Algochains MCP Server

In the server's implementation (`src/algochains_mcp/data_ingestion.py:324`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ".env.production", "id_dsa", "id_ecdsa", "id_ed25519", "id_rsa", "known_hosts", "oauth_tokens.js

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/data_ingestion.py

In the server's implementation (`algoclaw/cli.py:236`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } ps = subprocess.run(["ps", "aux"], capture_output=True, text=True) for symbol, proc_name in b

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server algoclaw/cli.py

In the server's implementation (`src/algochains_mcp/adaptive_brain_status.py:163`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ps_output = subprocess.run( ["ps", "aux"], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/adaptive_brain_status.py

In the server's implementation (`src/algochains_mcp/agent_swarm/agent_orchestrator.py:20`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ct] = {} async def spawn(self, name: str, role: str, strategy: str | None = None, capital_allocation: float | None

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/agent_swarm/agent_orchestrator.py

In the server's implementation (`src/algochains_mcp/http_bridge.py:1175`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y: result = subprocess.run( ["pgrep", "-f", pattern], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/http_bridge.py

In the server's implementation (`src/algochains_mcp/live_bot_intelligence/bot_ops.py:406`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: lt = {} ps_output = subprocess.run(["ps", "aux"], capture_output=True, text=True, timeout=5).stdout running_bots

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/live_bot_intelligence/bot_ops.py

In the server's implementation (`src/algochains_mcp/live_bot_intelligence/heartbeat.py:124`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y: result = subprocess.run( ["ps", "aux"], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/live_bot_intelligence/heartbeat.py

In the server's implementation (`src/algochains_mcp/server.py:9303`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: proc = subprocess.run( [_sys.executable, "-c", script], cwd=con

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/server.py

In the server's implementation (`src/algochains_mcp/trading_system_health.py:69`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ps_output = subprocess.run( ["ps", "aux"], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/trading_system_health.py

In the server's implementation (`src/cli/src/auth.ts:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; import { CREDENTIALS_FILE } from "./config.js"; export type BrokerService = "tr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/src/auth.ts

In the server's implementation (`src/cli/src/commands/daemon.ts:202`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawn } = await import("child_process"); const child = spawn(process.execPath, [process.argv[1], "_daemon-internal-sta

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/src/commands/daemon.ts

In the server's implementation (`src/cli/src/commands/auth_cmd.ts:127`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch("https://paper-api.alpaca.markets/v2/account", { headers: { "APCA-API-KEY-ID": k

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/src/commands/auth_cmd.ts

In the server's implementation (`src/cli/src/commands/daemon.ts:306`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort("child_process"); execSync(`launchctl load ${LAUNCHD_PLIST_PATH}`); console.log(` ✓ Daemon registered as launch

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/src/commands/daemon.ts

In the server's implementation (`src/cli/src/commands/doctor.ts:137`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { const out = execSync(`${cmd} --version`, { encoding: "utf-8" }).trim(); const [, maj, min] = out.match

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/src/commands/doctor.ts

In the server's implementation (`src/cli/src/index.ts:377`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: cess"); try { execSync(`python3 scripts/quickstart.py --generate-config ${target}`, { stdio: "inherit", cwd: p

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/src/index.ts

In the server's implementation (`src/cli/src/plugins/manager.ts:124`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort("child_process"); execSync(`tar -xzf "${tarPath}" -C "${pluginDir}" --strip-components=1`); rmSync(tarPath);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/src/plugins/manager.ts

In the server's implementation (`src/algochains_mcp/tournament/numerai/run_pipeline.py:188`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: _, val_split = __import__( "algochains_mcp.tournament.numerai.era_utils", fromlist=["era_split"]

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/tournament/numerai/run_pipeline.py

In the server's implementation (`src/algochains_mcp/tournament/numerai/model_zoo.py:205`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: artifact = pickle.load(f) model = artifact["model"] model_feats = artifact["featur

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/tournament/numerai/model_zoo.py

In the server's implementation (`src/algochains_mcp/tournament/numerai/train.py:188`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ") as f: return pickle.load(f) def predict(model_artifact: dict, live_df: pd.DataFrame) -> pd.Series: """

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/algochains_mcp/tournament/numerai/train.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/quickstart.py:128`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: __import__(mod) _ok(f"import {mod}") except ImportError: _fail(f

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/quickstart.py