Code Auditor MCP Server

In the server's implementation (`dist/cli.js:3071`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st-grep patterns (e.g. "new Function($$$)").', requiredFields: ['pattern'], }, ]; const SCAFFOLD_CONFIG = {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli.js

In the server's implementation (`dist/auditRunner.js:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from 'child_process'; import { randomUUID } from 'node:crypto'; import { AuditAbortedError, AuditHando

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/auditRunner.js

In the server's implementation (`dist/churn/churnExtractor.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from 'child_process'; import * as path from 'path'; export const DEFAULT_CHURN_CONFIG = { churnWin

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/churn/churnExtractor.js

In the server's implementation (`dist/cli.js:2175`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import('node:child_process'); const { openSync } = await import('node:fs'); const { createAuditJob }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli.js

In the server's implementation (`dist/codeIndexDB.js:3034`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: bulk operations. */ exec(sql) { this.ensureInitialized(); this.db.exec(sql); } } // ── Helpers ─

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/codeIndexDB.js

In the server's implementation (`dist/enforcement/diffGate.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from 'node:child_process'; import { statSync } from 'node:fs'; import path from 'node:path'; /** * Parse `

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/enforcement/diffGate.js

In the server's implementation (`dist/languages/RuntimeManager.js:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t { exec, spawn } from 'child_process'; import { promisify } from 'util'; import * as path from 'path'; import * as fs f

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/languages/RuntimeManager.js

In the server's implementation (`dist/ledger.js:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from 'node:child_process'; import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'; impor

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/ledger.js

In the server's implementation (`dist/mcpAuditJobs.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort { fork } from 'node:child_process'; import { randomUUID } from 'node:crypto'; import { cpus, hostname } from 'node:o

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/mcpAuditJobs.js

In the server's implementation (`dist/native-bootstrap.js:18`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from 'node:child_process'; // ── Musl detection (same logic as @ast-grep/napi's isMusl) ──────────────────

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/native-bootstrap.js

In the server's implementation (`dist/styles/tailwindConfigLoader.js:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from 'node:child_process'; // --------------------------------------------------------------------------- /

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/styles/tailwindConfigLoader.js

In the server's implementation (`dist/auditRunner.js:1060`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const diffOutput = execSync(`git diff --name-only ${ref}`, { cwd: rootDir, stdio: 'pipe',

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/auditRunner.js

In the server's implementation (`dist/churn/churnExtractor.js:92`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const output = execSync(`git log --numstat --format='%H|%an|%at' --since='${sinceStr}'`, { cwd: targetPath, std

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/churn/churnExtractor.js

Tool "overwrite" can write, overwrite or delete files (keyword "overwrite" in tool name). Verify it is scoped to a safe directory.

Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.

Location: tool overwrite

In the server's implementation (`dist/styles/tailwindConfigLoader.js:140`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const config = require(configPath); // Handle default exports const resolved = config.default ?

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/styles/tailwindConfigLoader.js

Tool "overwrite" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool overwrite

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/scripts/runBench.js:643`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st _importDist = (p) => import(p); const callGraphMod = await _importDist('../../dist/graph/callGraph.js

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/scripts/runBench.js