TMHSDigital · TMHSDigital · Sep 18, 2026 · Sep 17, 2026 · Sep 17, 2026 · Sep 17, 2026
diff --git a/.cursorrules b/.cursorrules
@@ -1,2 +1,3 @@
 - Never use em dashes (-). Use a regular dash (-) or rewrite the sentence instead.
 - Never hardcode Steam API keys. Always read from STEAM_API_KEY environment variable.
+- Any tool that performs a live mutation must use the shared confirm gate from src/utils/confirm.ts (dry_run default true, confirm required to send).
diff --git a/.github/SECURITY_ADVISORY_DRAFT.md b/.github/SECURITY_ADVISORY_DRAFT.md
@@ -0,0 +1,67 @@
+# GitHub Security Advisory Draft
+
+Paste into a GitHub Security Advisory when publishing. Do not request a CVE from this draft.
+
+## Title
+
+Ungated Steam Partner API write tools in the default MCP server bin
+
+## Severity
+
+Medium
+
+Suggested CVSS 3.1 vector (5.3 Medium):
+
+`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N`
+
+Rationale: an unauthenticated Steam user can author review or Workshop text that an agent later loads. Integrity impact is high if that agent then invokes a publisher-key write tool. Attack complexity is high because the MCP host must have a publisher Web API key configured and the agent must treat untrusted text as instructions. User interaction is required (the operator or agent must fetch the untrusted content).
+
+## CWE
+
+CWE-693: Protection Mechanism Failure
+
+The publisher API key check was present and enforced. What was absent was a confirmation step between an authorized caller and a state-mutating call, so an authorized agent acting on injected instructions could trigger a live mutation with no interposed check.
+
+## Affected versions
+
+`@tmhs/steam-mcp` <= 0.8.0
+
+## Patched version
+
+`@tmhs/steam-mcp` 0.9.0
+
+## Summary
+
+Five tools registered in the default `steam-mcp` bin POST to the live Steam Partner Web API as soon as they are invoked. They had no dry-run default, no confirmation flag, and no code path that could refuse an unconfirmed call. The same repository already gated Partner-admin image and trailer uploads behind `refuseIfUnconfirmed` plus a separate process requiring `STEAM_PARTNER_ADMIN=1`. The five default-bin write tools had neither layer.
+
+Two read tools in the original report (`steam_getReviews`, `steam_queryWorkshop`) returned Steam user-authored text into the agent context without labeling it as untrusted. `steam_getWorkshopItem` is the same class (Workshop title and description). That is the injection path that can reach the ungated sinks.
+
+## Impact
+
+An agent with this server enabled and a Steam publisher Web API key in `STEAM_API_KEY` can grant inventory items, set or clear achievements, upload leaderboard scores, or update Workshop item metadata without an explicit confirmation from the operator.
+
+## Affected write tools (0.8.0 and earlier)
+
+- `steam_grantInventoryItem` -> `IInventoryService/AddItem`
+- `steam_setAchievement` -> `ISteamUserStats/SetUserStatsForGame`
+- `steam_clearAchievement` -> `ISteamUserStats/SetUserStatsForGame`
+- `steam_uploadLeaderboardScore` -> `ISteamLeaderboards/SetLeaderboardScore`
+- `steam_updateWorkshopItem` -> `IPublishedFileService/UpdateDetails`
+
+## Injection path (read tools)
+
+- `steam_getReviews` returns full review bodies.
+- `steam_queryWorkshop` returns Workshop `title` and `short_description`.
+- `steam_getWorkshopItem` returns Workshop `title` and `description`.
+
+Those fields are authored by arbitrary Steam users. In 0.8.0 they were returned verbatim with no delimiting. 0.9.0 still returns the full text (it is not stripped) but labels it as untrusted data. The label is defense in depth. The confirm gate on write tools is the control.
+
+## Remediation
+
+Upgrade to `@tmhs/steam-mcp` 0.9.0. Write tools now default to `dry_run: true` and refuse to send unless `dry_run: false` and `confirm: true`.
+
+## Credit
+
+Reported by Syed Anas Mohiuddin, Independent Researcher, Maintainer of mcp-safeguard
+
+Disclosed as part of an MCP-server security research effort.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,21 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.9.0] - 2026-09-17
+
+### Security
+
+- All five default-bin Partner API write tools (`steam_grantInventoryItem`, `steam_setAchievement`, `steam_clearAchievement`, `steam_uploadLeaderboardScore`, `steam_updateWorkshopItem`) now default to `dry_run: true` and refuse to contact Steam unless `confirm: true`.
+- `steam_getReviews`, `steam_queryWorkshop`, `steam_getWorkshopItem`, and `steam_getNewsForApp` label untrusted free text (user-authored or third-party) so agents treat it as data to summarize, not as commands. The label is defense in depth. The confirm gate is the control. `steam_getPlayerSummary` and `steam_getAppDetails` are deliberately unlabeled.
+- Reported by Syed Anas Mohiuddin, Independent Researcher, Maintainer of mcp-safeguard
+
+### Changed
+
+- Package copy now counts 5 write tools and 2 SDK code-example generators, instead of grouping both as 7 write tools.
+- Shared confirm/dry-run helpers live in `src/utils/confirm.ts` and are used by both the default bin and the Partner-admin process.
+
+**BREAKING CHANGE:** write tools no-op by default. Callers that invoked them with no flags previously sent a live POST. They now receive a dry-run plan and send nothing. To execute for real, pass `dry_run: false` and `confirm: true`.
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -4,7 +4,7 @@
 
