auth0-mcp-server

auth0/auth0-mcp-server

This MCP server lets AI coding agents manage an Auth0 tenant's applications, APIs, actions, forms, logs, and local project onboarding configurations. The biggest risk is that prompt injection can cause the agent to modify live Auth0 tenant authentication settings (such as allowed OAuth callback URLs or custom login Actions) or inject malicious environment variables into local .env files.

What it can reach

Secrets

Reads and writes Auth0 Management API tokens, refresh tokens, and tenant domains in the system keychain via keytar (or reads AUTH0_TOKEN and AUTH0_DOMAIN from environment variables), and fetches application client secrets to write into local .env files.

Network

Makes authenticated requests to the user's Auth0 Management and OAuth APIs, fetches quickstart specs and prompts from cdn.auth0.com, and sends usage analytics to heapanalytics.com unless AUTH0_MCP_ANALYTICS=false is set.

Files

Reads and modifies MCP client config files (Claude, Claude Code, Cursor, Windsurf, VS Code, Gemini CLI) during initialization, and reads/writes .env files, .gitignore, and state/audit logs in user-specified project directories.

Browser

Opens the system default web browser during the OAuth 2.0 device authorization flow when running the init command.

Findings

1. HighMutating quickstart tool matches documented read-only auth0_get_* pattern and modifies OAuth callbacks

   src/tools/quickstarts.ts:352

   The documentation instructs users to pass --tools 'auth0_list_*,auth0_get_*' as an alternative way to enable only read-only operations. However, auth0_get_quickstart_guide uses the auth0_get_ prefix while directly calling APPLICATION_HANDLERS['auth0_update_application'] in-process, bypassing the server's tool allowlist. Through prompt injection, an attacker can call auth0_get_quickstart_guide with an attacker-controlled base_url to append malicious OAuth callback and logout URLs to an existing Auth0 application even when auth0_update_application is filtered out.

   Fix: Rename auth0_get_quickstart_guide so it does not match auth0_get_*, and check that auth0_update_application is enabled before mutating application settings.

2. MediumNewline injection into .env files via unsanitized credential values

   src/utils/credentials-writer.ts:95

   When auth0_save_credentials_to_file writes credentials to a project's .env or .env.local file, it concatenates keys and values without rejecting newline characters (\n or \r). In src/utils/env-credentials.ts, callback_url (in fallback and spec modes) and client_id (in SPA specs where no API lookup occurs) are taken directly from tool arguments. A prompt-injected tool call can include newline sequences in these arguments to inject arbitrary environment variables (such as NODE_OPTIONS or PYTHONSTARTUP) into the project's .env file.

   Fix: Reject any credential key or value containing \r, \n, or null bytes before writing to the environment file, and validate callback_url as a well-formed HTTP/HTTPS URL.

3. MediumIncomplete path denylist in hasProjectMarker allows writes to hidden config subpaths and symlinked system paths

   src/utils/onboarding.ts:36

   hasProjectMarker is used by auth0_onboarding and auth0_save_credentials_to_file to prevent writing .env and .gitignore files into system or hidden configuration directories, but it does not check for any actual project marker files. It only blocks hidden directories in the user's home directory when path.basename(resolvedDir) starts with a dot, which fails to block subdirectories such as ~/.config/Claude or ~/.local/bin. It also checks POSIX_DENIED_PREFIXES before resolving symlinks, allowing /private/tmp or /private/etc on macOS.

   Fix: Resolve projectPath with fs.realpathSync before calling hasProjectMarker, check all path segments under os.homedir() for leading dots, and include /private and /Library in POSIX_DENIED_PREFIXES.

4. MediumResource server responses do not redact HS256 signing secrets

   src/tools/resource-servers.ts:453

   Unlike the application tools, auth0_get_resource_server, auth0_create_resource_server, and auth0_update_resource_server return the raw resourceServer object from the Auth0 Management API without calling maskSensitiveFields, and signing_secret is missing from DEFAULT_SENSITIVE_FIELDS in src/utils/response-masker.ts. When an API uses symmetric signing (HS256), its plaintext signing_secret is exposed to the AI agent and client logs.

   Fix: Add signing_secret to DEFAULT_SENSITIVE_FIELDS in src/utils/response-masker.ts and apply maskSensitiveFields(resourceServer) in src/tools/resource-servers.ts.

5. MediumGemini CLI extension init command requests all scopes and tools without user confirmation

   commands/auth0/init.toml:3

   While the project documentation states that no scopes are requested by default so users can interactively grant least-privilege access, the /auth0:init command for the Gemini CLI extension runs init with --tools "*" --scopes "*" --no-interaction. This automatically requests every Management API scope (including create and update permissions for clients, actions, forms, and grants) and opens the browser without interactive scope selection.

   Fix: Remove --scopes "*" and --no-interaction from the command in commands/auth0/init.toml so users interactively choose the scopes they need.