/mcp/src/tools.ts` marks gateway/admin tools as master-key tools and forwards them with the server-side `AGENTICMAIL_MASTER_KEY`. - `packages/mcp/README.md` documents that gateway/admin tools require the master key. ## Reproduction Use the bundled one-command PoC runner: ```bash cd agenticmail ./scripts/run_agenticmail_mcp_http_unauth_poc.sh ``` Expected success output: ```text [+] received mcp-session-id without authentication: ... [+] tools/call(setup_guide) HTTP status: 200 [+] SUCCESS: unauthenticated HTTP client invoked MCP tool `setup_guide` ``` ## PoC Files - [scripts/run_agenticmail_mcp_http_unauth_poc.sh](scripts/run_agenticmail_mcp_http_unauth_poc.sh) - One-command wrapper that starts the API, starts MCP in HTTP mode, runs the client PoC,