VonBrubeck LLC
Independent Security Research & Assessments

Independent security research and assessment for AI and developer tooling.

VonBrubeck LLC focuses on security issues in AI tooling, API integrations, and execution boundaries. Public research is linked below. Private assessments are available by agreement and are scoped to the system, access, and timeline.

Areas of focus

SECTOR PRACTICE
  • Runtime IPC & Broker Isolation
    FastMCP stdio and SSE socket vulnerabilities, loopback origin bypasses, and unsanitized argument deserialization in tool servers.
    Scope: MCP Protocol Spec • Unix Sockets • gRPC
  • Ambient Token & Secret Bleed
    Preventing credential leakage across multi-step prompt context windows, subagent handoff states, and SaaS broker bridges.
    Scope: OAuth Delegation • Ephemeral Grants
  • Subprocess & Sandbox Escapes
    Container breakouts, command substitution in bash/powershell tools, and unconstrained workspace write primitives.
    Scope: Docker • Firecracker • Windows Job Objects

Selected Public Research

LINKED PUBLIC RECORDS
  • AWS PostgreSQL MCP server
    A command execution issue in a specific protocol mode and privileged database-role configuration.
    Public AWS and GitHub advisories; reporter credited
  • MCP SDK transport and redirect handling
    Two Python SDK reports covering a deprecated WebSocket transport and cross-origin redirect handling.
    Public GitHub advisories; reporter credited
  • Obot, Heimdall MCP, and Zigbee2MQTT MCP
    Publicly credited reports with deployment-specific quickstart, command execution, and LAN exposure conditions.
    Advisories and release notes linked below

Assessment Inquiries

SCOPED BY AGREEMENT
  • Focused Security Assessment
    A scoped review of an agreed system boundary, with findings documented and evidence matched to what can be reproduced.
    Scope, timing, and fee agreed before work begins
  • Ongoing Review
    Recurring review may be arranged for teams that need continued coverage of agent or tool integrations.
    Availability and scope by agreement
  • Protocol and Runtime Review
    Review of selected protocol, transport, tool execution, or isolation boundaries in AI-enabled software.
    Scope agreed in writing

Selected Public Security Research

A selection of reports with public acknowledgements. Severity labels follow the linked source; deployment conditions and affected components are included for context.

PUBLIC ADVISORIES & RELEASE NOTES
Public recordProjectPublished severityFinding and scopeCredit / fix
CVE-2026-87911 / GHSA-fph8-pg5w-78fvAWS PostgreSQL MCP serverPG_WIRE_PROTOCOL; versions below 1.1.7Critical (GitHub); Important (AWS)Crafted COPY TO PROGRAM input can execute commands when processed by a self-managed PostgreSQL server, with an authenticated user and a database role holding superuser or pg_execute_server_program privileges. Default read-only mode does not remove these conditions.AWS bulletin acknowledges Ryan von Brubeck; fixed in 1.1.7
GHSA-jj4w-pfgv-4mrmObotQuickstart Docker deploymentCriticalWith authentication disabled and network access to the quickstart service, an Owner/Admin could launch an MCP server with Docker socket access.Advisory credits Ryan Vonbrubeck; documentation fix
Heimdall MCP v0.2.1 release notesHeimdall MCP15+ tools using shell executionCritical; CVSS 9.8 (release notes)Command injection in tool execution; release notes describe replacing shell execution with argument-based process invocation.Credits @dodge1218; fixed in v0.2.1
GHSA-m2jq-w2wv-43fhZigbee2MQTT MCPSSE endpointHighUnauthenticated SSE access when reachable on the local network; ordinary residential/SOHO use is LAN scoped.Advisory credits @dodge1218; patched
GHSA-vj7q-gjh5-988wMCP Python SDKDeprecated WebSocket server transportHigh; CVSS 7.6Missing Host/Origin protections in a deprecated WebSocket transport requiring manual ASGI wiring. Stdio, SSE, Streamable HTTP, and FastMCP users were not affected.Advisory credits @dodge1218; fixed in 1.28.1
GHSA-5h93-6whr-6q8jMCP Python SDK clientsHTTP/SSE redirects and OAuth requestsModerate; CVSS 5.9Custom headers and request bodies could be forwarded across origins during redirects. Affected HTTP/SSE client and OAuth paths only; not a standalone bearer-token disclosure.Advisory credits @dodge1218; fixed in 1.30.0 / 2.2.0
GHSA-q3h7-gpc9-2rxcSigNozMap-accessor query pathHigh; CVSS 7.6SQL injection through map-accessor keys in a query field, available to authenticated users with the Viewer role.Advisory credits @dodge1218; fixed in v0.142.0
x64dbg MCP v1.0.8 release notesx64dbg MCPCSRF / DNS rebindingNo public severity listedRelease notes describe the reported issue and fix; they state no CVSS or impact rating.Credits @vonbrubeck; fixed in v1.0.8

Research & Assessment Areas

Areas of focus for independent research and potential assessment work. Each engagement is scoped to the system and evidence available.

SCOPE MAY INCLUDE CODE REVIEW AND REPRODUCTION
PRAC-01 / PROTOCOL ARCHITECTURE

Architectural Review & Protocol Verification

Potential review areas include transport channels (FastMCP, JSON-RPC, SSE, and gRPC), message signing, origin validation, and the handling of untrusted tool responses.

  • Review of relevant protocol behavior
  • Transport security (mTLS, unix domain sockets)
  • Tool schema and input-boundary review
  • Threat model notes, if in scope
PRAC-02 / OFFENSIVE VERIFICATION

Runtime Boundary Testing & Subprocess Escapes

Research and assessment may examine whether prompt manipulation, untrusted repositories, or compromised dependencies can cross a sandbox boundary, expose host data, or misuse subprocess privileges.

  • Container isolation and syscall policy review
  • Subprocess and shell input handling
  • Path handling in dynamic tool arguments
  • Reproduction evidence for validated findings, where feasible
PRAC-03 / MULTI-TENANT ISOLATION

Autonomous Memory & State Isolation Audits

Potential review areas include state serialization, vector database access, checkpoint caches, and delegated agent permissions, with attention to cross-user data access.

  • Session isolation and cache behavior review
  • Token scope and lifecycle review
  • Context and state isolation review
  • Delegated agent permission review

Assessment Inquiries

For teams building AI-enabled software, assessment scope, access, timing, and deliverables are agreed before work begins.

TERMS BY AGREEMENT
PHASE 01
Surface Ingestion
Map tool configs, Dockerfiles, IPC sockets, and ambient credential blocks.
PHASE 02
Transport Rigor
Audit CSWSH, DNS rebinding, CORS, and SSE vs HTTP authentication parity.
PHASE 03
Tool Boundaries
Test filesystem traversal, IMDS accessibility (169.254.169.254), and state bleed.
PHASE 04
PoC Construction
Develop reproduction steps for validated findings, where feasible.
PHASE 05
Findings & Readout
Share the agreed findings and remediation discussion.

Contact

Direct communication for technical scoping, briefing inquiries, and coordinated vulnerability disclosure.

BUSINESS CONTACT