Depwire Cli MCP Server

In the server's implementation (`dist/chunk-5EG3JK54.js:19890`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: suggestedFix: "Avoid eval(parse(text=...)). Use switch statements, match.arg(), or lookup tables instead." }, {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-5EG3JK54.js

The implementation both builds shell commands out of runtime values (`dist/chunk-FPQKWAVT.js`) and evaluates runtime values as code (`dist/chunk-5EG3JK54.js`). Each is a separate arbitrary-execution primitive; a server exposing both gives anything that reaches either one a direct path to running attacker-chosen code. These two sinks are in different files — confirm whether they are actually connected, or are unrelated code paths (e.g. a vendored bundle plus a CLI wrapper).

Fix: Remove the dynamic eval, and pass command arguments as an argv array instead of building a shell string. If both are genuinely required, constrain and validate every value that can reach them.

Location: server implementation

In the server's implementation (`dist/chunk-5EG3JK54.js:19385`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e if user input reaches eval().", suggestedFix: "Remove eval() and use safe alternatives (JSON.parse for data, speci

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-5EG3JK54.js

In the server's implementation (`dist/chunk-5EG3JK54.js:17069`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; function generateHistory(graph, projectRoot, version) { let output = ""; con

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-5EG3JK54.js

In the server's implementation (`dist/chunk-FPQKWAVT.js:617`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; async function getCommitLog(dir, limit) { try { if (limit !== void 0 && (!

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-FPQKWAVT.js

In the server's implementation (`dist/index.js:1559`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; function git(cmd, cwd) { return execSync(`git ${cmd}`, { cwd, encoding: "utf-8

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`dist/chunk-FPQKWAVT.js:624`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ""; const output = execSync( `git log ${limitArg} --pretty=format:"%H|%aI|%s|%an"`, { cwd: dir, encodin

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-FPQKWAVT.js

In the server's implementation (`dist/index.js:1561`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: it(cmd, cwd) { return execSync(`git ${cmd}`, { cwd, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim(); } fu

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

Tool "list_files" takes a path parameter "directory" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.

Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.

Location: tool list_files · inputSchema.properties.directory