mcp-redis

redis/mcp-redis

This MCP server provides an interface for AI agents to read, write, search, and manage data in a Redis database. The main risks are that untrusted prompt input can trigger destructive database operations or exfiltrate sensitive Redis data via the external documentation search API, and automatic .env loading can allow an untrusted workspace to override server settings.

What it can reach

Network

Connects to the configured Redis instance (default 127.0.0.1:6379), makes HTTPS requests to https://redis.io/convai/api/docs/search (or MCP_DOCS_SEARCH_URL), and connects to Azure Entra ID endpoints when Entra ID authentication is enabled.

Files

Automatically reads a .env file from the current working directory or parent directories on startup, and reads SSL certificate and key files if configured.

Secrets

Reads Redis credentials, Azure Entra ID service principal secrets, or ambient Azure credentials (via DefaultAzureCredential or Managed Identity) from environment variables and CLI arguments.

Findings

1. MediumAutomatic loading of .env from working directory can hijack configuration

   src/common/config.py:6

   The server calls load_dotenv() at import time, which searches the current working directory and parent directories for a .env file. If an AI coding agent starts the MCP server inside an untrusted project directory containing a malicious .env file, that file can override settings that have no CLI flags—such as redirecting MCP_DOCS_SEARCH_URL to an attacker-controlled server or enabling REDIS_ENTRAID_AUTH_FLOW even when --url is explicitly passed.

   Fix: Remove the implicit load_dotenv() call or require an explicit --env-file CLI option so that .env files in untrusted workspaces are not loaded automatically.

2. LowDocumentation search tool sends agent-controlled queries to an external API

   src/tools/misc.py:245

   The search_redis_documents tool sends the question parameter over HTTP to an external endpoint (https://redis.io/convai/api/docs/search by default) and returns the remote content to the agent. Its docstring also instructs the agent that it 'must be invoked every time the user wants to learn more'. Under prompt injection, an attacker could trick the agent into reading sensitive keys from Redis and passing their contents in the question parameter to exfiltrate them externally.

   Fix: Provide a configuration flag to disable external documentation search or restrict outbound HTTP calls in sensitive environments.

3. LowUnpinned package version in Gemini extension configuration

   gemini-extension.json:10

   The Gemini CLI extension manifest runs uvx with redis-mcp-server@latest, which downloads and executes whatever version is currently latest on PyPI rather than a pinned, reviewed version.

   Fix: Pin the package to a specific release version (for example, redis-mcp-server==0.5.1) in gemini-extension.json.