mlgym-deploy 2.3.6 → 2.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SECURITY-UPDATE-v2.4.0.md +104 -0
- package/index.js +464 -6267
- package/package.json +1 -1
- package/index-v2.js +0 -1062
- package/index-v3-explicit.js +0 -129
|
@@ -0,0 +1,104 @@
|
|
|
1
|
+
# Security Update: MLGym MCP Server v2.4.0
|
|
2
|
+
|
|
3
|
+
## Critical Security Fix
|
|
4
|
+
|
|
5
|
+
### Vulnerability Fixed
|
|
6
|
+
- **Email Enumeration Attack**: The previous `mlgym_auth_check` tool allowed attackers to check if email addresses exist in the system without authentication
|
|
7
|
+
- **Security Risk Level**: HIGH - Exposed user privacy and enabled targeted attacks
|
|
8
|
+
|
|
9
|
+
### Changes Made
|
|
10
|
+
|
|
11
|
+
#### Removed Insecure Tools
|
|
12
|
+
- ❌ **Removed `mlgym_auth_check`**: This tool revealed whether accounts exist
|
|
13
|
+
- ❌ **Removed `mlgym_user_create`**: Replaced with secure consolidated flow
|
|
14
|
+
|
|
15
|
+
#### Added Secure Authentication
|
|
16
|
+
- ✅ **New `mlgym_authenticate` tool**: Consolidated secure authentication that:
|
|
17
|
+
- Never reveals if an account exists without valid credentials
|
|
18
|
+
- Handles both login and account creation in one secure flow
|
|
19
|
+
- Returns generic error messages for failed authentication
|
|
20
|
+
- Automatically sets up SSH keys on successful auth
|
|
21
|
+
|
|
22
|
+
### Security Improvements
|
|
23
|
+
|
|
24
|
+
1. **No Email Enumeration**: Login failures return generic "Authentication failed. Invalid credentials." regardless of whether account exists
|
|
25
|
+
|
|
26
|
+
2. **Consolidated Flow**: Single tool handles both scenarios:
|
|
27
|
+
- Existing users: Login with email/password
|
|
28
|
+
- New users: Set `create_if_not_exists=true` with full_name and accept_terms
|
|
29
|
+
|
|
30
|
+
3. **Automatic SSH Setup**: SSH keys are automatically generated and registered on first login
|
|
31
|
+
|
|
32
|
+
### Migration Guide
|
|
33
|
+
|
|
34
|
+
#### Old Flow (INSECURE - DO NOT USE)
|
|
35
|
+
```javascript
|
|
36
|
+
// Step 1: Check if user exists (SECURITY VULNERABILITY!)
|
|
37
|
+
mlgym_auth_check({ email: "user@example.com" })
|
|
38
|
+
|
|
39
|
+
// Step 2: Create or login based on response
|
|
40
|
+
if (exists) {
|
|
41
|
+
mlgym_auth_login({ email, password })
|
|
42
|
+
} else {
|
|
43
|
+
mlgym_user_create({ email, name, password })
|
|
44
|
+
}
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
#### New Flow (SECURE)
|
|
48
|
+
```javascript
|
|
49
|
+
// For existing users
|
|
50
|
+
mlgym_authenticate({
|
|
51
|
+
email: "user@example.com",
|
|
52
|
+
password: "SecurePass123!"
|
|
53
|
+
})
|
|
54
|
+
|
|
55
|
+
// For new users
|
|
56
|
+
mlgym_authenticate({
|
|
57
|
+
email: "user@example.com",
|
|
58
|
+
password: "SecurePass123!",
|
|
59
|
+
create_if_not_exists: true,
|
|
60
|
+
full_name: "John Doe",
|
|
61
|
+
accept_terms: true
|
|
62
|
+
})
|
|
63
|
+
```
|
|
64
|
+
|
|
65
|
+
### Update Instructions
|
|
66
|
+
|
|
67
|
+
1. **Update the npm package**:
|
|
68
|
+
```bash
|
|
69
|
+
npm install -g mlgym-deploy@2.4.0
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
2. **Restart Cursor** to load the updated MCP server
|
|
73
|
+
|
|
74
|
+
3. **Update any scripts** that use the old tools
|
|
75
|
+
|
|
76
|
+
### Testing
|
|
77
|
+
|
|
78
|
+
The update includes comprehensive security tests to verify:
|
|
79
|
+
- Insecure tools are removed
|
|
80
|
+
- Authentication doesn't reveal account existence
|
|
81
|
+
- Generic error messages are returned
|
|
82
|
+
- SSH keys are properly configured
|
|
83
|
+
|
|
84
|
+
### Backward Compatibility
|
|
85
|
+
|
|
86
|
+
⚠️ **Breaking Changes**:
|
|
87
|
+
- `mlgym_auth_check` is completely removed
|
|
88
|
+
- `mlgym_user_create` is replaced by `mlgym_authenticate`
|
|
89
|
+
- `mlgym_auth_login` is replaced by `mlgym_authenticate`
|
|
90
|
+
|
|
91
|
+
All functionality is preserved through the new `mlgym_authenticate` tool with enhanced security.
|
|
92
|
+
|
|
93
|
+
### Support
|
|
94
|
+
|
|
95
|
+
If you encounter any issues with the update:
|
|
96
|
+
1. Check that you're using v2.4.0: `npm list -g mlgym-deploy`
|
|
97
|
+
2. Clear MCP cache: `rm ~/.mlgym/mcp_config.json`
|
|
98
|
+
3. Restart Cursor and try again
|
|
99
|
+
|
|
100
|
+
---
|
|
101
|
+
|
|
102
|
+
**Version**: 2.4.0
|
|
103
|
+
**Release Date**: October 30, 2025
|
|
104
|
+
**Security Advisory**: HIGH - All users should update immediately
|