Per-framework vulnerability guides — remediation examples for LangChain, CrewAI, MCP, OpenAI, Vercel AI

[JBAhire]

Summary

Create framework-specific vulnerability guides that show developers exactly how to fix g0 findings in their framework. Currently findings say "what's wrong" but not "here's the fix in your framework."

Motivation

g0 detects findings across 10 frameworks, but the remediation advice is generic. A LangChain developer needs different fix patterns than a CrewAI developer. For example:

• "Shared memory between users" → fix in LangChain uses ConversationBufferMemory(memory_key=user_id), fix in CrewAI uses agent-scoped memory
• "No input validation on tool" → fix in MCP uses inputSchema with JSON Schema, fix in LangChain uses Pydantic models
• "System prompt has no scope boundaries" → fix patterns differ by framework

Proposed Content

Per-Framework Guides

Create one guide per major framework:

1. LangChain/LangGraph (docs/frameworks/langchain.md)

   • Top 10 findings and LangChain-specific fixes
   • Memory isolation patterns
   • Tool input validation with Pydantic
   • Agent scope boundaries in LangGraph
   • Safe ReAct agent patterns

2. CrewAI (docs/frameworks/crewai.md)

   • Crew/agent/task security patterns
   • Role-based access in multi-agent crews
   • Tool permission scoping
   • Memory isolation between agents

3. MCP (docs/frameworks/mcp.md)

   • Tool description security (rug-pull prevention)
   • Input schema validation best practices
   • Server configuration hardening
   • Transport security (stdio vs SSE vs HTTP)

4. OpenAI Agents SDK (docs/frameworks/openai.md)

   • Agent instruction boundaries
   • Tool call validation
   • Guardrail implementation
   • Handoff security patterns

5. Vercel AI SDK (docs/frameworks/vercel-ai.md)

   • Tool result validation
   • Streaming response security
   • Multi-step agent boundaries

Each Guide Includes

• Top 10 most common findings for that framework
• Before/after code examples showing the fix
• Framework-specific security patterns and anti-patterns
• Links to framework documentation
• Which g0 rules are most relevant

Files to Create

• docs/frameworks/langchain.md
• docs/frameworks/crewai.md
• docs/frameworks/mcp.md
• docs/frameworks/openai.md
• docs/frameworks/vercel-ai.md
• docs/frameworks/README.md — index page
• Update docs/README.md to link to framework guides

Acceptance Criteria

• 5 framework-specific vulnerability guides
• Each guide has 10+ before/after code fix examples
• Covers the most common findings per framework
• Linked from docs index and relevant rule documentation