agent-device advisory: repository config could redirect remote-daemon credentials

Callstack published a security advisory for agent-device, its device automation CLI and MCP server, on 2026-08-03. GHSA-m7q5-6423-2mwq describes a credential-exposure path (CWE-200): the CLI reads a project-level agent-device.json from the repository it runs in, and a malicious repository could set daemonBaseUrl to an attacker-controlled endpoint. The CLI would then send the user's or CI's AGENT_DEVICE_DAEMON_AUTH_TOKEN to that address.

The advisory rates the issue medium severity, with no CVE assigned. Affected versions run from 0.8.0 through 0.20.3; the fix shipped in 0.20.4 on 2026-08-03, and 0.20.5 and 0.20.6 followed within the week. The vulnerability sits in the optional remote-daemon connection path. The local stdio MCP transport, which is how the server ordinarily runs for coding agents, is not affected.

One distribution wrinkle raises the advisory's relevance: the official MCP Registry still carries an active record for the project's former name, io.github.callstackincubator/agent-device, pinned at version 0.16.9, inside the vulnerable range. The current record under io.github.callstack/agent-device tracked the patched 0.20.6 on 2026-08-07.