openresearch-mcp is a zero-auth MCP server. Strong controls around external data fetching and tool outputs are therefore a top priority — the tools fetch attacker-influenceable content and, in HTTP mode, expose a network service.

PyPI releases are immutable, so earlier versions remain installable and still contain the pre-hardening code. Pin accordingly.

Always install the latest:

uvx openresearch-mcp                 # always isolated, latest
pip install -U openresearch-mcp      # or upgrade in place

The project was reviewed and hardened using agent-security-skill, an OWASP-aligned AI agent security review skill developed by the maintainer.

This was not a generic checklist pass: findings were applied directly to openresearch-mcp and resulted in concrete code, dependency, workflow, and test changes. Each pass was cross-checked with an independent model to reduce single-reviewer blind spots.

• Before review: several high-impact AI-agent security gaps — SSRF exposure, raw external content returned to agents, and unbounded fetch/parsing paths.
• As of >= 0.1.7: no known CRITICAL or HIGH findings remain within the reviewed scope. Remaining items are defense-in-depth or operational controls.

Current version: v0.2.1 — the core SSRF/framing hardening (>= 0.1.7) is unchanged. The 0.2.x wave adds 13 new fixed-host, zero-auth tools; because their hosts are trusted and hardcoded (not attacker-controlled), they deliberately do not use safefetch — the SSRF threat model is unchanged. The wave had its own OWASP pass: no CRITICAL/HIGH, and the MEDIUM/LOW findings (unframed external error fields, log-newline injection, unencoded URL path segments) were fixed before release (see v0.2.0 below). v0.2.1 adds reliability hardening around flaky/rate-limited upstreams and broadens /health without turning it into a per-tool probe fanout.

Independent cross-model review across four passes (two reviewers, alternating), driving findings from CRITICAL to none:

v0.1.6 — core hardening

• safefetch.safe_get: scheme allowlist, resolved-IP validation, manual redirect re-validation, streaming byte cap
• format_untrusted() applied to every external-content tool
• /health TTL cache; default bind moved to 127.0.0.1
• GitHub Actions pinned to SHAs; ddgs / youtube-transcript-api capped to tested major

v0.1.7 — defense-in-depth

• Block IPv4-mapped addresses (::ffff:10.0.0.5) via explicit unwrap + recheck
• Block NAT64 well-known prefix (64:ff9b::/96)
• Post-connect peer-IP check fails closed when the socket cannot be introspected
• fastmcp>=3.4.2,<4, pypdf>=5.0,<6
• @pytest.mark.integration test against a real public URL to catch future _peer_ip() / urllib3 contract breaks

Full regression suite passing across Python 3.11–3.13, including SSRF (rebinding, redirect chains, round-robin DNS, metadata-endpoint access) and untrusted-content framing tests.

v0.1.9 — expansion infrastructure

• Shared fixed-host HTTP transport with one error contract (SourceError), hard timeouts, non-JSON handling, bounded cache, and per-source throttling hooks
• Identifier normalization for country/date/year/currency inputs used by the 0.2.0 tools
• get_current_date utility so agents can anchor relative requests without guessing
• CLI transport flags (--host, --port, --stdio) and CI/type-check hardening

v0.2.0 — zero-auth cross-domain expansion

• Added 13 zero-auth domain tools: weather forecast/history, World Bank indicator search/fetch, FX, crypto, GDELT news, Europe PMC, Bluesky user/profile/feed, SEC company financials, and SEC filing search
• Added live integration coverage across SEC, GDELT, Open-Meteo, Frankfurter, CoinGecko, World Bank, Europe PMC, Bluesky, and cross-domain chains
• Extended OWASP pass to new fixed-host tools: no CRITICAL/HIGH findings remained before release
• Fixed release-wave findings: external upstream error fields are not surfaced unframed, log newlines are scrubbed before server logging, and user-derived URL path segments are encoded

v0.2.1 — upstream reliability patch

• Added retry handling for transient fixed-host failures (429, 5xx, network failures, non-JSON throttle bodies) while keeping settled 4xx responses single-attempt
• Added GDELT → DuckDuckGo News fallback for search_news outages, with country/language filters for GDELT and explicit fallback labeling
• Improved read_url / read_pdf fetch success with a full browser User-Agent and SEC-specific contact User-Agent for sec.gov document reads
• Added World Bank retries / timeout bump and expanded lightweight /health sample to cover World Bank, Frankfurter, Europe PMC, and Bluesky

• RCE (LLM05 / ASI05): no eval/exec/subprocess/os.system — clean.
• Tool-loop iteration (ASI02): stateless single-shot tools; read_repo bounded (tree capped, ≤6 files). No agent loop.
• HITL / rogue agent (ASI09 / ASI10): no irreversible or privileged actions, no approval flow — N/A.

• Continue monitoring the urllib3 internals used in _peer_ip() (mitigated by the integration test).
• When exposing publicly (--host 0.0.0.0), always front the server with an authentication + rate-limiting gateway. The server is zero-auth by design.
• For the strongest SSRF posture, consider pinning the validated IP for the actual socket connection (custom resolver/adapter), eliminating the residual DNS-rebinding window entirely.

If you discover a security vulnerability, please use GitHub private vulnerability reporting if available, or contact the maintainer directly. Please do not open a public issue for undisclosed vulnerabilities. Security reports are treated with high priority.

Last updated: July 2026 · Version: v0.2.1

Security review methodology and tooling: agent-security-skill