Carto Md MCP Server

In the server's implementation (`src/security/ignore.js:24`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: be caught by *.key) 'id_rsa', 'id_rsa.pub', 'id_ed25519', 'id_ed25519.pub', 'id_ecdsa', 'id_ecdsa.pub', '

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/security/ignore.js

In the server's implementation (`src/acp/safety.js:22`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } = require('child_process'); const DEFAULT_TIMEOUT_MS = 30_000; const DEFAULT_MAX_OUTPUT_BYTES = 1_048_576;

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/acp/safety.js

In the server's implementation (`src/anci/git-meta.js:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } = require('child_process'); /** * git(root, args) → trimmed stdout string, or null on any failure. */ fu

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/anci/git-meta.js

In the server's implementation (`src/brain/procedural/index.js:49`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } = require('child_process'); let log; try { log = execFileSync('git', [ '-C', temporalStore._p

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/brain/procedural/index.js

In the server's implementation (`src/brain/working/index.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } = require('child_process'); /** * getUncommittedFiles(projectRoot) → Array<{ path, change_kind }> * * U

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/brain/working/index.js

In the server's implementation (`src/cli/check.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); const path = require('path'); const fs = require('fs'); const { SQLiteStore } =

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/check.js

In the server's implementation (`src/cli/init.js:372`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } = require('child_process'); const cmd = process.platform === 'win32' ? 'where' : 'which'; const r =

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/init.js

In the server's implementation (`src/cli/pr-impact.js:35`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } = require('child_process'); const { SQLiteStore } = require('../store/sqlite-store'); const { StoreAdapter

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/pr-impact.js

In the server's implementation (`src/mcp/middleware/index.js:361`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: s, spawn = require('child_process').spawn, clientIn = process.stdin, clientOut = process.stdout, stderr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp/middleware/index.js

In the server's implementation (`src/predictive/ownership.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } = require('child_process'); function gitLog(projectRoot, args, timeoutMs = 10_000) { try { return ex

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/predictive/ownership.js

In the server's implementation (`src/cli/doctor.js:68`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t err = null; try { require(pkg); loaded = true; } catch (e) { err = e; } results.push({ id: `native-$

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/doctor.js

In the server's implementation (`src/extractors/loader.js:26`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const plugin = require(fullPath); // Validate plugin shape if (typeof plugin.name !== 'string') {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/extractors/loader.js

In the server's implementation (`src/mcp/change-plan.js:888`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: lower-relevance forward import(s) pruned — run \`impact\` on an anchor for the full dependency set._`); } lines.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp/change-plan.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/gen-api-docs.js:28`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e no-new-func return (new Function(`return ${arrayLiteral}`))(); } function loadTools() { // Cheap eval — extract t

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/gen-api-docs.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/postinstall.js:22`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } = require('child_process'); // ---- Static metadata ---- const GRAMMARS = [ { pkg: 'tree-sitter-javascr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/postinstall.js

"carto-md" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node scripts/postinstall.js

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package carto-md