Db Connect (cagudelo) MCP Server

In the server's implementation (`dist/db/mysql-adapter.js:41`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: || 0 }; } async exec(query) { if (!this.connection) throw new Error("Database not initialize

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/mysql-adapter.js

In the server's implementation (`dist/db/postgresql-adapter.js:53`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: stID }; } async exec(query) { if (!this.client) throw new Error("Database not initialized");

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/postgresql-adapter.js

In the server's implementation (`dist/db/sqlserver-adapter.js:60`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: D: 0 }; } async exec(query) { if (!this.pool) throw new Error("Database not initialized");

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/sqlserver-adapter.js

In the server's implementation (`src/db/adapter.ts:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , lastID: number }>; exec(query: string): Promise<void>; getMetadata(): { name: string, type: string, path?: strin

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/db/adapter.ts

In the server's implementation (`src/db/mysql-adapter.ts:53`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: || 0 }; } async exec(query: string): Promise<void> { if (!this.connection) throw new Error("Database not in

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/db/mysql-adapter.ts

In the server's implementation (`src/db/postgresql-adapter.ts:66`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: stID }; } async exec(query: string): Promise<void> { if (!this.client) throw new Error("Database not initia

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/db/postgresql-adapter.ts

In the server's implementation (`src/db/sqlserver-adapter.ts:72`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: D: 0 }; } async exec(query: string): Promise<void> { if (!this.pool) throw new Error("Database not initiali

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/db/sqlserver-adapter.ts

In the server's implementation (`test-mcp-server.ts:16`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch("https://api.chucknorris.io/jokes/random"); const data = await response.json();

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server test-mcp-server.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/install-check.js:51`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) { try { await import(dep); console.log(`✅ ${dep} - OK`); } catch (error) { console.log(`❌ ${dep}

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/install-check.js