Only the latest published minor line receives security fixes. This project releases from master with Release Please, and there are no maintenance branches, so a fix ships as a new patch release rather than a backport.

If you are pinned to an older line, the upgrade path is npm install -g @ooples/token-optimizer-mcp@latest. Note the scope: the unscoped token-optimizer-mcp on npm is a different package and is not this project.

Use GitHub's private vulnerability reporting, which is enabled on this repository: Report a vulnerability. That opens a private advisory visible only to the maintainers.

Please do not open a public issue for something you believe is exploitable.

What to expect:

• Acknowledgement within a few days.
• An assessment — accepted, or declined with the reasoning — once the report has been read against the source.
• A fix released as a patch version if accepted, with credit in the release notes unless you ask otherwise.

Static-analysis output, audits and hardening suggestions that are not exploitable are welcome as ordinary public issues; #343 is the model for that.

This is a local MCP server. It runs as the user who starts it, on that user's machine, and its tools act with that user's full privileges. Two consequences are worth stating plainly, because a tool name does not convey them:

• smart_process (start operation) launches an arbitrary executable of the caller's choosing, with caller-supplied arguments, working directory and environment. It runs in argv mode with no shell, so there is no command injection — but granting it is equivalent to granting local command execution. Operators who want monitoring only should expose smart_processes instead.
• The file tools (smart_read, smart_write, smart_edit, smart_glob, smart_grep) take arbitrary paths and are not confined to a project root. They can read and write anywhere the user can.

Neither is a vulnerability; both are the point of the respective tools. They are listed here so the decision to wire this server into an autonomous agent is made with the scope visible.

Every process launch in tool code runs in argv mode with no shell. Most go through the helpers in src/utils/safe-exec.ts, which are shell: false by construction; the rest call spawn directly with an explicit shell: false (smart-docker, smart-network, smart-system-metrics, run-node-bin, smart-process). String-concatenated commands, shell: true, and interpolated execSync must not be reintroduced in tool code, whichever route a call site takes.