Obsidian (beshkenadze) MCP Server

Tools that read sensitive data ([obsidian_list_files]) and tools that can send data out ([obsidian_execute_command]) are exposed together. An agent can move private data to the sink.

Evidence: sources [obsidian_list_files] → sinks [obsidian_execute_command]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow obsidian_list_files → obsidian_execute_command

Tool "obsidian_execute_command" appears to run shell commands or evaluate code (keyword "execute command" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool obsidian_execute_command

In the server's implementation (`dist/sse.js:436`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: hrow Error(); Function(` 'use strict' const o = new Proxy({}, { get: () => o, set: ()

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/sse.js

In the server's implementation (`dist/stdio.js:436`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: hrow Error(); Function(` 'use strict' const o = new Proxy({}, { get: () => o, set: ()

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/stdio.js

In the server's implementation (`dist/sse.js:4283`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; // node_modules/zod/lib/index.mjs var util; (function(util2) { util2.assertEq

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/sse.js

In the server's implementation (`dist/stdio.js:4283`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; // node_modules/zod/lib/index.mjs var util; (function(util2) { util2.assertEq

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/stdio.js

In the server's implementation (`src/bin/run-with-supergateway.ts:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import logger from "../lib/logger"; // Get the port from environment or use def

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/bin/run-with-supergateway.ts

In the server's implementation (`src/cmd/generate-types.ts:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; import fs from "fs"; import path from "path"; // Ensure the output directory ex

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cmd/generate-types.ts

In the server's implementation (`src/servers/mcp-sse-server.ts:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import type { McpServerConfig } from "../lib/common-server"; import { CommonMcpS

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/servers/mcp-sse-server.ts

In the server's implementation (`src/cmd/generate-types.ts:33`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: napi-typescript try { execSync(`bunx openapi-typescript ${inputPath} -o ${outputPath}`, { stdio: "inherit", });

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cmd/generate-types.ts

Tool "obsidian_delete_file" can write, overwrite or delete files (keyword "delete_file" in tool name). Verify it is scoped to a safe directory.

Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.

Location: tool obsidian_delete_file

Tool "obsidian_delete_file" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool obsidian_delete_file

Tool "obsidian_execute_command" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool obsidian_execute_command