[Alex-Hofer]

Follow-up to #22702; #22703 proposes the same for Python.

MCP servers expose tools to LLM agents. Every argument of a tool, resource or prompt callback is chosen by the client, that is by a model that prompt injection can steer, or by anyone who can reach the server over HTTP. This PR models that input for the TypeScript SDKs as data extensions in javascript/ql/lib/ext: the callback arguments and the low-level requests as sources of the opt-in ai threat model (#22810), the request headers and the bearer token as sources of the remote threat model.

First commit, the MCP SDKs:

• @modelcontextprotocol/sdk 1.x and @modelcontextprotocol/server 2.x, McpServer: the arguments of the callbacks of tool, registerTool, prompt and registerPrompt, and the URI and template variables of resource and registerResource.
• The low-level Server: request.params in handlers of setRequestHandler, also when the server is reached through McpServer.server, and the parameters of custom methods in 2.x.
• The request headers and the bearer token that the SDK hands to a callback: extra.requestInfo.headers and extra.authInfo.token in 1.x, ctx.http.req.headers.get() and ctx.http.authInfo.token in 2.x.
• fastmcp: addTool({execute}), addResourceTemplate({load}), addPrompt({load}).
• typeModel rows for the import paths with and without .js and for a server that arrives as a typed parameter.

Second commit, flow summaries for zod (independent of the first, can be split off): handlers of the low-level server get the raw arguments and validate them with a zod schema before use (Schema.parse(request.params.arguments)). There is no model of zod, so the flow ends at that call. Four rows let data flow from the argument of parse, safeParse, parseAsync and safeParseAsync to the result. I used kind value: js/path-injection does not follow a taint summary there (it is a data-flow configuration with flow states) and does follow a value one; I checked both on a small server.

Tests: library-tests/threat-models/sources gets mcp.ts, fastmcp.ts and zod.ts with inline expectations (threat-source, hasFlow); callbacks that are not registered with a server and a static resource have none. codeql test run passes locally with CLI 2.27.1.

Evidence: as a model pack, these rows take CodeQL 2.27.1 from 6 to 25 of 38 real, publicly disclosed vulnerabilities in TypeScript and JavaScript MCP servers in mcp-vulnbench. On the half of the cases that the models were not run on while they were written, plain CodeQL finds 3 of 21, the rows of the first commit 11, and both commits together 14 (the zod rows were measured with kind taint), at 2.62 instead of 0.08 alarms per KLOC. Known limits are documented there: servers kept in a field of a project class, handler tables built across modules, and sinks such as fetch from undici or Playwright's page.goto. The measurement used the rows as remote, which is on by default; with ai the same sources apply once that threat model is enabled.

[jacknojo]

Thanks for your contribution @Alex-Hofer. We discussed this internally and think remote is not an ideal threat model for LLM-generated content.
The PR #22810 adds support for a new (opt-in) threat model called "ai". May I suggest that you update your MadS to use "ai"?

[Alex-Hofer]

Done: the rows for handler input (callback arguments, low-level requests) now use ai, and the branch is rebased on main so that #22810 is in. I kept remote for the request headers and the bearer token that the SDK hands to a callback: those come from the HTTP client, not from the model. If you would rather have everything under ai, I will switch those four rows as well. The same change is in #22703 for Python.

[jacknojo]

Thank you for this contribution 👍

[Alex-Hofer]

Thanks for the approval, @jacknojo! Only the license check has run on this PR so far, so I think the CI still needs to be started from your side. Is there anything else I should do? And if you have time, #22703 makes the same change (ai for handler input) for Python.

[Alex-Hofer]

Thanks for starting the checks! The coverage check failed while setting up Python 3.8, which the Ubuntu 26.04 runners no longer have; main moved that workflow to Python 3.12 in 104bf77, and a re-run reuses the old merge commit. I have merged main into the branch (no force-push), so the next run should pick up the fix. The coverage report only covers Java, C# and Go, so the change itself does not affect it.

[Alex-Hofer]

I can't open the internal run, but I think I found what failed in JS Language Tests Linux: library-tests/frameworks/data (warnings.ql and test.ql) fails locally with Invalid kind "ai" in source model., because ValidSourceKind in shared/mad/codeql/mad/ModelValidation.qll did not list ai yet. I missed that test when I switched the rows to ai, sorry. e2bc115 adds it; those two tests and the threat-model tests now pass locally with CLI 2.27.1. If the run still fails, could you tell me which test it is?

The commit touches shared/, so it dismissed your approval and requested the shared-libraries reviewers. If you would rather have this line in its own PR, I can split it out. #22703 will need the same line, so I will take it from main there once it has landed.