AGENTFORCE-MCP-18: MCP Tool Input Inserted Into REST Path Without Validation
🟡 Medium · Injection
Detects MCP server code that builds a REST API path (ServiceNow /api/now/..., Salesforce /services/data/..., other /api/ or /rest/ paths) from a tool argument with no encoding (encodeURIComponent / quote) and no format check (regex, enum, sys_id / Id pattern). A model-supplied value such as '../../sys_user' or 'x?sysparm_query=...' changes which endpoint or records the call reaches.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-MCP-18 |
| Severity | Medium |
| Category | Injection |
| Compliance | EU_AI_ACT_HIGH_RISK, SOC2_CC7 |
Remediation
Validate path inputs before use (for ServiceNow sys_ids /^[0-9a-f]{32}$/, table names against an allowlist, Salesforce Ids /^[a-zA-Z0-9]{15,18}$/) in the tool schema (zod regex / enum, pydantic pattern) and encode each segment (encodeURIComponent / urllib.parse.quote(safe='')).