 ## What is this?
 
-An MCP (Model Context Protocol) server that exposes Steam Web API endpoints as structured tools for AI-powered IDEs. It is the companion server for the [Steam Developer Tools](https://github.com/TMHSDigital/Steam-Cursor-Plugin) Cursor plugin, which provides 30 skills and 9 rules for Steam/Steamworks development. The server provides 26 tools: 19 read-only and 7 write/guidance tools.
+An MCP (Model Context Protocol) server that exposes Steam Web API endpoints as structured tools for AI-powered IDEs. It is the companion server for the [Steam Developer Tools](https://github.com/TMHSDigital/Steam-Cursor-Plugin) Cursor plugin, which provides 30 skills and 9 rules for Steam/Steamworks development. The server provides 26 tools: 19 read-only, 5 write (Partner API mutations gated by confirm/dry-run), and 2 SDK code-example generators.
 
 The plugin's skills reference these MCP tools to fetch live data from Steam - player stats, store info, workshop items, leaderboards, and more.
 
@@ -26,6 +26,7 @@ src/
     validate.ts          Pure validateStoreAsset(path, slot)
   utils/
     steam-api.ts         Shared fetch wrapper, URL builders, API key helper, error formatting
+    confirm.ts           Shared dry_run/confirm gate for any live mutation
     errors.ts            Custom error classes (rate limit, missing key, unavailable)
 ```
 
@@ -35,6 +36,7 @@ src/
 - `steam-api.ts` provides `steamFetch()` which handles timeouts (15s via AbortController with `TimeoutError`), HTTP error detection (429 rate limits with up to 2 retries and exponential backoff, 5xx unavailable), and JSON parsing.
 - `errorResponse()` formats errors as MCP-compatible `{ isError: true }` responses.
 - Tools that need an API key call `requireApiKey()` which reads `STEAM_API_KEY` from env and throws `MissingApiKeyError` with setup instructions if missing.
+- Any tool that performs a live mutation must use the shared confirm gate in `src/utils/confirm.ts`: spread `confirmSchema`, call `refuseIfUnconfirmed` before any network I/O, run the dry-run branch before `requireApiKey()`, and never send unless `dry_run: false` and `confirm: true`.
 - No-auth tools (getAppDetails, searchApps, getPlayerCount, getAchievementStats, getWorkshopItem, getReviews, getPriceOverview, getAppReviewSummary, getRegionalPricing, getNewsForApp, validateStoreAsset) work without any configuration.
 
 ## How to build and run
@@ -55,7 +57,7 @@ npm test            # single run
 npm run test:watch  # watch mode
 ```
 
-Tests cover error classes, `steamFetch` behavior (mocked fetch), retry logic, and Zod input validation for tools.
+Tests cover error classes, `steamFetch` behavior (mocked fetch), retry logic, Zod input validation for tools, and the confirm/dry-run gate on write tools.
 
