Codeguard (npm) MCP Server

In the server's implementation (`dist/scanners/vulnerability-scanner.js:86`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Deserialization: Using eval() is extremely dangerous', severity: 'critical', cwe: 'CWE-

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/scanners/vulnerability-scanner.js

In the server's implementation (`dist/utils/security-scorer.js:94`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: explanation: 'Never use eval(). Use JSON.parse with proper error handling and validation', tips: [

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/utils/security-scorer.js

In the server's implementation (`src/scanners/vulnerability-scanner.ts:93`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Deserialization: Using eval() is extremely dangerous', severity: 'critical' as SeverityLevel, cwe: 'C

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/scanners/vulnerability-scanner.ts

In the server's implementation (`src/utils/security-scorer.ts:102`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: explanation: 'Never use eval(). Use JSON.parse with proper error handling and validation', tips: [ '

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/utils/security-scorer.ts

In the server's implementation (`dist/scanners/vulnerability-scanner.js:52`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ng template literals in exec()', severity: 'critical', cwe: 'CWE-78', ow

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/scanners/vulnerability-scanner.js

In the server's implementation (`dist/utils/security-scorer.js:73`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nimport { spawn } from 'child_process';\nconst child = spawn('command', [arg1, arg2]);`, explanation: 's

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/utils/security-scorer.js

In the server's implementation (`src/scanners/vulnerability-scanner.ts:57`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ng template literals in exec()', severity: 'critical' as SeverityLevel, cwe: 'CWE-78', owasp:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/scanners/vulnerability-scanner.ts

In the server's implementation (`src/utils/security-scorer.ts:81`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nimport { spawn } from 'child_process';\nconst child = spawn('command', [arg1, arg2]);`, explanation: 'spawn wi

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/utils/security-scorer.ts

A hardcoded Stripe secret key (a live-looking credential hardcoded in shipped code) appears in `examples/test-code.js:17`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: Stripe secret key: sk_l…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server examples/test-code.js

In a packaging/dev/install script (shipped, but not the server runtime) (`examples/test-code.js:23`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nst { exec } = require('child_process'); exec(`ls -la ${userInput}`, (error, stdout) => { console.log(stdout);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server examples/test-code.js