Security & vulnerability disclosure policy
How to report a security issue affecting agenticweb.wiki or the wiki.agenticweb/probe MCP server, our safe-harbour commitment for good-faith researchers, and the architectural controls guarding the probe worker.
Reporting a vulnerability
- Email: info@belgravialabs.com (subject line:
[SECURITY] agenticweb.wiki). - RFC 9116 manifest: https://agenticweb.wiki/.well-known/security.txt
- Response SLA: We acknowledge reports within 48 hours and aim to ship verified fixes to our Cloudflare Worker edge within 72 hours of triage.
Scope & safe harbour
Good-faith security research against agenticweb.wiki and https://agenticweb.wiki/mcp that respects our published rate limits, avoids denial-of-service floods, and does not target third-party origins through our probe tools is authorized under this policy. Please test SSRF or parser edge cases using domains you control rather than third-party infrastructure.
Security architecture of the MCP server
- Zero server-side credentials on public tools: All 11 MCP tools are unauthenticated and read-only. The Worker holds no user OAuth tokens, payment keys, or session secrets that could leak across callers.
- Per-hop SSRF prevention: Every outbound fetch in
has,probe, andvalidate_manifestresolves DNS over HTTPS and validates all returned A/AAAA records against RFC 1918, loopback, link-local, carrier-grade NAT, cloud metadata (169.254.169.254), and IPv6 private ranges before connecting and at every HTTP redirect hop (capped at 3 hops). - Indirect prompt-injection mitigation: Outbound probes never return raw third-party HTML or prose bodies into the MCP tool response. Only deterministic counts, booleans, and schema-validated fields are extracted, and responses are tagged with
content_trust: "untrusted_external_origin". - Edge rate limiting: Per-client IPv4 / IPv6
/64and per-target-origin rate limiters protect both the Worker and third-party origins from amplification.