Bot Relay MCP Server

Tool "spawn_agent" appears to run shell commands or evaluate code (keyword "spawn" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool spawn_agent

In the server's implementation (`dist/backup.js:33`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort { spawnSync } from "child_process"; import { withDeadline } from "./http-deadline.js"; import { getDbPath, getDb, cl

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/backup.js

In the server's implementation (`dist/cli/init.js:39`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFileSync } from "child_process"; import readline from "readline/promises"; import { ensureSecureDir, ensureSecure

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/init.js

In the server's implementation (`dist/cli/open.js:20`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; function parseArgs(argv) { const out = { url: null, help: false }; for (

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/open.js

In the server's implementation (`dist/cli/restart.js:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFileSync } from "child_process"; import { CANONICAL_LABEL, plistPathFor, parseLoadedRelayLabels, chooseRestartTar

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/restart.js

In the server's implementation (`dist/focus/dispatcher.js:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import { existsSync } from "fs"; import { log } from "../logger.js"; import { ma

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/focus/dispatcher.js

In the server's implementation (`dist/liveness.js:42`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from "node:child_process"; import { log } from "./logger.js"; import { profileProcessPatternSource } from "

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/liveness.js

In the server's implementation (`dist/mcp-prompts.js:48`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: off a brief. macOS-only spawn (see spawn_agent docs); on Linux/Windows, the operator starts the new terminal manually.",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/mcp-prompts.js

In the server's implementation (`dist/spawn/dispatcher.js:20`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: pawn as cpSpawn } from "child_process"; import { execSync } from "child_process"; import { log } from "../logger.js"; im

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/spawn/dispatcher.js

In the server's implementation (`dist/sqlite-compat.js:134`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: his.db, sql); } exec(sql) { this.db.run(sql); // v2.0 beta: respect txDepth so exec() inside a t

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/sqlite-compat.js

Untrusted-input tools ([task_schema_get]) co-exist with external-action tools ([abandon_registration, spawn_agent, send_message, register_webhook, delete_webhook]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [task_schema_get] → sinks [abandon_registration, spawn_agent, send_message, register_webhook, delete_webhook]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow task_schema_get → abandon_registration

In the server's implementation (`dist/backup.js:196`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`http://${host}:${port}/health`, { signal }); return res.ok; }); }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/backup.js

In the server's implementation (`dist/cli/doctor.js:135`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`http://${host}:${port}/health`, { signal }); if (!res.ok) ret

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/doctor.js

In the server's implementation (`dist/cli/watch.js:159`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`http://${host}:${port}/health`, { signal }); if (!res.ok) ret

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/watch.js

Tool "spawn_agent" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool spawn_agent