Mikrotik (ai-solutions.ru) MCP Server

Tools that read sensitive data ([get_logs]) and tools that can send data out ([execute_command, schedule_tasks]) are exposed together. An agent can move private data to the sink.

Evidence: sources [get_logs] → sinks [execute_command, schedule_tasks]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow get_logs → execute_command

Tool "execute_command" appears to run shell commands or evaluate code (keyword "execute command" in tool name, parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool execute_command

Tool "schedule_tasks" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool schedule_tasks

In the server's implementation (`dist/cli/commands/claude.js:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t(require("os")); const child_process_1 = require("child_process"); const util_1 = require("util"); const inquirer_1 = _

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/commands/claude.js

In the server's implementation (`dist/notifications/desktop-notifier.js:39`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: equire("events"); const child_process_1 = require("child_process"); const util_1 = require("util"); const os = __importS

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/notifications/desktop-notifier.js

Tool "execute_command" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool execute_command · inputSchema.properties.command

Tool "schedule_tasks" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool schedule_tasks · inputSchema.properties.script

Tool "execute_command" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool execute_command

Tool "schedule_tasks" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool schedule_tasks

In a packaging/dev/install script (shipped, but not the server runtime) (`test/test-real-routeros.mjs:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from 'child_process'; import readline from 'readline'; // Set test environment process.env.MIKROTIK_H

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server test/test-real-routeros.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`test/test-v2-complete.mjs:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from 'child_process'; import readline from 'readline'; console.log('🧪 Complete Testing of MikroTik M

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server test/test-v2-complete.mjs

"@ai-solutions.ru/mikrotik-mcp-server" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node scripts/postinstall.js

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package @ai-solutions.ru/mikrotik-mcp-server