AKADATA LIMITED
AKAMAN Validation and Security Tests
AKAMAN input validation, protocol tests, non-execution behaviour, and current transport status.
AKAMAN
A small Linux C utility that retrieves the compact documentation fragment an AI agent needs from the host where it is running.
Validation and security
The dated v0.1.0 test report records 217 passed, 0 failed on 2026-08-11. The tested scope covers the CLI, the MCP stdio transport, and the webMCP HTTP transport.
Coverage includes:
- man-page discovery, sections, subcommands, options, and bundled options,
- progressive disclosure,
- the
docandheaderssources, including traversal and symlink-escape checks, - MCP
initialize,ping,tools/list,tools/call, - malformed requests, invalid UTF-8, and oversized requests,
- CLI/MCP response consistency (parity),
- HTTP authentication, method rejection, and invalid bind-address handling,
- shell-metacharacter and command-substitution-shaped input,
- SQL-injection-shaped and XSS-shaped strings,
- token budgets, and benchmark checks.
What the injection tests prove
SQL-injection-shaped inputs such as ' OR '1'='1 and x' UNION SELECT NULL-- are treated as inert data and return no-match responses. The XSS-shaped payload ><script>alert(1)</script> is likewise treated as data: it returns a rejection or no-match and produces valid JSON with valid MCP text content. AKAMAN contains no SQL database and no HTML renderer, so these are input-handling and non-execution checks — not claims of database or browser security.
Scope of the security claims
The tests verify bounded parsing, rejection, non-execution, and protocol integrity. Queries are not executed through a shell (external commands run via argv, not a shell). AKAMAN is not a sandbox. Documentation is treated as data and is never executed.