 **Manual testing** via MCP inspector or by configuring as an MCP server in Cursor:
 

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -77,7 +77,9 @@ registerGetReviews(server);
 
 4. If the tool needs an API key, use `requireApiKey()` from `steam-api.ts` and mention it in the tool description.
 
-5. Build and test:
+5. If the tool performs a live mutation (inventory grant, achievement/stat write, leaderboard write, Workshop metadata update, Partner-admin upload, or similar), spread `confirmSchema` from `src/utils/confirm.ts`, call `refuseIfUnconfirmed` before any network I/O, run the dry-run branch before `requireApiKey()`, and prepend a capability warning to the tool description. Do not add a new write tool that can send unconfirmed. Read-only Steam POSTs (for example `GetPublishedFileDetails`) are not mutations and must not use this gate.
+
+6. Build and test:
 
 ```bash
 npm run build
@@ -90,6 +92,7 @@ npm run build
 - Never hardcode API keys. Always read from `STEAM_API_KEY` environment variable.
 - Every tool should have a clear description and well-typed zod input schema with `.describe()` on each field.
 - Wrap all tool handlers in try/catch and use `errorResponse()` for error formatting.
+- Live mutations must use the shared confirm gate (`confirmSchema`, `refuseIfUnconfirmed`, dry-run before `requireApiKey()`).
 
 ## Pull request guidelines
 

diff --git a/README.md b/README.md
@@ -19,13 +19,13 @@
 
 <p align="center">
   <a href="package.json"><img src="https://img.shields.io/node/v/@tmhs/steam-mcp" alt="node"></a>
-  <a href="https://github.com/TMHSDigital/Steam-MCP#available-tools-v080"><img src="https://img.shields.io/badge/MCP_tools-26-blue" alt="MCP tools"></a>
+  <a href="https://github.com/TMHSDigital/Steam-MCP#available-tools-v090"><img src="https://img.shields.io/badge/MCP_tools-26-blue" alt="MCP tools"></a>
   <img src="https://img.shields.io/badge/Steam_Web_API-powered-1b2838" alt="Steam Web API">
 </p>
 
 ---
 
-<p align="center"><strong>26 MCP tools</strong> - 11 no-auth - 8 API key - 7 publisher key</p>
+<p align="center"><strong>26 MCP tools</strong> - 19 read - 5 write - 2 SDK guides</p>
 
 Query Steam store data, player statistics, achievements, reviews, pricing, workshop items, leaderboards, inventory, and player profiles - all as structured MCP tools callable from Cursor's AI agent.
 
@@ -107,7 +107,44 @@ Add the Steam MCP server to your Cursor MCP settings (`.cursor/mcp.json` in your
 
 Once configured, the tools are available to Cursor's AI agent. Pair with the [Steam Developer Tools](https://github.com/TMHSDigital/Steam-Cursor-Plugin) plugin for the full skill set.
 
-## Available Tools (v0.8.0) - 26 Total
+## Security model
+
+All five write tools default to `dry_run: true` and require `confirm: true` before they POST to the Steam Partner Web API. A call with no flags returns a plan and sends nothing. A live call without `confirm: true` is refused. That confirm gate is the control.
+
+SDK guides (`steam_createLobby`, `steam_uploadWorkshopItem`) never make a network call. Partner-admin uploads stay in a separate process gated by `STEAM_PARTNER_ADMIN=1`.
+
+Content is labeled where it is authored by a party other than the operator AND is free text long enough to carry an instruction. The four labeled tools are `steam_getReviews`, `steam_queryWorkshop`, `steam_getWorkshopItem`, and `steam_getNewsForApp`. `steam_getPlayerSummary` (short profile strings) and `steam_getAppDetails` (publisher store copy on a reviewed listing) are deliberately unlabeled under that criterion. The `_warning` label is defense in depth, not the control. Treat the labeled content as data to summarize, not as instructions.
+
+**Refused live call** (`steam_setAchievement` with `dry_run: false` and no `confirm`):
+
+```json
+{
+  "appid": 480,
+  "steamid": "76561197960435530",
