1. extensions/memory-core/src/memory/qmd-manager.test.ts, line 1052-1091 (link)

   Multi-collection override path not covered by tests

   The test uses a single paths entry, so it exercises only the single-collection branch (runQmdSearchViaMcporter directly). The multi-collection branch via runMcporterAcrossCollections — which also has the new explicitToolOverride param threaded through it — is not tested.

   While the code path looks correct from the diff alone, adding a second paths entry to this test (or a new dedicated test) would lock in the multi-collection flat-query behavior and protect against future regressions in runMcporterAcrossCollections.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: extensions/memory-core/src/memory/qmd-manager.test.ts
   Line: 1052-1091
   
   Comment:
   **Multi-collection override path not covered by tests**
   
   The test uses a single `paths` entry, so it exercises only the single-collection branch (`runQmdSearchViaMcporter` directly). The multi-collection branch via `runMcporterAcrossCollections` — which also has the new `explicitToolOverride` param threaded through it — is not tested.
   
   While the code path looks correct from the diff alone, adding a second paths entry to this test (or a new dedicated test) would lock in the multi-collection flat-query behavior and protect against future regressions in `runMcporterAcrossCollections`.
   
   How can I resolve this? If you propose a fix, please make it concise.

2. src/config/zod-schema.ts, line 1368 (link)

   searchTool accepts empty strings at the Zod validation layer

   searchTool: z.string().optional(),

   An empty-string value passes Zod validation and is only normalised to undefined later in resolveSearchTool. This is harmless at runtime, but the schema will silently accept memory.qmd.searchTool: "" without surfacing a validation error to the user. Consider aligning schema and resolution:

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: src/config/zod-schema.ts
   Line: 1368
   
   Comment:
   **`searchTool` accepts empty strings at the Zod validation layer**
   
   ```ts
   searchTool: z.string().optional(),
   ```
   
   An empty-string value passes Zod validation and is only normalised to `undefined` later in `resolveSearchTool`. This is harmless at runtime, but the schema will silently accept `memory.qmd.searchTool: ""` without surfacing a validation error to the user. Consider aligning schema and resolution:
   
   
   
   How can I resolve this? If you propose a fix, please make it concise.

1. 🟠 Arbitrary MCP tool invocation via configurable memory.qmd.searchTool override

Description

memory.qmd.searchTool allows a configuration-provided string to be used as the MCP tool name for mcporter calls, without an allowlist or capability check.

• Input: memory.qmd.searchTool (resolved by resolveSearchTool via trim() only)
• Sink: mcporter CLI invocation mcporter call <serverName>.<tool>
• Issue: Any tool exposed by the configured MCP server can be invoked during a normal “search” flow when searchTool is set. If an attacker can influence configuration (e.g., untrusted workspace settings, tenant-controlled config, env var injection), they can trigger unexpected tools with side effects (filesystem access, network exfiltration, admin actions) under the host’s privileges.

Vulnerable code:

const selector = `${params.mcporter.serverName}.${effectiveTool}`;
...
result = await this.runMcporter([
  "call",
  selector,
  "--args",
  JSON.stringify(callArgs),
  ...
]);

This is a form of unsafe capability exposure: the search API is expected to perform retrieval, but can be redirected to arbitrary server tools.

Recommendation

Constrain memory.qmd.searchTool to a safe allowlist of read-only search tools, and reject/ignore any other value.

Options:

1. Prefer an enum in schema/config (most robust):

​// e.g. only allow built-ins plus a vetted custom list
const AllowedSearchTools = ["query", "search", "vector_search", "deep_search", "hybrid_search"] as const;

searchTool: z.enum(AllowedSearchTools).optional();

2. Runtime allowlist check (if tools differ per server): fetch advertised tools from the MCP server and allow only those tagged/known as safe (read-only), otherwise fall back to the built-in mapping.

Also consider making searchTool admin-only (not user/workspace controllable) if this runs in a multi-tenant/SaaS context.

2. 🔵 Log/telemetry injection via unvalidated mcporter selector component (memory.qmd.searchTool)

Description

memory.qmd.searchTool is only trim()ed and then used to build the mcporter selector string. That selector is embedded into commandSummary (used in thrown error messages) without any neutralization.

• Input: searchTool from config (resolveSearchTool) can contain control characters (e.g., \n, \r, tabs) or other log-breaking bytes.
• Propagation: searchTool becomes part of selector = ${serverName}.${effectiveTool}``.
• Sink: selector becomes part of commandSummary via spawnInvocation.argv.join(" ") and is included in error messages thrown by runCliCommand.

This enables log forging / log injection if a malicious repository/workspace can influence the config value, potentially:

• creating fake log lines (newline injection),
• obscuring real errors,
• poisoning downstream telemetry/metrics that parse command summaries.

Vulnerable code:

const selector = `${params.mcporter.serverName}.${effectiveTool}`;
...
commandSummary: `${spawnInvocation.command} ${spawnInvocation.argv.join(" ")}`,

Recommendation

Validate and/or neutralize searchTool (and other selector components) before incorporating them into command summaries/logs.

Recommended defense-in-depth:

1. Constrain allowed tool names (best): allow only a safe character set and a reasonable length.
2. Escape control characters when building strings used for logs/errors.

Example (validation + escaping):

function validateToolName(tool: string): string {
  const trimmed = tool.trim();
  if (!/^[a-zA-Z0-9_\-]{1,64}$/.test(trimmed)) {
    throw new Error("Invalid searchTool; expected 1-64 chars of [a-zA-Z0-9_-]");
  }
  return trimmed;
}

function escapeForLog(s: string): string {
  return s.replace(/[\r\n\t]/g, (ch) => ({"\r":"\\r","\n":"\\n","\t":"\\t"}[ch]!));
}

const selector = `${serverName}.${validateToolName(tool)}`;
const commandSummary = `${cmd} ${argv.map(escapeForLog).join(" ")}`;