Codescalpel MCP Server

In the server's implementation (`src/code_scalpel/analysis/code_analyzer.py:1181`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: l": "Code injection via eval()", "exec": "Code injection via exec()", "compile": "Potential code

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/analysis/code_analyzer.py

In the server's implementation (`src/code_scalpel/code_parsers/javascript_parsers/javascript_parsers_esprima.py:35`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ity Analysis: - eval() and Function constructor detection - innerHTML/outerHTML XSS detection -

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/javascript_parsers/javascript_parsers_esprima.py

In the server's implementation (`src/code_scalpel/code_parsers/python_parsers/python_parsers_bandit.py:189`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ": [ "Avoid eval(), exec(), and compile() with user input", "Use ast.literal_eval() for parsing

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/python_parsers/python_parsers_bandit.py

In the server's implementation (`src/code_scalpel/code_parsers/typescript_parsers/analyzer.py:207`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rns detected: - eval() usage - innerHTML assignment - SQL string concatenation - Hardcod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/typescript_parsers/analyzer.py

In the server's implementation (`src/code_scalpel/generators/refactor_simulator.py:156`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: x\\n+def foo(x): return eval(x)' ... ) >>> result.is_safe False >>> result.reason

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/generators/refactor_simulator.py

In the server's implementation (`src/code_scalpel/mcp/helpers/extraction_helpers.py:1965`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ("eval(", "Use of eval() detected - security risk"), ("exec(", "Use of exec() detected - security risk"),

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/mcp/helpers/extraction_helpers.py

In the server's implementation (`src/code_scalpel/mcp/helpers/security_helpers.py:859`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "javascript": "Avoid eval(). Use JSON.parse() for data parsing", "java": "Avoid ScriptEngine with user in

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/mcp/helpers/security_helpers.py

In the server's implementation (`src/code_scalpel/polyglot/typescript/analyzer.py:214`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rns detected: - eval() usage - innerHTML assignment - SQL string concatenation - Hardcod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/polyglot/typescript/analyzer.py

In the server's implementation (`src/code_scalpel/analysis/code_analyzer.py:1182`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: c": "Code injection via exec()", "compile": "Potential code injection via compile()", "__import_

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/analysis/code_analyzer.py

In the server's implementation (`src/code_scalpel/code_parsers/cpp_parsers/cpp_parsers_Clang-Static-Analyzer.py:196`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: clang_output = subprocess.check_output( ["clang-check", "-ast-dump=full", self.file_path],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/cpp_parsers/cpp_parsers_Clang-Static-Analyzer.py

In the server's implementation (`src/code_scalpel/code_parsers/cpp_parsers/cpp_parsers_Cppcheck.py:255`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: aths) result = subprocess.run(cmd, capture_output=True, text=True) # cppcheck writes XML to stderr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/cpp_parsers/cpp_parsers_Cppcheck.py

In the server's implementation (`src/code_scalpel/code_parsers/cpp_parsers/cpp_parsers_clang_tidy.py:170`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ] result = subprocess.run(cmd, capture_output=True, text=True) # clang-tidy diagnostic output i

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/cpp_parsers/cpp_parsers_clang_tidy.py

In the server's implementation (`src/code_scalpel/code_parsers/cpp_parsers/cpp_parsers_cpplint.py:175`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: _args) result = subprocess.run(cmd, capture_output=True, text=True) # cpplint writes to stderr r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/cpp_parsers/cpp_parsers_cpplint.py

In the server's implementation (`src/code_scalpel/code_parsers/csharp_parsers/csharp_parsers_Roslyn-Analyzers.py:80`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: subprocess.run( [ "dotnet", "build",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/csharp_parsers/csharp_parsers_Roslyn-Analyzers.py

In the server's implementation (`src/code_scalpel/code_parsers/csharp_parsers/csharp_parsers_SecurityCodeScan.py:138`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: subprocess.run( ["dotnet", "build", str(target), f"/p:ErrorLog={sarif_path}"],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/csharp_parsers/csharp_parsers_SecurityCodeScan.py

In the server's implementation (`src/code_scalpel/code_parsers/csharp_parsers/csharp_parsers_StyleCop.py:88`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: subprocess.run( ["dotnet", "build", str(path), f"/p:ErrorLog={out}"],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/csharp_parsers/csharp_parsers_StyleCop.py

In the server's implementation (`src/code_scalpel/code_parsers/csharp_parsers/csharp_parsers_fxcop.py:130`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: subprocess.run( ["dotnet", "build", str(target), f"/p:ErrorLog={sarif}"],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/csharp_parsers/csharp_parsers_fxcop.py

In the server's implementation (`src/code_scalpel/code_parsers/go_parsers/go_parsers_gofmt.py:60`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: list_result = subprocess.run( ["gofmt", "-l", target], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/go_parsers/go_parsers_gofmt.py

In the server's implementation (`src/code_scalpel/ast_tools/import_resolver.py:53`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: DUNDER = "dunder" # __import__() LAZY = "lazy" # Detected but not yet resolved FRAMEWORK = "framework" # F

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/ast_tools/import_resolver.py

In the server's implementation (`src/code_scalpel/cli_tools/tool_bridge.py:132`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: module = __import__(module_name, fromlist=[tool_name]) return getattr(module, tool_name, None)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/cli_tools/tool_bridge.py

In the server's implementation (`src/code_scalpel/code_parsers/python_parsers/python_parsers_flake8.py:288`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: s", "F404": "future import(s) name after other statements", "F405": "name may be undefined, or defined from star

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/python_parsers/python_parsers_flake8.py

In the server's implementation (`src/code_scalpel/code_parsers/typescript_parsers/parser.py:25`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Remove unused Optional import (CodeQL) class TSNodeType(Enum): """TypeScript/JavaScript AST node types (ESTree-co

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/code_parsers/typescript_parsers/parser.py

In the server's implementation (`src/code_scalpel/mcp/models/graph.py:533`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: containing the aliasing import (relative)" ) line: int | None = Field(default=None, description="Line number of

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/mcp/models/graph.py

In the server's implementation (`src/code_scalpel/polyglot/typescript/parser.py:32`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Remove unused Optional import (CodeQL) class TSNodeType(Enum): """TypeScript/JavaScript AST node types (ESTree-co

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/polyglot/typescript/parser.py

In the server's implementation (`src/code_scalpel/cache/ast_cache.py:260`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 301) return pickle.load(f) # nosec B301 def _save_ast(self, cache_path: Path, ast: Any) -> None:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/cache/ast_cache.py

In the server's implementation (`src/code_scalpel/cache/unified_cache.py:347`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: payload = pickle.load(f) # nosec B301 if payload.get("hash") == file_hash:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/code_scalpel/cache/unified_cache.py