Claude Flow (ruvnet) MCP Server

In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/analyze.js:297`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: securityIssues.push('new Function()'); fileStats.push({ file: filePath,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/commands/analyze.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/neural.js:1445`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 'eval(', 'Function(', 'exec(', 'spawn(', 'child_process', 'rm -rf', 'sudo',

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/commands/neural.js

In the server's implementation (`.claude/helpers/github-safe.js:22`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: c, execFileSync } from 'child_process'; import { writeFileSync, unlinkSync } from 'fs'; import { tmpdir } from 'os'; imp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server .claude/helpers/github-safe.js

In the server's implementation (`.claude/helpers/hook-handler.cjs:82`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require('child_process'); const cliBin = resolveCliBinForHook(); const cmd = process.platform ===

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server .claude/helpers/hook-handler.cjs

In the server's implementation (`.claude/helpers/statusline.cjs:25`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); const os = require('os'); // Configuration const CONFIG = { maxAgents:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server .claude/helpers/statusline.cjs

In the server's implementation (`v3/@claude-flow/cli/dist/src/appliance/rvfa-builder.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from 'node:child_process'; import { RvfaWriter, } from './rvfa-format.js'; // ── Encryption Constants ─────

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/appliance/rvfa-builder.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/appliance/rvfa-runner.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from 'node:child_process'; import { tmpdir } from 'node:os'; import { RvfaReader } from './rvfa-format.js';

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/appliance/rvfa-runner.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/doctor.js:1666`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const resp = await fetch(`http://${bind}/status`, { headers: { authorization: `Bearer ${token}` },

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/commands/doctor.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/neural.js:1153`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch('https://api.pinata.cloud/pinning/pinJSONToIPFS', { method: 'POST',

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/commands/neural.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js:166`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch('https://api.anthropic.com/v1/messages', { method: 'POST', headers

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/update/checker.js:35`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, { headers: {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/update/checker.js

In the server's implementation (`.claude/helpers/hook-handler.cjs:222`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y { const mod = require(modulePath); return mod; } finally { console.log = origLog;

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server .claude/helpers/hook-handler.cjs

In the server's implementation (`v3/@claude-flow/cli/dist/src/appliance/ruvllm-bridge.js:249`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return await import(pkg); } catch { return null; } } /** Tier-1 A

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/appliance/ruvllm-bridge.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/agntcy/publish.js:101`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const mod = (await import(AGNTCY_PACKAGE_NAME)); if (typeof mod.publishAgentRecord !== 'function') {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/commands/agntcy/publish.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/agntcy/runtime.js:93`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 0 forbid. await import(packageName); return { configured: true, reason: `${packageName} resolved`, endpo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/commands/agntcy/runtime.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/appliance.js:27`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const mod = await import(path); return mod[exportName]; } catch { output.printError(`RVFA

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/commands/appliance.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/doctor.js:1167`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const mod = await import(specifier); if (!mod.FederationNodeState) { return {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/commands/doctor.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/init.js:52`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: async () => (await import(codexModuleId)).CodexInitializer, // Strategy 2: Project node_modules (works if i

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/commands/init.js

In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/memory-distill.js:230`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Database = (await import(mod)).default; } catch { output.writeln(output.warning('bette

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/commands/memory-distill.js

In a packaging/dev/install script (shipped, but not the server runtime) (`.claude-plugin/scripts/ruflo-hook.cjs:27`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , execSync } = require('child_process'); const fs = require('fs'); const path = require('path'); /** Exit 0 uncondition

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server .claude-plugin/scripts/ruflo-hook.cjs

In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-agent.js:44`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from 'node:child_process'; import * as fs from 'node:fs'; import * as path from 'node:path'; import { SMOKE

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/benchmarks/gaia-agent.js

In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-critic.js:35`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from 'node:child_process'; import { runGaiaAgent, } from './gaia-agent.js'; // ----------------------------

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/benchmarks/gaia-critic.js

In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-decomposer.js:36`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from 'node:child_process'; // --------------------------------------------------------------------------- /

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/benchmarks/gaia-decomposer.js

In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-judge.js:30`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from 'node:child_process'; // --------------------------------------------------------------------------- /

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/benchmarks/gaia-judge.js

In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.js:237`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ed weights. */ import(state) { if (!Array.isArray(state.weights) || state.weights.length !=

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.js

In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.smoke.js:185`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ictor(); predictor2.import(exported); assert.equal(predictor2.isTrained, true, 'imported predictor should be tra

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.smoke.js