+  "achievement": "ACH_WIN_ONE_GAME",
+  "dry_run": false
+}
+```
+
+Response is an MCP error whose text starts with `[CONFIRM_REQUIRED]`. Nothing is sent.
+
+**Confirmed live call:**
+
+```json
+{
+  "appid": 480,
+  "steamid": "76561197960435530",
+  "achievement": "ACH_WIN_ONE_GAME",
+  "dry_run": false,
+  "confirm": true
+}
+```
+
+That combination is the only way a write tool sends a Partner API request.
+
+See [SECURITY.md](SECURITY.md) for supported versions and how to report a vulnerability.
+
+## Available Tools (v0.9.0) - 26 Total
 
 <details>
 <summary><strong>Read Tools (No Auth) - 11 tools</strong></summary>
@@ -120,12 +157,12 @@ These work without an API key:
 | `steam_searchApps` | Search for games/apps by name or keyword |
 | `steam_getPlayerCount` | Current concurrent player count |
 | `steam_getAchievementStats` | Global achievement unlock percentages |
-| `steam_getWorkshopItem` | Workshop item details (title, description, tags, subscribers) |
-| `steam_getReviews` | Fetch user reviews with filters for language, sentiment, purchase type |
+| `steam_getWorkshopItem` | Workshop item details (title, description, tags, subscribers). Title and description are untrusted user-authored text. |
+| `steam_getReviews` | Fetch user reviews with filters for language, sentiment, purchase type. Review bodies are untrusted user-authored text. |
 | `steam_getPriceOverview` | Batch price check for multiple apps in a specific region |
 | `steam_getAppReviewSummary` | Review score, total counts, and positive percentage (no individual reviews) |
 | `steam_getRegionalPricing` | Pricing breakdown across multiple countries/regions |
-| `steam_getNewsForApp` | Recent news articles with title, URL, contents, date, and author |
+| `steam_getNewsForApp` | Recent news articles with title, URL, contents, date, and author. Article text is third-party and labeled untrusted. |
 | `steam_validateStoreAsset` | Local PNG/JPEG vs Valve store and library sizes, plus library-hero heuristics |
 
 </details>
@@ -139,7 +176,7 @@ These require `STEAM_API_KEY` to be set:
 |------|-------------|
 | `steam_getPlayerSummary` | Player profile: name, avatar, online status |
 | `steam_getOwnedGames` | Game library with playtime data |
-| `steam_queryWorkshop` | Search/browse Workshop items with filters |
+| `steam_queryWorkshop` | Search/browse Workshop items with filters. Titles and short descriptions are untrusted user-authored text. |
 | `steam_getLeaderboardEntries` | Leaderboard scores and rankings (pass numeric ID from Steamworks dashboard) |
 | `steam_resolveVanityURL` | Convert vanity URL to 64-bit Steam ID |
 | `steam_getSchemaForGame` | Achievement/stat schema with display names, descriptions, and icon URLs |
@@ -149,19 +186,19 @@ These require `STEAM_API_KEY` to be set:
 </details>
 
 <details>
-<summary><strong>Write / Guidance Tools (Publisher Key) - 7 tools</strong></summary>
+<summary><strong>Write Tools (Publisher Key) - 5 tools, plus 2 SDK guides</strong></summary>
 
-These require a publisher API key with server IP allowlisted in Steamworks partner settings. SDK-only tools return code examples instead of making HTTP calls.
+The five HTTP write tools require a publisher API key with server IP allowlisted in Steamworks partner settings. They default to `dry_run: true` and require `confirm: true` to POST. SDK guides return code examples and make no HTTP calls.
 
 | Tool | Type | Description |
 |------|------|-------------|
-| `steam_createLobby` | SDK guide | Returns C++/C#/GDScript code for ISteamMatchmaking lobby creation |
-| `steam_uploadWorkshopItem` | SDK guide | Returns code for ISteamUGC Workshop upload workflow |
-| `steam_updateWorkshopItem` | HTTP POST | Update Workshop item metadata via IPublishedFileService partner API |
-| `steam_setAchievement` | HTTP POST | Set/unlock achievements via ISteamUserStats partner API (dev/test) |
