exa-mcp-server
npm:exa-mcp-server@3.2.1
github.com/exa-labs/exa-mcp-server
Severity breakdown
Worst finding
Tool `web_search_advanced_exa` fetches external web content -- indirect-injection surface
· web_search_advanced_exa
Description: "Advanced search with filters, domains, dates, highlights, summaries, and subpage crawling" -- this tool pulls externally-controlled content into the agent's context window, the canonical indirect-injection vector. Even when the user supplies the URL, content at that URL can carry hostile instructions.
fix: Sandbox the fetched content: strip prompts before forwarding to the model, constrain to an allow-list of domains, and route through capframe-guard with a `domain in [...]` caveat.
All 1 finding
- mediumTool `web_search_advanced_exa` fetches external web content -- indirect-injection surface· web_search_advanced_exaindirect injection
Description: "Advanced search with filters, domains, dates, highlights, summaries, and subpage crawling" -- this tool pulls externally-controlled content into the agent's context window, the canonical indirect-injection vector. Even when the user supplies the URL, content at that URL can carry hostile instructions.
fix: Sandbox the fetched content: strip prompts before forwarding to the model, constrain to an allow-list of domains, and route through capframe-guard with a `domain in [...]` caveat.
How this was scored
Source registry — tool surface extracted from the package's README + manifest (R3/R5/R6/R7 fire; schema-dependent rules deferred). Findings are emitted by the public capframe.findings.v1 schema. Score = 100 − (10·Critical + 4·High + 2·Medium + 1·Low), clamped to [0, 100].
Disagree with a finding? Open an issue.