Skip to content

Security: corezoid/corezoid-ai-plugin

Security

SECURITY.md

Security

Supported versions

Version Security fixes
latest release / main Yes
older tags No — security fixes are released as new versions only; older tags are not patched in-place. Upgrade to the latest release.

Go is not required on supported prebuilt platforms (darwin/linux × amd64/arm64). It is only needed for developer workflows (COREZOID_MCP_DEV=1) or as a silent fallback when the prebuilt binary cannot be downloaded.

Credential storage model

All credentials and per-workspace config live in a single user-level file:

File Contents Scope
~/.corezoid/config.json version, folders[] (one entry per working directory). Each folder holds account_url, corezoid_url, workspace_id, stage_id, access_token, expires_at, api_login, api_secret, and cached project_id / git_url / git_stage_path. User — one file, keyed by absolute root_path; longest-prefix match against the cwd
~/.corezoid/api-keys/<slug>-<obj_id>.json Read-only archive of API keys the user has issued via create-api-key (unrelated to the auth used by this MCP server) User

Config file: written with permissions 0600; the ~/.corezoid/ directory is created with 0700. Nothing lives in the project tree — secrets (access_token, api_secret) never leave the user's home directory.
Plugin package: plugins/corezoid/.mcp.json ships without any credentials — tokens are never bundled in the marketplace package.
Environment fallback: when the matching folder entry leaves a field empty (or no entry matches the cwd), the server falls back to COREZOID_* variables for the same fields — including COREZOID_ACCESS_TOKEN, COREZOID_API_LOGIN, and COREZOID_API_SECRET (see README). Intended for CI/containers, where no interactive login is possible. Such values are read-only: they are never written back to ~/.corezoid/config.json, and they do not get the 0600 protection the config file has — keep them in your CI secret store, not in a committed file, and note that logout cannot unset them.
Concurrency: writes go through an in-process mutex + a cross-process flock on ~/.corezoid/config.json.lock, followed by an atomic temp-file + rename. Two MCP-server processes started from different IDE windows serialise cleanly.

What the MCP server sends over the network

  • OAuth2 flows go to account.corezoid.com (or the configured account_url).
  • All Corezoid API calls go to the corezoid_url of the current Folder in ~/.corezoid/config.json (default: https://api.corezoid.com).
  • TLS verification is enabled by default. It can be disabled with COREZOID_INSECURE_TLS=1 — only for on-premises installations with self-signed certificates.
  • Anonymous tool-call telemetry (tool name, duration ms, error type, API hostname) is sent to www.corezoid.com. Every event carries product: "corezoid" — the same ingest process is shared with simulator-ai-plugin, and that field keeps the two plugins' data distinguishable downstream. No tokens, workspace identifiers, or process content are included. Set COREZOID_ANALYTICS_DISABLED=1 to opt out entirely. After the first successful login, you are offered a one-time opt-in to include your email address in telemetry — this is voluntary and stored in ~/.corezoid/preferences.json. You can remove it at any time by deleting or editing that file.
  • User-initiated feedback (via the corezoid-feedback skill / send-feedback tool) is sent only after explicit user confirmation. All text fields are scanned for Bearer tokens, JWTs, API keys, passwords, and long hex secrets; any matches are replaced with [REDACTED] before transmission. Set COREZOID_FEEDBACK_DISABLED=1 to block feedback submission entirely.

MCP server binary distribution

On first start the MCP server launcher (run.sh) downloads a prebuilt binary from the GitHub Release that matches the version declared in plugin.json:

https://github.com/corezoid/corezoid-ai-plugin/releases/download/v{VERSION}/convctl-{os}-{arch}

The binary is cached in ~/.cache/corezoid-mcp/{VERSION}/. If the download fails (no network, unsupported platform, or checksum mismatch) the launcher falls back to go run . from source.

Checksum verification is automatic. run.sh downloads checksums.txt alongside the binary, computes the SHA256 digest, and only promotes the binary to the cache if the hashes match. A mismatched or missing checksum causes the download to be discarded silently.

To re-verify a cached binary manually:

curl -fsSL https://github.com/corezoid/corezoid-ai-plugin/releases/download/v{VERSION}/checksums.txt \
  | sha256sum --check --ignore-missing

Each GitHub Release includes a checksums.txt file generated by CI at build time.

What not to commit

  • access_token or OAuth2 refresh tokens of any kind
  • ~/.corezoid/config.json (and its .lock sidecar) — user-scope only, never in a repo
  • ~/.corezoid/api-keys/*.json — read-only archive of issued API keys
  • Workspace IDs or stage IDs tied to private environments
  • Exported process files (.conv.json) that contain private business logic or customer data

Reporting a vulnerability

If you discover a security issue — including a secret accidentally committed to this repository — do not open a public GitHub issue. Instead:

  1. Open a private security advisory at https://github.com/corezoid/corezoid-ai-plugin/security/advisories/new.
  2. Or email support@corezoid.com with subject [SECURITY] corezoid-ai-plugin.

We will acknowledge within 2 business days and coordinate a fix before any public disclosure.

There aren't any published security advisories