Robloxstudio (6xvl) MCP Server

Tool "breakpoints" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool breakpoints

Tool "eval_server_runtime" appears to run shell commands or evaluate code (keyword "eval" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool eval_server_runtime

Tool "eval_client_runtime" appears to run shell commands or evaluate code (keyword "eval" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool eval_client_runtime

In the server's implementation (`dist/index.js:2389`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFileSync } from "child_process"; import { existsSync as existsSync2, readFileSync, readdirSync, statSync } from "

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`dist/index.js:7340`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch(`https://apis.roblox.com/universes/v1/places/${placeId}/universe`); if (!response.ok)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

Tool "breakpoints" takes a command-shaped parameter "script_path" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool breakpoints · inputSchema.properties.script_path

Tool "eval_server_runtime" takes a command-shaped parameter "code" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool eval_server_runtime · inputSchema.properties.code

Tool "eval_client_runtime" takes a command-shaped parameter "code" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool eval_client_runtime · inputSchema.properties.code

In the server's implementation (`studio-plugin/src/modules/LuauExec.ts:155`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \tend \tlocal function require(module) \t\tlocal history_start = #__mcp_LogService:GetLogHistory() \t\tlocal ok, value

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server studio-plugin/src/modules/LuauExec.ts

In the server's implementation (`studio-plugin/src/modules/handlers/MicroProfilerHandlers.ts:406`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: libOrErr] = pcall(() => require(libModule) as LibMPLike); if (!ok) { return { error: "libmp_require_failed", me

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server studio-plugin/src/modules/handlers/MicroProfilerHandlers.ts

Tool "breakpoints" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool breakpoints

Tool "eval_server_runtime" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool eval_server_runtime

Tool "eval_client_runtime" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool eval_client_runtime