Davinci Resolve (samuelgursky) MCP Server

Tools that read sensitive data ([get_media_storage_files]) and tools that can send data out ([open_project, open_project_folder]) are exposed together. An agent can move private data to the sink.

Evidence: sources [get_media_storage_files] → sinks [open_project, open_project_folder]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow get_media_storage_files → open_project

In the server's implementation (`bin/davinci-resolve-mcp.mjs:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import fs from "node:fs"; import os from "node:os"; import path from "node:path"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/davinci-resolve-mcp.mjs

In the server's implementation (`install.py:176`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: }')" ) result = subprocess.run( [str(python_path), "-c", script], capture_output=True, t

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server install.py

In the server's implementation (`resolve-advanced/server/aaf.mjs:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from 'node:child_process'; import { existsSync } from 'node:fs'; import { fileURLToPath } from 'node:url';

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server resolve-advanced/server/aaf.mjs

In the server's implementation (`resolve-advanced/server/capabilities.mjs:14`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { createRequire } from 'node:module'; const require = createRequire(impo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server resolve-advanced/server/capabilities.mjs

In the server's implementation (`resolve-advanced/server/deliverable-qc.mjs:18`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { createRequire } from 'node:module'; import { probeMedia } from './ffpro

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server resolve-advanced/server/deliverable-qc.mjs

In the server's implementation (`resolve-advanced/server/extract-frames.mjs:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import fs from 'node:fs'; import path from 'node:path'; import { requireFfmpeg }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server resolve-advanced/server/extract-frames.mjs

In the server's implementation (`resolve-advanced/server/ffprobe-media.mjs:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { requireFfmpeg } from './capabilities.mjs'; /** Parse an "a/b" rational

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server resolve-advanced/server/ffprobe-media.mjs

In the server's implementation (`resolve-advanced/server/group-grade-read.mjs:20`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { createRequire } from 'node:module'; import { drxTool } from './tools/dr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server resolve-advanced/server/group-grade-read.mjs

In the server's implementation (`resolve-advanced/server/offline-ref-db.mjs:340`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const r = require('node:child_process').spawnSync( dump, ['-h', String(cfg.host), '-p', String(cfg.port), '-U',

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server resolve-advanced/server/offline-ref-db.mjs

In the server's implementation (`resolve-advanced/server/qc-sampler.mjs:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { createRequire } from 'node:module'; const require = createRequire(impo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server resolve-advanced/server/qc-sampler.mjs

Tool "unlink_proxy_media" can write, overwrite or delete files (keyword "unlink" in tool name). Verify it is scoped to a safe directory.

Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.

Location: tool unlink_proxy_media

Tool "unlink_clip_proxy_media" can write, overwrite or delete files (keyword "unlink" in tool name). Verify it is scoped to a safe directory.

Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.

Location: tool unlink_clip_proxy_media

In the server's implementation (`resolve-advanced/server/tools/drt.mjs:54`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rame crashes Resolve on import (measured)),audioOnly?+track? (explicit AUDIO placement on audio track 1-16; presence sup

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server resolve-advanced/server/tools/drt.mjs

Tool "unlink_proxy_media" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool unlink_proxy_media

Tool "unlink_clip_proxy_media" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool unlink_clip_proxy_media