Security audit - 2026-05-01

Reviewer: discord-mcp implementer subagent (Plan 12 Phase E)
Scope: codebase as of commit 438b679 (branch feature/plan12-test-infra-polish)
Status: PASS with 1 P1 fixed in audit + 2 P2 deferred

The audit was performed before tagging v0.12.0 and pre-1.0 release. Findings are categorized:

P0 - must fix before release. Blocks Phase F.
P1 - should fix in Plan 12 Phase E.
P2 - defer to Plan 13+ with documented rationale.

A. Token redaction

grep -rn "DISCORD_TOKEN" packages/ returns 12 source files (excluding tests and config.ts). Each call site was reviewed:

packages/mcp-core/src/errors/client.ts:68 - references the env var name in an error message (“Set DISCORD_TOKEN env to a fresh token”). No value echo.
packages/mcp-server/src/cli.ts - references the env var name in --help.
packages/mcp-server/src/transports/stdio.ts:31,52-54 - passes the token value to discord.js Client / REST, never logs it.
packages/mcp-server/src/lib/checks/token-online.ts:65 - constructs Authorization: Bot <token> for the live /users/@me probe; no log.
packages/mcp-server/src/lib/checks/token-format.ts - reads process.env.DISCORD_TOKEN and asserts shape; never logs the value.
packages/mcp-server/src/commands/init.ts - emits the literal placeholder ${env:DISCORD_TOKEN} into generated client configs (intentional UX, no value).

grep for console.log|logger.*DISCORD_TOKEN and ${config.DISCORD_TOKEN} returns zero matches. No accidental token echo path identified.

Result: PASS. No findings.

B. Untrusted-wrap completeness

The wrapMessages / wrapUntrusted helpers (packages/mcp-core/src/tools/_lib/untrusted.ts) fence Discord-authored content inside <untrusted_*> markers so agents treat it as data. Plan 7 §3.10 enumerated 16 read-side tools that must wrap their text output.

Verified each tool calls wrapMessages or wrapUntrusted at least once:

Tool	Wrap calls	Status
`messages_get`	2	OK
`messages_list_pins`	2	OK
`messages_search_recent`	2	OK
`members_list`	2	OK
`members_get`	2	OK
`members_get_current_user`	2	OK
`automod_get_rule`	2	OK
`automod_list_rules`	2	OK
`events_get`	2	OK
`events_list`	2	OK
`stickers_get_guild_sticker`	2	OK
`webhooks_get_message`	2	OK
`interactions_get_followup`	2	OK
`interactions_get_original_response`	2	OK
`application_get_current`	2	OK
`application_modify_current`	2	OK
`onboarding_get`	2	OK
`users_get`	2	OK

Three additional tools surfaced by the broader grep were inspected:

users_get_current - returns the bot’s own /users/@me profile. The username field is operator-controlled, not attacker-influenced. Not in scope for the untrusted-wrap requirement.
members_search - renders user-authored username into the text field via a list (- $\{username\} (\user:${user_id}`)`). The structured payload is fine but the rendered Markdown is agent-visible. P2: consider wrapping the rendered list in Plan 13.
stickers_list_guild - text only contains a count and the guild ID; user-authored sticker names go to data only. Not in scope for the text-wrapping rule.

Result: PASS. P2 noted for members_search (Plan 13).

C. Confirmation gates

grep -rln "destructiveHint: true" packages/mcp-core/src/tools/ returned 27 tools. Each was checked for preconditions: ['confirm_required']:

Initial pass found 1 P1 finding:

reactions_delete_all - destructive (clears reactions, irreversible) but missing preconditions: ['confirm_required'].

Fixed in this audit commit (packages/mcp-core/src/tools/reactions/delete_all.ts): added the precondition + **DESTRUCTIVE - IRREVERSIBLE.** description prefix. Existing unit tests bypass the precondition by calling t.run() directly, so no test changes were needed.

The remaining 26 destructive tools all gate behind confirm_required:

webhooks/{delete,delete_message,delete_with_token}
users/leave_guild
stickers/delete_guild_sticker
stage_instances/delete
soundboard/delete_guild_sound
roles/delete
monetization/entitlements_delete_test
messages/{delete,bulk_delete}
members/{kick,bulk_ban,ban}
invites/delete
interactions/{delete_original_response,delete_followup}
guild/{delete_integration,begin_prune}
events/delete
emojis/delete
commands/{delete_guild,delete_global}
channels/delete
automod/delete_rule
app_emojis/delete

Result: PASS after fix. 1 P1 closed, 0 outstanding.

D. Audit redaction

audit/redact.ts enumerates exactly the 15 tools listed in Plan 8 Phase F:

messages_send, messages_edit, messages_bulk_delete
webhooks_execute, webhooks_edit_message
components_v2_send, components_v2_edit, components_v2_send_from_template
intelligence_summarize_channel, intelligence_classify_messages, intelligence_draft_response, intelligence_moderate_content, intelligence_extract_entities
interactions_create_response, interactions_edit_original_response

Both consumers of redactArgs(args, toolName) are wired:

middleware/audit.ts:56 - used for the JSONL args_redacted field.
middleware/telemetry.ts:110 - used as the mcp.args.redacted event attribute on every mcp.tool.* span.

The global sensitive-key set (token, bearer_token, auth, password, secret) is matched at any nesting depth, with case-insensitive key comparison. String values longer than 200 chars are truncated to 100 + ...[TRUNCATED].

Result: PASS. No findings.

E. OWASP top 10 spot checks

Category	Status	Notes
Injection	PASS	zod `safeParse` at every tool boundary (validateMiddleware).
Broken auth	PASS	Token never logged; never appears in span attrs / metric labels.
Sensitive data exposure	PASS	`redactArgs` covers per-tool + global sensitive keys.
XML external entities	N/A	No XML processing in the codebase.
Broken access control	DOCUMENTED	Agents inherit full bot permissions. Scope-based limiting deferred to Plan 13+.
Security misconfiguration	PASS	Defaults: `MCP_DRY_RUN=true`, `OTEL_ENABLED=false`.
XSS	N/A	stdio transport renders no HTML.
Deserialization	PASS	All inputs go through zod `safeParse` before handler runs.
Vulnerable deps	P2	`pnpm audit` reports 1 moderate: Astro `<6.1.6` XSS in `define:vars`. Site-only, doesn’t affect runtime mcp-core / mcp-server. Defer to Plan 13.
Logging gaps	PASS	Every mutating call goes through `audit.ts` middleware (Plan 8 Phase E).

Action items

Priority	Finding	Status
P0	-	None
P1	`reactions_delete_all` missing `confirm_required`	FIXED in this audit commit
P2	`members_search` text rendering of usernames	Deferred to Plan 13
P2	Astro 5.x `define:vars` XSS - site-only	Deferred to Plan 13 (bump to ≥6.1.6)

No P0 findings. Phase F (tag v0.12.0) may proceed.