Merge pull request #20 from decibri/development

fix: strict input schemas, security policy, SDK floor raise for 0.2.1

Author: rossarmstrong

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      npm-deps:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns: ["*"]

.github/workflows/ci.yml

@@ -47,9 +47,11 @@ jobs:
 
       - name: Install dependencies
         # npm ci, not npm install: a green run proves the locked tree works,
-        # not whatever npm resolved today. No --ignore-scripts, unlike
-        # publish.yml: publishing has no use for the native postinstall, but
-        # the smoke tests exercise the decibri binary, so it must run here.
+        # not whatever npm resolved today. Scripts stay enabled, unlike
+        # publish.yml: nothing in the tree declares an install script today
+        # (decibri ships prebuilt binaries as optional dependencies), so
+        # --ignore-scripts would change nothing, and the default keeps this
+        # job faithful to what a consumer's npm install actually does.
         run: npm ci
 
       - name: Diagnostic - raw device enumeration

CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-07-14
+
+### Changed
+
+- Every tool input schema now declares `additionalProperties: false` and an
+  explicit `required` array. The MCP SDK does not enforce the input schema
+  at the transport layer, so this does not change what the handlers accept;
+  it tells validating clients and schema-aware layers to reject arguments
+  the tool does not declare. No parameter is added, removed, or renamed,
+  and every existing valid call is unaffected.
+- Raised the declared floor for `@modelcontextprotocol/sdk` from `^1.0.0`
+  to `^1.25.2`, past the fixes for GHSA-w48q-cv73-mx4w (patched in 1.24.0)
+  and GHSA-8r9q-7v3j-jr4g (patched in 1.25.2). Neither advisory is
+  reachable in this server, which speaks stdio only and registers no
+  resource templates, but the declared range is the only version
+  constraint consumers get: npm does not ship a lockfile inside the
+  package, so the floor must not admit a vulnerable version. This
+  project's own resolution (1.29.0) is unchanged.
+
+### Added
+
+- `SECURITY.md`: a security policy covering responsible disclosure, what
+  the server accesses on the machine it runs on, why it runs natively
+  rather than in a container, and the supply chain posture of the
+  published package.
+- Dependabot configuration covering npm dependencies and GitHub Actions
+  workflow versions, on a weekly schedule.
+
 ## [0.2.0] - 2026-07-13
 
 ### Changed
@@ -112,7 +140,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   listing, WAV output validation, and error responses.
 - Tag-triggered npm publish workflow.
 
-[Unreleased]: https://github.com/decibri/mcp-listen/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/decibri/mcp-listen/compare/v0.2.1...HEAD
+[0.2.1]: https://github.com/decibri/mcp-listen/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/decibri/mcp-listen/compare/v0.1.3...v0.2.0
 [0.1.3]: https://github.com/decibri/mcp-listen/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/decibri/mcp-listen/compare/v0.1.1...v0.1.2

