Docker (L337-org) MCP Server

In the server's implementation (`docker_mcp/tools/buildx.py:100`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: or "id=npmrc,src=/home/u/.npmrc" key - the component to read, e.g. "dest" returns: str | None - the componen

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docker_mcp/tools/buildx.py

In the server's implementation (`docker_mcp/tools/images.py:137`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: entials cached in `~/.docker/config.json`, and leave `auth_config` unset. args: repository - Image refe

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docker_mcp/tools/images.py

In the server's implementation (`docker_mcp/tools/plugins.py:92`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ystem_login`, or from `~/.docker/config.json` if the host ran `docker login`. Raises if the reference cannot be reso

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docker_mcp/tools/plugins.py

In the server's implementation (`docker_mcp/tools/registry.py:471`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: and does NOT read `~/.docker/config.json` — for private registries prefer the DOCKER_MCP_SERVER_REGISTRY_USERNAME /

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docker_mcp/tools/registry.py

In the server's implementation (`docker_mcp/tools/system.py:415`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: entials cached in `~/.docker/config.json`, and avoid calling this tool from an agent loop. Credentials let `imag

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docker_mcp/tools/system.py

In the server's implementation (`docker_mcp/tools/_cli.py:207`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ", None) proc = subprocess.run( # noqa: S603 — shell=False, argv is a list, binary is resolved via shutil.which

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docker_mcp/tools/_cli.py

In the server's implementation (`docker_mcp/tools/_ssh_proxy.py:670`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: the local path: `subprocess.run(timeout=...)` calls `Popen.kill()`, which is `os.kill(self.pid, ...)` on

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docker_mcp/tools/_ssh_proxy.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_buildx.py:124`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "id=npmrc,src=/home/user/.npmrc"], ssh=["default"]) args = run.call_args.args[0] assert args[args.index("--secre

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_buildx.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/measure-comparison-figures.py:345`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: v_overrides) proc = subprocess.run( # noqa: S603 (fixed argv, no shell, interpreter resolved from sys.executable)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/measure-comparison-figures.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/integration/test_cli_flag_drift.py:85`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eplace". return subprocess.run( # noqa: S603 [docker, *argv, "--help"], capture_output=

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/integration/test_cli_flag_drift.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/integration/test_skill.py:36`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: xit code.""" return subprocess.run( # noqa: S603 argv, capture_output=True, input=stdin, timeout=timeout, c

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/integration/test_skill.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_buildx.py:496`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: /".join(parts) def exec(self, argv, *, timeout, max_output_bytes, cwd=None): self.calls.append({"argv": lis

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_buildx.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_cli.py:696`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: l_file).name}" def exec(self, argv, *, timeout, max_output_bytes, cwd=None): self.calls.append({"argv": lis

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_cli.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_prompts.py:438`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: r._prompts))" out = subprocess.run( # noqa: S603 — fixed argv, sys.executable, no shell [sys.executable, "-

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_prompts.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_remote_exec.py:219`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: claimed: CPython's `subprocess.run(timeout=...)` calls `Popen.kill()`, which is SIGKILL on POSIX. Without escalation

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_remote_exec.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_resources.py:299`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: in(u))" ) out = subprocess.run( # noqa: S603 — fixed argv, sys.executable, no shell [sys.executable, "-

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_resources.py