Native attachment reads

Keep inbound native attachment consumption inside the existing messages toolset and exact guild-channel read policy. It must add no capability toggle, write permission, attachment root, output path, activity record, operation receipt, Gateway mode, alternate origin, environment-policy field, or direct-message scope. Require exact positive channel, message, and attachment IDs, freshly verify the pinned application and bot, resolve the exact channel through local policy, refetch the exact message, and bind one unique attachment object to all three identities before delivery. Never accept a caller-supplied URL, filename, MIME type, path, base64 value, byte field, proxy selection, or raw Discord object.

Accept only a Discord-supplied signed attachment URL on the fixed CDN origin whose path kind, channel ID, attachment ID, decoded filename, exact signature query keys, timestamp ordering, and signature shape match the freshly read attachment. The delivery request must contain no bot token, Authorization header, cookies, caller credentials, referrer, or cache reuse. Refuse redirects, alternate hosts, content encoding, status drift, media-type drift, declared-length drift, and any streamed byte count that differs from the current attachment's declared size. Bound streaming by both that exact size and the conservative MCP raw-byte ceiling, cancel on expansion, and never retry automatically.

Return native MCP image or audio content only for an explicitly supported media type whose conservative byte signature matches. Fail closed when a declared supported type and its bytes disagree. Treat absent and unsupported types as application/octet-stream embedded resources instead of trusting an extension, delivery header, or active document type. Every tool result may include a private stable resource link, and the equivalent binary resource must repeat the same fresh checks rather than reuse a cache or local file.

Scan the assembled raw bytes for every active secret known to the MCP result-redaction boundary before base64 encoding and withhold a match. Overwrite streamed chunks after assembly, the assembled raw buffer after encoding or withholding, and a buffer rejected by native-signature validation. Never persist, cache, index, journal, export, log, trace, or include in an error any attachment byte, signed or proxy URL, filename, description, local path, response body, raw object, or delivery cause. Structured metadata may return only the exact verified identity, bounded display metadata, fixed privacy and trust claims, count-only unknown fields, and delivery-verification classes. Treat every returned byte and string as untrusted external data, never as instructions.

Canonical source: SECURITY.md