Backlog (gkoreli) MCP Server

In the server's implementation (`dist/cli/bridge.mjs:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; //#region src/cli/bridge.ts async function runBridge(port) { await ensureServer

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/bridge.mjs

In the server's implementation (`dist/cli/server-manager.mjs:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { request } from "node:http"; //#region src/cli/server-manager.ts const s

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/server-manager.mjs

In the server's implementation (`dist/server/port-collision.mjs:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from "node:child_process"; import { connect } from "node:net"; //#region src/server/port-collision.ts /** *

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/server/port-collision.mjs

In the server's implementation (`dist/storage/local/git-runner.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; //#region src/storage/local/git-runner.ts /** * The one injectable git-plumbing

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/storage/local/git-runner.mjs

In the server's implementation (`dist/viewer/assets/index-gxnsLQ1C.js:343`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: r??{}}s||(this.#e=this)}exec(t){if(!this.#e){const{lazyCompile:s,...o}=this.rawOptions;this.#e=new to(this.#r,this.flags

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/viewer/assets/index-gxnsLQ1C.js

In the server's implementation (`dist/auth/oauth-routes.mjs:159`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const userResp = await fetch("https://api.github.com/user", { headers: { Authorization: `Bearer ${githubAccessToken}

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/auth/oauth-routes.mjs

In the server's implementation (`dist/server/port-collision.mjs:190`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { try { const pids = execSync(`lsof -ti TCP:${targetPort} -sTCP:LISTEN`, { encoding: "utf-8" }).trim().split("\n").ma

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/server/port-collision.mjs