Deploycheck MCP Server

In the server's implementation (`detectors/securityDetector.js:183`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: suggestedFix: "Remove eval() usage. Use JSON.parse() or local logic alternatives to avoid remote code executions."

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server detectors/securityDetector.js

In the server's implementation (`utils/testPhase12.js:36`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st app = express(); eval("console.log('dangerous')"); app.listen(3000); `, "utf8" ); // 3. Dockerfile

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server utils/testPhase12.js

In the server's implementation (`utils/testPhase4.js:80`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: // Eval usage eval("console.log('dangerous')"); // SQL Injection risk app.get('/user', (req, res)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server utils/testPhase4.js

In the server's implementation (`deployers/netlifyDeployer.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ync, spawn } = require("child_process"); const logger = require("../utils/logger.js"); function isNetlifyCliAvailable()

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server deployers/netlifyDeployer.js

In the server's implementation (`deployers/railwayDeployer.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ync, spawn } = require("child_process"); const logger = require("../utils/logger.js"); function isRailwayCliAvailable()

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server deployers/railwayDeployer.js

In the server's implementation (`deployers/vercelDeployer.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ync, spawn } = require("child_process"); const fs = require("fs"); const path = require("path"); const logger = require(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server deployers/vercelDeployer.js

In the server's implementation (`detectors/depDetector.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: _hooks", "buffer", "child_process", "cluster", "console", "constants", "crypto", "dgram", "dns", "doma

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server detectors/depDetector.js

In the server's implementation (`detectors/pythonAstEngine.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require("child_process"); const path = require("path"); const fs = require("fs"); let cachedPythonCmd =

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server detectors/pythonAstEngine.js

In the server's implementation (`utils/logAnalyzer.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require("child_process"); const fs = require("fs"); const path = require("path"); // Load external signa

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server utils/logAnalyzer.js

In the server's implementation (`detectors/pythonAstEngine.js:65`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: aces const stdout = execSync(`"${pythonCmd}" "${parserPath}" "${filePath}"`, { encoding: "utf8", maxBuff

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server detectors/pythonAstEngine.js

In the server's implementation (`utils/logAnalyzer.js:27`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e diff const diff = execSync(`git diff HEAD~${commits} HEAD --unified=0`, { cwd: repoPath, encoding: "utf8" });

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server utils/logAnalyzer.js