In scope
- Policy evaluation and default-deny behavior.
- Path, URL, argument, and secret canonicalization.
- MCP gateway framing, authorization, and audit integrity.
- Package provenance, release artifacts, and documented examples.
CirvixBreak Cirvix
Break the engine.
Stay inside the sandbox.
We want reproducible failures against the public local engine. This program is for the code and fixtures in the public repository, not for unrelated infrastructure, customer systems, or third-party MCP servers.
Out of scope
- Unrelated websites, GitHub, npm, PyPI, or cloud infrastructure.
- Production systems you do not own or have explicit authorization to test.
- Social engineering, spam, credential theft, or denial-of-service testing.
- Attempts to access proprietary control-plane systems.
Sandbox boundaries
Use a disposable local directory, synthetic credentials, loopback-only services, and bounded request rates. Do not send test payloads to external hosts. If a reproduction needs a network destination, use a local fixture and include the exact command to start it. Stop immediately if you encounter data that is not yours.
For a safe starting point, run npm run verify:adversarial and add a regression fixture under packages/agent-control/test/.
How to report
Email [email protected] with “Security research” in the subject, or use the contact in security.txt. Include the affected version, environment, exact reproduction steps, expected versus observed behavior, and whether the issue exposes data or changes state. Encrypt sensitive material before sending it; never include live credentials.
Severity and response
| Severity | Definition | Target response |
|---|---|---|
| Critical | Remote or local bypass that exposes real secret material or enables arbitrary tool execution outside policy. | Acknowledge within 1 business day; triage and mitigation plan as soon as reproducible. |
| High | Reliable policy bypass, audit-integrity failure, or cross-boundary authorization defect without a safe user action. | Acknowledge within 2 business days; regression test and remediation plan. |
| Medium | Limited bypass requiring unusual configuration, or a materially misleading security claim. | Acknowledge within 5 business days; fix or document a mitigation. |
| Low | Hardening, documentation, or low-impact correctness issue. | Acknowledge when triaged; fix on the normal maintenance cycle. |
We will acknowledge useful reports, keep the reporter informed while a fix is prepared, and credit researchers only with permission.
Want to see the boundary first?
Run the public Attack Lab, then reproduce the same sequence locally.