genexus-mcp is a Model Context Protocol server that lets AI agents drive a real GeneXus 18 Knowledge Base. That means it shells out, touches the filesystem, talks to a local worker over IPC, and runs against your actual KB. Treat it accordingly.

Do not open a public issue for security reports. Use one of:

• GitHub private vulnerability reporting — preferred: https://github.com/lennix1337/Genexus18MCP/security/advisories/new
• Email — lucassouza@univali.br with subject prefix [genexus-mcp security]

Please include:

1. Affected version (npm view genexus-mcp version or the tag you're on).
2. A minimal reproduction — config snippet, the exact MCP tool call, and the observed effect.
3. Whether the issue requires a malicious KB, a malicious AI prompt, a hostile local user, or just normal usage.

You should get an acknowledgement within 3 business days. Fixes ship as patch releases on the latest minor.

Only the latest minor receives security fixes. Older minors are not backported — upgrade with npx genexus-mcp@latest.

In scope:

• Arbitrary code execution triggered by a crafted MCP request that the gateway shouldn't have honored.
• Path traversal / SSRF reaching outside the configured KB or GeneXus install root.
• Prompt-injection vectors in tool_definitions.json or in injected context that would manipulate the host agent beyond stated tool semantics.
• npm supply-chain issues (tampered publish.zip, missing provenance, etc.).
• Authentication/authorization bypass against the worker IPC channel.

Out of scope (these are expected capabilities for an MCP that wraps a desktop SDK):

• The package uses child_process, filesystem APIs, and https — that's how it spawns the .NET worker, reads/writes the KB, and checks for npm updates. Generic scanner flags on these are not vulnerabilities.
• The worker runs as the same user that launched the MCP and has full access to the configured KB. That is the design.
• A user pointing the MCP at a KB they don't own. Access control to the KB itself is GeneXus's job, not ours.
• Issues that only reproduce with a modified config.json you wrote yourself.

I'll coordinate a fix and credit you in the release notes unless you ask to stay anonymous. Public disclosure happens after the patched version is on npm — usually same-day for the kind of issues this project realistically faces.