Agentdb MCP Server

In the server's implementation (`dist/src/cli/agentdb-cli.js:1757`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawn } = await import('child_process'); const serverProcess = spawn('node', [mcpServerPath], { stdi

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/cli/agentdb-cli.js

In the server's implementation (`dist/src/cli/commands/install-embeddings.js:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort { spawnSync } from 'child_process'; // Color codes for beautiful output const colors = { reset: '\x1b[0m', b

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/cli/commands/install-embeddings.js

In the server's implementation (`dist/src/db-fallback.js:377`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: pper; } exec(sql) { return this.db.exec(sql); } save() { // Save

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/db-fallback.js

In the server's implementation (`dist/src/controllers/EmbeddingService.js:214`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch('https://api.openai.com/v1/embeddings', { method: 'POST', headers:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/controllers/EmbeddingService.js

In the server's implementation (`dist/src/services/LLMRouter.js:383`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch('https://openrouter.ai/api/v1/chat/completions', { method: 'POST',

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/services/LLMRouter.js

In the server's implementation (`dist/src/backends/ruvector/RuVectorBackend.js:303`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: mmapModule = await import(moduleName); } catch { // mmap-io not available,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/backends/ruvector/RuVectorBackend.js

In the server's implementation (`dist/src/browser/HNSWIndex.js:338`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: x from JSON */ import(json) { const data = JSON.parse(json); this.config = data.config;

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/browser/HNSWIndex.js

In the server's implementation (`dist/src/cli/agentdb-cli.js:1526`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: initScenario } = await import(runnerUrl); const subcommand = args[1]; if (!subcommand || subcom

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/cli/agentdb-cli.js

In the server's implementation (`dist/src/cli/commands/doctor.js:152`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { require(mod.module); console.log(` ✅ ${mod.name} available`); passedChe

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/cli/commands/doctor.js

In the server's implementation (`dist/src/cli/lib/config-manager.js:498`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: SON string. */ import(json) { const config = JSON.parse(json); return this.validate(config);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/cli/lib/config-manager.js

In the server's implementation (`dist/src/cli/lib/report-store.js:392`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: JSON. */ async import(json) { const results = JSON.parse(json); const ids = []; for (co

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/cli/lib/report-store.js

In the server's implementation (`dist/src/cli/lib/simulation-registry.js:99`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const module = await import(filePath); const scenario = module.default || module;

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/cli/lib/simulation-registry.js

In the server's implementation (`dist/src/cli/lib/simulation-runner.js:107`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const module = await import(fullPath); return module.default || module; }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/cli/lib/simulation-runner.js

In the server's implementation (`dist/src/controllers/WASMVectorSearch.js:129`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: onst wasmModule = await import(normalizedPath); const ReasoningBankWasm = wasmModule.ReasoningBankWasm |

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/controllers/WASMVectorSearch.js

In the server's implementation (`dist/src/optimizations/ToolCache.js:211`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ersistence) */ import(entries) { const now = Date.now(); let imported = 0; for (const {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/optimizations/ToolCache.js

"agentdb" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node scripts/postinstall.cjs || true

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package agentdb