Adeu MCP Server

In the server's implementation (`src/test-rpc.ts:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from "node:child_process"; import { resolve, join } from "node:path"; import { tmpdir } from "node:os"; imp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/test-rpc.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/mcp.schema-gaps.test.ts:23`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from "node:child_process"; import { resolve, join } from "node:path"; import { tmpdir } from "node:os"; imp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp.schema-gaps.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/parity_live.test.ts:120`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import("node:child_process"); const projectRoot = resolve(__dirname, "../../../.."); const pythonCli

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/parity_live.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/repro.feedback.test.ts:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from "node:child_process"; import { resolve, join, basename, dirname } from "node:path"; import { tmpdir }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/repro.feedback.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/repro.qa_2026_07_18.test.ts:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from "node:child_process"; import { resolve, join } from "node:path"; import { tmpdir } from "node:os"; imp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/repro.qa_2026_07_18.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/repro.qa_2026_07_23.finalize.test.ts:34`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from "node:child_process"; import { resolve } from "node:path"; import { existsSync } from "node:fs"; desc

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/repro.qa_2026_07_23.finalize.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/repro.qa_report_v8.test.ts:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { existsSync } from "node:fs"; import { resolve } from "node:path"; impor

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/repro.qa_report_v8.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/repro_qa_round3_2026_07_24.test.ts:32`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from "node:child_process"; import { resolve, join } from "node:path"; import { tmpdir } from "node:os"; imp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/repro_qa_round3_2026_07_24.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/spec_2026_07_28.test.ts:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from "node:child_process"; import { resolve } from "node:path"; import { fileURLToPath } from "node:url";

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/spec_2026_07_28.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`tsup.config.ts:25`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from "node:child_process"; let gitSha = "unknown"; try { gitSha = execSync("git rev-parse --short HEAD",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tsup.config.ts