Listen to this Post
The release introduces crucial updates to the Fairquery Agent Trust MCP server package, specifically targeting input schema documentation, cross-field validation rules, and email syntax checking mechanisms.
In previous versions, the `email_check_syntax` utility inadvertently flagged common typo-squats of major email providers—such as `gmial.com` or hotmial.com—as disposable email addresses simply because they happened to overlap with upstream disposable email blocklists.
This caused legitimate user inputs or common typographical errors during lead screening and data sanitization pipelines to be misclassified as malicious or disposable entities rather than simple typographical mistakes.
To resolve this behavior discrepancy, version 1.0.4 and its preceding iterations refine the parsing logic so that such domains now correctly report a status of POSSIBLE_TYPO accompanied by a constructive did_you_mean suggestion.
Furthermore, the updates standardize extensive tool descriptions across all twelve included tools, spanning free local utilities like pii_list_detectors, pii_scan_text, pii_redact_text, email_check_syntax, sanctions_list_sources, osv_query_packages, and osv_get_vulnerability, alongside paid Apify-backed capabilities.
Developers utilizing Claude Desktop, Cursor, and VS Code now benefit from streamlined installation snippets via the npm package (npx -y @fairquery/agent-trust-mcp) rather than direct GitHub repository references.
The inclusion of explicit cross-field rules, parameter defaults, format patterns, and billing interaction descriptions ensures that AI agents interacting with the Model Context Protocol server maintain higher precision and prevent unintended cost multiplication or erroneous security verdicts.
DailyCVE Form:
Platform: Agent Trust MCP
Version: v1.0.4
Vulnerability: Typo-squat misclassification
Severity: Low
date: 2026-10-17
Prediction: 2026-10-17
What Undercode Say:
Showing bash commands and codes related to the blog
npx -y @fairquery/agent-trust-mcp
npm install @fairquery/agent-trust-mcp
node -e "require('@fairquery/agent-trust-mcp')"
Exploit: (Educational Purposes!)
// Simulating input check for typo-squats
const result = email_check_syntax("[email protected]");
if (result.status === "POSSIBLE_TYPO") {
console.log(<code>Did you mean: ${result.did_you_mean}</code>);
}
Protection: from this CVE
Upgrade the package to version 1.0.4 or higher using npm, ensure proper handling of email syntax validation codes, and verify that MCP client configurations point to the official npm package registry instead of legacy repository references.
Impact:
Misclassification of domain typos as disposable addresses could lead to automated rejection of valid user signups, inaccurate lead screening scores, and potential friction in automated AI agent workflows relying on precise input sanitation parameters.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
