Codesift MCP Server

In the server's implementation (`dist/cli/auto-prune.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { readFile, writeFile } from "node:fs/promises"; import { join } from "no

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/auto-prune.js

In the server's implementation (`dist/cli/commands-index.js:27`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import("node:child_process"); const { fileURLToPath } = await import("node:url"); const { dirname, jo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/commands-index.js

In the server's implementation (`dist/cli/commands-maintenance.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from "node:child_process"; import { getBoolFlag, output, die } from "./args.js"; /** * Delete orphaned per

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/commands-maintenance.js

In the server's implementation (`dist/cli/git-hooks-installer.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from "node:child_process"; import { existsSync, realpathSync } from "node:fs"; import { copyFile, mkdir, re

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/git-hooks-installer.js

In the server's implementation (`dist/cli/hooks/post-tool-use.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { randomUUID } from "node:crypto"; import { CODE_EXTENSIONS } from "./sha

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/hooks/post-tool-use.js

In the server's implementation (`dist/cli/setup/mcp.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from "node:child_process"; import { existsSync } from "node:fs"; import { homedir } from "node:os"; import

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/setup/mcp.js

In the server's implementation (`dist/install-check.js:115`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import("node:child_process"); /** * Verify in a FRESH process, not with `transformersResolvable()`.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/install-check.js

In the server's implementation (`dist/lsp/lsp-manager.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { pathToFileURL } from "node:url"; import { LspClient } from "./lsp-clien

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/lsp/lsp-manager.js

In the server's implementation (`dist/lsp/lsp-servers.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from "node:child_process"; export const LSP_SERVERS = { typescript: { command: "typescript-lang

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/lsp/lsp-servers.js

In the server's implementation (`dist/tools/dependency-audit-freshness-tools.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from "node:child_process"; import { promisify } from "node:util"; import { CHECK_TIMEOUT_MS, MAX_BUFFER, pa

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/dependency-audit-freshness-tools.js

In the server's implementation (`dist/cli/git-hooks-installer.js:171`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } else { execSync(`git config --global core.hooksPath ${JSON.stringify(hooksDir)}`, { stdio:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/git-hooks-installer.js

In the server's implementation (`dist/install-check.js:131`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ut-type=module", "-e", "import(process.env.CS_PROBE_SPEC).then(()=>process.exit(0),()=>process.exit(1))"], { cwd: packag

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/install-check.js

In the server's implementation (`dist/register-tool-groups/core/meta.js:68`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: matched files may ONLY import (allowlist)"), })), zJsonArray(z.object({

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/register-tool-groups/core/meta.js

In the server's implementation (`dist/search/optional-transformers.js:41`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: IFIER; return await import(spec); } /** * How to actually get the package back, phrased for the platform the caller

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/search/optional-transformers.js

In the server's implementation (`dist/tools/astro-audit.js:89`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const mod = (await import(resolvedPath)); const fn = mod[exportName]; if (typeof fn === "function")

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/astro-audit.js

"codesift-mcp" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node ./dist/cli.js setup all 2>/dev/null && echo ' ✨ CodeSift MCP installed and configured for all platforms. ⚠️ Restart your AI client (Cmd+Q for Claude C

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package codesift-mcp