Shopify Mcp Admin MCP Server

In the server's implementation (`dist/dashboard/assets/blade-DVc8C-J4.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: mns|prepare|error(msg)?|exec(ute)?|field_(scale|num|name|type|precision|len)|foreignkeys|free_result|fetch_(into|object|

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/dashboard/assets/blade-DVc8C-J4.js

In the server's implementation (`dist/dashboard/assets/cobol-nwyudZeR.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e.cobol"},{"begin":"(?i:exec(?:\\\\s+sqlims|\\\\s+sql))","contentName":"meta.embedded.block.openesql","end":"(?i:end-exe

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/dashboard/assets/cobol-nwyudZeR.js

In the server's implementation (`dist/dashboard/assets/code-block-QI2IAROF-DewX0Js5.js:153`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n??{}}i||(this.#e=this)}exec(e){if(!this.#e){const{lazyCompile:i,...s}=this.rawOptions;this.#e=new $t(this.#n,this.flags

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/dashboard/assets/code-block-QI2IAROF-DewX0Js5.js

In the server's implementation (`dist/dashboard/assets/php-CDn_0X-4.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: mns|prepare|error(msg)?|exec(ute)?|field_(scale|num|name|type|precision|len)|foreignkeys|free_result|fetch_(into|object|

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/dashboard/assets/php-CDn_0X-4.js

In the server's implementation (`dist/index.js:7552`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t tokenResponse = await fetch(`https://${shop}/admin/oauth/access_token`, { method: "POST", headers: {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`dist/setup-wizard-PVLOC3DU.js:145`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t tokenResponse = await fetch(`https://${config.storeUrl}/admin/oauth/access_token`, { method: "POST", h

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/setup-wizard-PVLOC3DU.js

In the server's implementation (`dist/chunk-UMNIRP6T.js:12925`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \u2192 submit-redirect-import (execute). **Prerequisites:** Prepare a CSV file with "path,target" format and host it at

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-UMNIRP6T.js

In the server's implementation (`dist/dashboard/assets/index-dRkb9Ugl.js:12`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t[e.id];try{let n=await import(e.module);return t[e.id]=n,n}catch(n){return console.error(`Error loading route module \`

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/dashboard/assets/index-dRkb9Ugl.js