Security

This page is the short version for people using the tools. The threat model has the evidence and the scoring.

Use standard input and output

The stdio transport has no network listener. Prefer it.

xianyun-mcp mcp stream listens on 0.0.0.0 when you don’t pass --host, and has no authentication. The only protection is a check of the HTTP Host header, which a script can satisfy by sending Host: localhost. If you must use it, pass --host 127.0.0.1:

$ xianyun-mcp mcp stream --host 127.0.0.1 --port 8080

This was measured: with no --host, the process listened on 0.0.0.0:18099. The default comes from the brontes library underneath, so fixing it takes a wrapper or an upstream change. (TM-MCP-001)

Treat configuration as code

A Xianyun config can run commands on your machine. Lifecycle hooks run programs, and the config can come from places other than the file you wrote:

• extends: fragments fetched over HTTPS, with no pinning or signature check.
• A xianyun-project.yaml inside a repository you cloned for edit mode.
• A xianyun.yaml found by walking up from your working directory.

xianyun_up, xianyun_deploy, and xianyun_update run without a prompt and can trigger those hooks. Read the hooks in a config before your agent runs it, and be careful about letting an agent pull a repository whose project file you haven’t read. (TM-MCP-002, TM-CFG-001, TM-CFG-004)

Secrets in your environment

xianyun_config_print expands ${NAME} references from your whole process environment and prints the result to the agent. A config that references ${AWS_SECRET_ACCESS_KEY} in a field that gets printed puts that secret in the agent’s context. This was measured. (TM-CFG-003)

The confirmation prompt isn’t a boundary

See Confirmation and gated tools. It protects you from an agent that calls a destructive tool by mistake, as long as your client supports it. It doesn’t protect you from a client that skips the prompt.

Shared machines

Several files are created world-readable on a default umask, which matters on a machine other people log into. Measured on 2026-10-13:

• The kubeconfig backup ~/.kube/config.caproni.bak is mode 0644 although the kubeconfig is 0600.
• During a Kustomize build, the dev CA’s private key is staged in $TMPDIR as a 0644 file inside a 0755 directory. This path only runs when a Kustomize deployer does, which can’t happen yet.

Config discovery also keeps walking upward when you’re outside your home directory, so a xianyun.yaml planted in /tmp could be picked up if you run the tool from under it. That one wasn’t measured.

Reporting a problem

Add what you find to the threat model, with the command that shows it.