Codegraph (nahisaho) MCP Server

Tools that read sensitive data ([read_file_content]) and tools that can send data out ([execute_shell_command]) are exposed together. An agent can move private data to the sink.

Evidence: sources [read_file_content] → sinks [execute_shell_command]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow read_file_content → execute_shell_command

Tool "execute_shell_command" appears to run shell commands or evaluate code (keyword "execute shell" in tool name, parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool execute_shell_command

In the server's implementation (`src/codegraph_mcp/__main__.py:263`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: log: process = subprocess.Popen( cmd, stdout=log, stderr=subprocess.STDOUT,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/codegraph_mcp/__main__.py

Tool "execute_shell_command" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool execute_shell_command · inputSchema.properties.command

Tool "execute_shell_command" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool execute_shell_command

Tool "read_file_content" takes a path parameter "file_path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.

Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.

Location: tool read_file_content · inputSchema.properties.file_path

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/conftest.py:34`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import subprocess subprocess.run( ["git", "init"], cwd=temp_dir, capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/conftest.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/e2e/test_scenarios.py:158`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) # Git commit subprocess.run(["git", "add", "."], check=False, cwd=repo_path, capture_output=True) subproc

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/e2e/test_scenarios.py