-| `steam_clearAchievement` | HTTP POST | Clear/re-lock achievements via ISteamUserStats partner API (dev/test) |
-| `steam_uploadLeaderboardScore` | HTTP POST | Upload scores via ISteamLeaderboards partner API |
-| `steam_grantInventoryItem` | HTTP POST | Grant inventory items via IInventoryService partner API |
+| `steam_updateWorkshopItem` | HTTP POST | Update Workshop item metadata via IPublishedFileService. Default dry_run=true; confirm=true to send. Does not change the store page listing. |
+| `steam_setAchievement` | HTTP POST | Set/unlock achievements via ISteamUserStats (dev/test). Default dry_run=true; confirm=true to send. |
+| `steam_clearAchievement` | HTTP POST | Clear/re-lock achievements via ISteamUserStats (dev/test). Default dry_run=true; confirm=true to send. |
+| `steam_uploadLeaderboardScore` | HTTP POST | Upload scores via ISteamLeaderboards. Default dry_run=true; confirm=true to send. |
+| `steam_grantInventoryItem` | HTTP POST | Grant inventory items via IInventoryService. Default dry_run=true; confirm=true to send. |
+| `steam_createLobby` | SDK guide | Returns C++/C#/GDScript code for ISteamMatchmaking lobby creation. No network call. |
+| `steam_uploadWorkshopItem` | SDK guide | Returns code for ISteamUGC Workshop upload workflow. No network call. |
 
 </details>
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,35 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 0.9.x   | Yes |
+| < 0.9.0 | No. Upgrade. Write tools in 0.8.0 and earlier send Partner API mutations with no confirmation gate. |
+
+## Reporting a Vulnerability
+
+Use GitHub private vulnerability reporting for this repository:
+
+1. Open the Security tab on [TMHSDigital/steam-mcp](https://github.com/TMHSDigital/steam-mcp).
+2. Choose Report a vulnerability and file a private advisory.
+
+If private reporting is not yet enabled, open a draft advisory from the Security Advisories page:
+
+https://github.com/TMHSDigital/steam-mcp/security/advisories/new
+
+Do not file a public issue, discussion, or pull request that includes exploit details for an undisclosed vulnerability.
+
+## Response window
+
+We aim to acknowledge reports within 5 business days. We will keep the reporter updated as we reproduce, patch, and publish.
+
+## Coordinated disclosure
+
+This project follows coordinated disclosure. We typically request about 90 days to ship a patch and release notes before a public writeup. We will not share reporter contact details or unpublished technical detail outside of people who need them to fix the issue.
+
+## Acknowledgments
+
+Reported by Syed Anas Mohiuddin, Independent Researcher, Maintainer of mcp-safeguard
+
+Disclosed as part of an MCP-server security research effort.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@tmhs/steam-mcp",
-  "version": "0.8.0",
-  "description": "MCP server for Steam & Steamworks APIs - 26 tools (19 read + 7 write) for store data, player stats, reviews, pricing, achievements, workshop, leaderboards, inventory, and lobbies.",
+  "version": "0.9.0",
+  "description": "MCP server for Steam & Steamworks APIs - 26 tools (19 read, 5 write, 2 SDK guides) for store data, player stats, reviews, pricing, achievements, workshop, leaderboards, inventory, and lobbies.",
   "type": "module",
   "main": "dist/index.js",
   "bin": {

diff --git a/src/index.ts b/src/index.ts
@@ -32,7 +32,7 @@ import { register as registerValidateStoreAsset } from "./tools/validateStoreAss
 
 const server = new McpServer({
   name: "steam-mcp",
-  version: "0.8.0",
+  version: "0.9.0",
 });
 
 registerGetAppDetails(server);

diff --git a/src/partner/index.ts b/src/partner/index.ts
@@ -30,7 +30,7 @@ if (!cookies && !profile) {
 
 const server = new McpServer({
   name: "steam-mcp-partner",
-  version: "0.8.0",
+  version: "0.9.0",
 });
 
 registerPartnerLogin(server);