Found while black-box testing the m1k3 CLI (2026-09-18).
$ m1k3 search "$(python3 -c 'print("brain tier "*12000)')" # 130 KB query
→ exit 0 after 43.1 s, 132 KB of stdout (the whole query echoed back in "Nothing relevant … for “…”")
A normal search answers in 0.2–0.4 s. search_knowledge has no input cap, so any local MCP visitor can hold the embedder for the best part of a minute with one call, and gets the payload reflected back. Loopback-only, so the blast radius is "another agent on this Mac" — but the HUD, the chat and ask_m1k3 share that embedder.
Suggested: cap query length at the tool boundary (a few hundred characters is already more than the FTS/embedding lanes can use — see the AND-semantics note on long queries), refuse over-cap with isError, and truncate the echo in the "nothing relevant" line. Worth a sweep of the other free-text tools (remember text, ask_m1k3 question, speak text) for the same shape; the HTTP layer accepted a 130 KB body without complaint.
From the CLI critical-test session of 2026-09-18 (the launch trap itself is #376).
Found while black-box testing the
m1k3CLI (2026-09-18).A normal search answers in 0.2–0.4 s.
search_knowledgehas no input cap, so any local MCP visitor can hold the embedder for the best part of a minute with one call, and gets the payload reflected back. Loopback-only, so the blast radius is "another agent on this Mac" — but the HUD, the chat andask_m1k3share that embedder.Suggested: cap query length at the tool boundary (a few hundred characters is already more than the FTS/embedding lanes can use — see the AND-semantics note on long queries), refuse over-cap with
isError, and truncate the echo in the "nothing relevant" line. Worth a sweep of the other free-text tools (remembertext,ask_m1k3question,speaktext) for the same shape; the HTTP layer accepted a 130 KB body without complaint.From the CLI critical-test session of 2026-09-18 (the launch trap itself is #376).