# Sibyl MCP Repro Pack 2026-06-01

Focused repro pack for turning the security findings into fixes and regression tests.

## How to run

```bash
docker run --rm --network none --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 512m --cpus 1 --tmpfs /tmp:rw,nosuid,nodev,size=128m --tmpfs /data:rw,nosuid,nodev,size=256m,mode=1777 -v "$PWD:/work" -w /work -e SIBYL_SECURITY_DATA_ROOT=/data sibyl-memory:local python scripts/run_mcp_security_repro_pack.py
```

## Summary

| Metric | Count |
|---|---:|
| Total | 6 |
| PASS | 1 |
| FAIL | 5 |

## Runs

| Run | Status | Checks | Reason |
|---|---:|---:|---|
| run-2026-06-01-mcp-run181-repro-validation-secret-input-value | FAIL | 1 / 2 | validation_error_sanitized; Invalid memory_remember body leaks raw validation details or fake secret-looking input. |
| run-2026-06-01-mcp-run182-repro-validation-missing-required | FAIL | 1 / 3 | recall_error_sanitized; state_error_sanitized; memory_recall with missing args leaks raw validation details.; memory_set_state with missing args leaks raw validation details. |
| run-2026-06-01-mcp-run183-repro-db-path-is-directory | FAIL | 0 / 1 | backend_error_sanitized; memory.db as a directory leaks backend storage details. |
| run-2026-06-01-mcp-run184-repro-memory-dir-symlink-outside-home | FAIL | 1 / 2 | no_write_outside_home; .sibyl-memory symlink is followed and memory.db is written outside HOME. |
| run-2026-06-01-mcp-run185-repro-db-file-symlink-outside-home | FAIL | 1 / 2 | no_write_outside_home; memory.db symlink is followed and SQLite creates or writes a database outside HOME. |
| run-2026-06-01-mcp-run186-repro-memory-dir-symlink-swap-during-session | PASS | 3 / 3 | none |

## Patch targets

1. Sanitize MCP validation errors. No raw Pydantic text, no input_value, no submitted secret-like values.
2. Resolve and constrain storage paths. Reject .sibyl-memory and memory.db symlinks that resolve outside HOME.
3. Sanitize storage errors. No OperationalError or backend exception names in public MCP responses.
4. Decide the concurrency contract. Either harden 80 parallel sessions or return a documented clean limit error.

The 80-session availability repro is optional because it is heavier:

```bash
docker run --rm --network none --cap-drop ALL --security-opt no-new-privileges --pids-limit 256 --memory 1g --cpus 1 --tmpfs /tmp:rw,nosuid,nodev,size=128m --tmpfs /data:rw,nosuid,nodev,size=512m,mode=1777 -v "$PWD:/work" -w /work -e SIBYL_SECURITY_DATA_ROOT=/data -e SIBYL_REPRO_INCLUDE_CONCURRENCY=1 sibyl-memory:local python scripts/run_mcp_security_repro_pack.py
```