SECURITY.md

@@ -0,0 +1,124 @@
+# Security
+
+mcp-listen takes security seriously. It is an MCP server that captures audio from the user's microphone, can transcribe it locally, and can pass the transcribed text to a language model, so we are especially attentive to input validation, file handling, and what leaves the machine. If you believe you have found a security vulnerability in this repository, please report it as described below.
+
+## Responsible Disclosure
+
+We are strongly committed to the responsible disclosure of security vulnerabilities. Please follow these guidelines when reporting security issues:
+
+- Email **security@decibri.com** with "SECURITY - mcp-listen" in the subject line.
+- Alternatively, use GitHub's [private vulnerability reporting](https://github.com/decibri/mcp-listen/security/advisories/new) to report directly through GitHub.
+- Please do not report security vulnerabilities through public GitHub issues.
+
+When reporting, please include the following details where applicable:
+
+- A description of the vulnerability and how it can be exploited
+- The affected version of the package
+- The platform and architecture (e.g. Windows x64, macOS arm64, Linux x64, Linux arm64)
+- The MCP client in use, if relevant
+- Steps to reproduce the issue
+- Any other relevant information that could help us fix the vulnerability
+
+We review reports as quickly as possible and work with reporters to coordinate remediation and disclosure.
+
+## What mcp-listen Accesses
+
+Understanding what the server touches is useful context when assessing the impact of a report.
+
+mcp-listen:
+
+- Reads from audio input devices when a capture tool is invoked
+- Writes WAV files to the system temporary directory. `capture_audio` returns the recording's path to the caller; `voice_query` deletes its recording when the query completes.
+- Transcribes captured audio locally, in process, using whisper.cpp. Audio never leaves the machine.
+- Sends transcribed text to the local Ollama daemon at `127.0.0.1:11434` when `voice_query` is used. This is the only network call in the codebase. An Ollama daemon configured with cloud models will relay that text off the machine; that relay is a property of the user's Ollama configuration, not of mcp-listen, but it is worth knowing when assessing where text can travel.
+- Reads the `WHISPER_MODEL_PATH` environment variable to locate the local Whisper model. It reads no API credentials: none are used. The bundled Ollama client library can read `OLLAMA_API_KEY`, but it attaches that credential only to requests to `ollama.com`, and mcp-listen only ever calls the local daemon, so that code path is unreachable.
+
+It does not collect telemetry or phone home. It runs with the privileges of the user who starts it.
+
+## Why mcp-listen Runs Natively
+
+mcp-listen does not ship a container image. This is a considered position, not an omission.
+
+The server's purpose is to capture audio from the host machine's microphone, and containerisation is not a meaningful boundary for that job:
+
+- On macOS and Windows, a container cannot reach the host microphone in any standard configuration: Linux containers run inside a virtual machine with no route to the host's audio hardware, and Windows-native containers have no audio capture support.
+- On Linux, a container can reach the microphone only by passing the audio device or the sound-server socket through the container boundary, which reopens exactly the boundary the container was supposed to provide.
+- Containerisation adds no consent layer either. Where the operating system has microphone consent controls (the per-app prompt on macOS, the desktop-app microphone privacy setting on Windows), they govern native processes; a containerised capture path would sit outside those controls, not strengthen them.
+
+The runtime posture is the mitigation instead: the server speaks only stdio to the client that spawned it, opens no listening sockets, makes no network calls other than to the local Ollama daemon, executes no code at install time, and runs as the user who started it.
+
+## Supply Chain and Package Integrity
+
+mcp-listen is published to npm as a single JavaScript package. It ships no binaries of its own; the native audio layer comes from the `decibri` dependency, which has its own security policy.
+
+### Build integrity
+
+- The package is published exclusively from GitHub Actions on GitHub-hosted runners. Nothing is published manually.
+- Publishing is triggered only by tagged releases and is gated behind a protected GitHub environment requiring manual approval, restricted to `v*` tags.
+- A pre-publish verification gate asserts that every file the package ships is present in the tarball and fails the release if any credential, publisher binary, or test fixture is present.
+- The full build and release configuration is open source and auditable in `.github/workflows/publish.yml`.
+
+### Publishing and authentication
+
+- npm publishing uses Trusted Publishing via OIDC. No long-lived npm tokens are stored in the repository or CI system. Each publish uses a short-lived, workflow-specific credential issued by npm.
+- The package declares no install or post-install scripts, and neither does any package in its dependency tree. Installing mcp-listen executes no code on the consumer's machine.
+
+### Provenance and attestation
+
+- Every release publishes with npm provenance attestation, cryptographically linking the published version to the exact source commit and build workflow.
+- Provenance attestations are recorded in the public Sigstore transparency log and can be verified with `npm audit signatures`.
+
+### Dependency monitoring
+
+- Dependencies are continuously monitored by Dependabot for security advisories and version updates.
+- Every pull request and every push to `main` runs the test suite on Linux, macOS, and Windows across Node.js 18, 20, and 22.
+
+## Supported Versions
+
+This security policy applies to the following versions:
+
+| Version | Supported |
+| --- | --- |
+| 0.2.x | Yes |
+| < 0.2 | No |
+
+Security fixes are applied to the latest release only. mcp-listen is pre-1.0 and older versions are not backported. Upgrade to the latest release.
+
+## Scope
+
+**In scope:**
+
+- The mcp-listen server itself: tool input handling, file handling, and the audio capture path
+- The published npm package and its release process
+- Anything that allows an untrusted MCP client to cause mcp-listen to act outside its intended behaviour
+
+**Out of scope:**
+
+- Vulnerabilities in dependencies. Report those to the dependency's maintainers. If a dependency vulnerability is exploitable *through* mcp-listen in a way specific to how mcp-listen uses it, that is in scope and we want to hear about it.
+- The behaviour of the language model or MCP client that invokes mcp-listen
+- Issues requiring an attacker to already have local access to the machine, since mcp-listen runs with the privileges of the user who starts it
+
+## CVE Policy
+
+For confirmed vulnerabilities, we will request a CVE identifier where appropriate and publish a GitHub Security Advisory with details of the issue, affected versions, and remediation steps. Security advisories are visible at the [mcp-listen security advisories page](https://github.com/decibri/mcp-listen/security/advisories).
+
+## Security Best Practices for Users
+
+- Keep your dependencies up to date regularly
+- Only install mcp-listen from the official npm registry
+- Verify provenance attestations on installed packages with `npm audit signatures`
+- Run `npm audit` regularly to check for known vulnerabilities in your dependency tree
+- Be aware that `voice_query` sends transcribed text to the local Ollama daemon, and that a daemon configured with cloud models will relay that text off the machine
+- Grant microphone access following the principle of least privilege
+
+## Reporting Concerns About This Policy
+
+If you have questions about this security policy itself, or suggestions for improvement, please open a regular issue on the repository. These are not security vulnerability reports and do not require private disclosure.
+
+## Acknowledgments
+
+Thank you to the researchers and community members who help keep mcp-listen users secure. If you report a valid vulnerability and would like public acknowledgment, we will credit you in the security advisory and release notes.
+
+## Contact
+
+For security questions, email **security@decibri.com** with "SECURITY - mcp-listen" in the subject line.

