SiYuan

SiYuan is an open-source, self-hosted knowledge workspace whose Go kernel ships a built-in MCP server rather than a separate package. The server is mounted at /mcp via kernel/mcp/server.go, which registers ginServer.POST("/mcp", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, serveHTTP(handler)) alongside matching GET and DELETE routes, and builds its handler as Streamable HTTP only; no stdio or SSE-only code path exists for this surface. Authentication runs through kernel/model/session.go's CheckAuth function, which accepts an API token supplied as an Authorization: Token/Bearer header or a ?token= query parameter, or an existing session, but the /mcp routes additionally require the Administrator role. Source in kernel/conf/ai.go sets the kernel's default MCP tool-exposure policy to allow with no per-tool overrides, so an authenticated administrator reaches the full tool set without additional configuration.

Authority is first-party: the repository is owned by the verified GitHub organization siyuan-note, whose own blog field points to https://b3log.org/siyuan, and the official Docker image is published under the matching b3log Docker Hub namespace. SiYuan's v3.8.0 changelog, published 2026-08-12, announced "Support Model Context Protocol (MCP)" as a new feature, though repository advisories show the /mcp route already existed and was exploitable at v3.7.1, released 2026-07-04, over a month earlier. No fetched surface names an MCP specification revision. The only revision-dated string found in the source is a constant, protocolVersion20260728 = "2026-07-28", used solely to branch between "modern" and "legacy" Streamable HTTP handling by request header; that is source code read via static fetch, not a vendor announcement, a docs page, or a live probe, so spec_status is unknown. No SiYuan user-guide page for the MCP feature could be located: b3log.org/siyuan makes no mention of MCP, and a guessed English-language documentation path returned HTTP 404.

SiYuan's MCP tool surface has drawn five published CVE records to date, all against tools reachable through this same /mcp endpoint and all fixed in releases that shipped before their CVE record's publish date: CVE-2026-74798 (database_clean, fixed in v3.8.0, released 2026-08-12), CVE-2026-59809 (http_request, fixed in v3.8.0), CVE-2026-60083 (file tool blocklist, fixed in v3.8.0), CVE-2026-82233 (asset.upload, fixed in v3.8.1, released 2026-08-18), and CVE-2026-85580 (a Linux-only path-guard bypass in the MCP file-access handler, fixed in v3.8.2, released 2026-08-30), as covered in four earlier stories and a fifth in September's roundup. Two further MCP-related advisories carry no CVE as of 2026-09-15. GHSA-cvhv-7xhj-xjp8, published 2026-07-13 and rated critical, described the pre-v3.7.2 /mcp route as gated only by CheckAuth with no admin check and no read-only check, exposing 31 MCP tools including arbitrary workspace file read/write/delete, SQL execution, and plugin distribution to any authenticated user rather than administrators only; it was patched in v3.7.2. GHSA-9g6v-r3xf-673q, published 2026-09-11 and rated medium, describes an incomplete fix for GHSA-c8r8-95hg-mp34: recursive MCP file operations that bypass the sensitive-path guard across versions 3.8.0 through 3.8.3. Its stated fix version, v3.8.4, had not shipped as a stable release as of 2026-09-15; only prerelease alpha and beta tags existed.