v0.2.0 · live
CAPFRAME
← leaderboard/Hugging Face Hub MCP/tool · space_search
§ toolhttpHugging Face Hub MCP

space_search

on https://huggingface.co/mcp

Severity

critical0
high1
medium0
low0
info0

1 finding on this tool

  1. highexcessive agencyf-r4-space_search

    Tool `space_search` accepts an unbounded monetary / quota value

    The numeric parameter(s) `limit` have a money/quota-shaped name but no `maximum` constraint. An LLM tricked by indirect-injection can call the tool with arbitrarily large values.

    fix: Add a `maximum` (and ideally `minimum`) to each money/quota numeric, OR enforce the cap via a capframe-bind `--limit` caveat at the agent boundary.

    OWASP LLM08NIST MANAGE-2.2ATLAS T0051

About this tool

space_search is one of 8 tools exposed by Hugging Face Hub MCP. The server scored 78/100 overall against the capframe rule engine (source: http). Last scanned 2026-06-05.

The findings above are emitted by the public capframe.findings.v1 schema. Disagree with one? Open an issue.