index.js

@@ -12,6 +12,11 @@ const { chat } = require('./lib/llm');
 
 // ── Server ─────────��───────────────────────��────────────────
 
+// Tools only: no resources or resource templates are registered, and that
+// is load-bearing. The SDK's resources/read path has carried a ReDoS
+// advisory (GHSA-8r9q-7v3j-jr4g, patched in 1.25.2) that this server does
+// not reach only because it registers no resources. Anyone adding a
+// resource here must first confirm the SDK floor is current.
 const server = new Server(
   { name: 'mcp-listen', version },
   { capabilities: { tools: {} } }
@@ -24,7 +29,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     {
       name: 'list_audio_devices',
       description: 'List available audio input devices (microphones) on this machine. Each device has a numeric index, a human-readable name, and a stable id. Prefer the id when selecting a device: indexes can shift when devices are added or removed, and names are not unique.',
-      inputSchema: { type: 'object', properties: {} }
+      inputSchema: { type: 'object', properties: {}, required: [], additionalProperties: false }
     },
     {
       name: 'capture_audio',
@@ -40,7 +45,9 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
             type: ['number', 'string'],
             description: 'Device to record from: the numeric index or the stable string id, both reported by list_audio_devices. Prefer the id; indexes can shift when devices are added or removed. Omit for system default microphone.'
           }
-        }
+        },
+        required: [],
+        additionalProperties: false
       }
     },
     {
@@ -73,7 +80,9 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
             type: 'string',
             description: 'System prompt for the LLM (default: You are a helpful assistant.)'
           }
-        }
+        },
+        required: [],
+        additionalProperties: false
       }
     }
   ]

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-listen",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Give your AI agents the ability to listen. Microphone capture and speech-to-text tools for MCP-compatible agents.",
   "mcpName": "io.github.decibri/mcp-listen",
   "main": "index.js",
@@ -42,7 +42,7 @@
     "url": "https://github.com/decibri/mcp-listen/issues"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.25.2",
     "decibri": "^5.0.0"
   },
   "optionalDependencies": {
@@ -61,4 +61,4 @@
     "x64",
     "arm64"
   ]
-}
+}

package.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/decibri/mcp-listen",
     "source": "github"
   },
-  "version": "0.2.0",
+  "version": "0.2.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "mcp-listen",
-      "version": "0.2.0",
+      "version": "0.2.1",
       "transport": {
         "type": "stdio"
       }

server.json

@@ -123,15 +123,32 @@ async function run() {
     return;
   }
 
-  // Test 2: All 3 tools advertised
+  // Test 2: All 3 tools advertised, each with a strict input schema. The
+  // SDK does not enforce the input schema at the transport layer, so the
+  // schema is the only place undeclared arguments can be rejected, and only
+  // by a validating client or layer. That makes additionalProperties: false
+  // and an explicit required array part of the tool contract: every schema
+  // must declare both, even when required is empty.
   try {
     const res = await server.send('tools/list', {});
     const names = res.result.tools.map(t => t.name).sort();
     const expected = ['capture_audio', 'list_audio_devices', 'voice_query'];
     if (JSON.stringify(names) !== JSON.stringify(expected)) {
       throw new Error(`Expected tools ${expected}, got ${names}`);
     }
-    log('pass', 'All 3 tools advertised');
+    for (const tool of res.result.tools) {
+      const schema = tool.inputSchema;
+      if (!schema || schema.type !== 'object') {
+        throw new Error(`${tool.name}: inputSchema must be an object schema`);
+      }
+      if (schema.additionalProperties !== false) {
+        throw new Error(`${tool.name}: inputSchema must declare additionalProperties: false`);
+      }
+      if (!Array.isArray(schema.required)) {
+        throw new Error(`${tool.name}: inputSchema must declare an explicit required array`);
+      }
+    }
+    log('pass', 'All 3 tools advertised with strict input schemas');
     passed++;
   } catch (err) {
     log('fail', `All 3 tools advertised: ${err.message}`);