Back to Home
wanaku-ai icon

wanaku

by wanaku-ai

Overview

A Model Context Protocol (MCP) Router that centralizes routing and resource management for AI agents, connecting them to various enterprise systems and tools via pluggable capabilities.

Installation

Run Command
wanaku start local --capabilities-client-secret=<your-keycloak-client-secret>

Environment Variables

  • AUTH_SERVER
  • QUARKUS_OIDC_CLIENT_CREDENTIALS_SECRET
  • WANAKU_SECRETS_ENCRYPTION_PASSWORD
  • WANAKU_SECRETS_ENCRYPTION_SALT

Security Notes

CRITICAL RISK: The 'wanaku-tool-service-exec' capability, included in the source, allows arbitrary command execution via `ProcessRunner.runWithOutput(arguments)` with explicitly no input validation. This is a severe vulnerability if an attacker can control the input URI to an 'exec' type tool. Developers are warned to 'use carefully', but this inherent danger in a provided component significantly reduces overall system safety. Other risks include default/hardcoded secrets in development/test configurations (e.g., Keycloak admin credentials, OIDC client secret) and disabling TLS verification for OIDC in development, both requiring careful handling in production. The system relies on an external Keycloak instance, and its misconfiguration could introduce further vulnerabilities. Currently, authenticated users have admin access to all tools and resources without fine-grained control.

Similar Servers

Stats

Interest Score50
Security Score4
Cost ClassLow
Stars90
Forks32
Last Update2025-12-02

Tags

AIMCPRouterAgenticIntegration