Agent Fleet MCP Server

In the server's implementation (`example-mcp-servers/example-python/fastmcp_server.py:72`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: umexpr result = eval(request.expression, {"__builtins__": {}}, {}) if isinstance(result, (int,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server example-mcp-servers/example-python/fastmcp_server.py

In the server's implementation (`example-mcp-servers/example-python/server.py:40`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n only result = eval(expression, {"__builtins__": {}}, {}) return json.dumps({ "success": Tr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server example-mcp-servers/example-python/server.py

In the server's implementation (`dist/cli.js:6677`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const result = Function(`"use strict"; return (${expression})`)(); return { success: true, result };

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli.js

In the server's implementation (`dist/index.js:2444`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const result = Function(`"use strict"; return (${expression})`)(); return { success: true, result };

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`example-mcp-servers/example-python/fastmcp_server.py:72`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: umexpr result = eval(request.expression, {"__builtins__": {}}, {}) if isinstance(result, (int,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server example-mcp-servers/example-python/fastmcp_server.py

In the server's implementation (`example-mcp-servers/example-python/server.py:40`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n only result = eval(expression, {"__builtins__": {}}, {}) return json.dumps({ "success": Tr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server example-mcp-servers/example-python/server.py

In the server's implementation (`memory/tool-templates/data-transformer/data-transformer-tool.ts:396`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { const fn = new Function('data', customFunction); return fn(data); } catch (error: any) { throw ne

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server memory/tool-templates/data-transformer/data-transformer-tool.ts

In the server's implementation (`packages/runtime/src/built-in-tools.ts:147`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const result = Function(`"use strict"; return (${expression})`)(); return { success: true, result };

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server packages/runtime/src/built-in-tools.ts

In the server's implementation (`src/tools/built-in/index.ts:144`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const result = Function(`"use strict"; return (${expression})`)(); return { success: true, result };

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/tools/built-in/index.ts

In the server's implementation (`dist/cli.js:2020`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { exec as exec2 } from "child_process"; import { promisify as promisify2 } from "util"; import { readFile as readFile5,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli.js

In the server's implementation (`dist/index.js:2316`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ; import { exec } from "child_process"; import { promisify } from "util"; import { readFile as readFile3, writeFile as w

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`packages/runtime/src/built-in-tools.ts:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ; import { exec } from 'child_process'; import { promisify } from 'util'; import { readFile, writeFile, readdir } from '

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server packages/runtime/src/built-in-tools.ts

In the server's implementation (`src/agents/agent-repository-manager.ts:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { exec } from 'child_process'; import { promisify } from 'util'; import { writeFile, access, mkdir, cp } from '

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/agents/agent-repository-manager.ts

In the server's implementation (`src/git/git-manager.ts:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { exec } from 'child_process'; import { promisify } from 'util'; import { readFile, access, readdir, stat } fro

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/git/git-manager.ts

In the server's implementation (`src/mcp/mcp-bundler.ts:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ; import { exec } from 'child_process'; import { promisify } from 'util'; import type { MCPServerConfig } from '../types

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp/mcp-bundler.ts

In the server's implementation (`src/tools/built-in/index.ts:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ; import { exec } from 'child_process'; import { promisify } from 'util'; import { readFile, writeFile, readdir } from '

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/tools/built-in/index.ts

In the server's implementation (`src/web/server.ts:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from 'child_process'; import type { AgentManifest } from '../types/index.js'; import dotenv from 'dote

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/web/server.ts

Untrusted-input tools ([fetch_data, coda_get_page]) co-exist with external-action tools ([coda_create_webhook, coda_delete_webhook, coda_trigger_automation, linear_create_issue, slack_send_message, slack_upload_file]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [fetch_data, coda_get_page] → sinks [coda_create_webhook, coda_delete_webhook, coda_trigger_automation, linear_create_issue, slack_send_message, slack

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow fetch_data → coda_create_webhook

In the server's implementation (`src/web/server.ts:136`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch('https://oauth2.googleapis.com/token', { method: 'POST', headers: { 'C

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/web/server.ts