Amicus MCP Server

In the server's implementation (`src/amicus/sdk/core/redaction.py:15`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: .env$|.*\.pem$|.*\.key$|id_rsa|id_ed25519|.*\.p12$)", re.IGNORECASE, ) # Inline secret-value shapes redacted within

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/amicus/sdk/core/redaction.py

In the server's implementation (`src/amicus/obs.py:133`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 's free-form filename (`exec(compile(src, "<anything>", ...))`) but does not prove the code was READ from that file.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/amicus/obs.py

In the server's implementation (`src/amicus/backends/claude/cli.py:192`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: proc = subprocess.run( [binary, *contract.AUTH_STATUS_ARGS], capture_output=Tru

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/amicus/backends/claude/cli.py

In the server's implementation (`src/amicus/jobs/store.py:657`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: proc = subprocess.Popen( cmd, cwd=str(jd),

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/amicus/jobs/store.py

In the server's implementation (`src/amicus/manifest.py:246`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rement_env() proc = subprocess.Popen( _SERVER_ARGV, stdin=subprocess.PIPE, stdout=subprocess

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/amicus/manifest.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/sdk/test_gitdiff.py:1227`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , "diff --git a/id_rsa b/config.py", ] probe = DiffRedactor() retained_out: list[str] = [] for l

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/sdk/test_gitdiff.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/sdk/test_redaction.py:2208`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ( "diff --git a/id_rsa b/config.py\n" "diff --git a/config.py b/config.py\n" "--- a/config.py\n+

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/sdk/test_redaction.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_log_redaction.py:322`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: amespace: dict = {} exec(compile("def boom():\n raise RuntimeError('x')\n", f"<{MARKER}>", "exec"), namespace)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_log_redaction.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/capture_claude_differentials.py:308`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: () -> int: commit = subprocess.run( ["git", "log", "-1", "--format=%h"], capture_output=True, text=True, che

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/capture_claude_differentials.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/capture_codex_differentials.py:239`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: () -> int: commit = subprocess.run( ["git", "log", "-1", "--format=%h"], capture_output=True, text=True, che

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/capture_codex_differentials.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/capture_kimi_differentials.py:241`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: () -> int: commit = subprocess.run( ["git", "log", "-1", "--format=%h"], capture_output=True, text=True, che

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/capture_kimi_differentials.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/check_backend_compat.py:146`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: done = subprocess.run( ["npm", "view", package, "version"], capture_output=True

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/check_backend_compat.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/check_release_state.py:833`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: OOT) -> str: return subprocess.run( ["git", *args], cwd=repo_root, capture_output=True, text=True, check=Tru

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/check_release_state.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/probe_review_surface.py:165`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ver. """ proc = subprocess.Popen( [sys.executable, "-c", "from amicus.server import main; main()"],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/probe_review_surface.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/record_live_gate_evidence.py:121`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rocess[str]: return subprocess.run(["git", *args], cwd=REPO_ROOT, capture_output=True, text=True, check=True) def

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/record_live_gate_evidence.py