Dollhousemcp MCP Server

In the server's implementation (`dist/handlers/mcp-aql/policies/ToolClassification.js:342`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nfig/', '~/.env', '~/.netrc', '~/.npmrc', '/etc/shadow', '/etc/passwd', '/etc/sudoers', '/proc/', '/sys/', ]

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/handlers/mcp-aql/policies/ToolClassification.js

In the server's implementation (`dist/elements/ensembles/Ensemble.js:1394`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: onst evaluationResult = vm.runInContext(wrappedCondition, vmContext, { timeout: 100, // 100ms max evalua

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/elements/ensembles/Ensemble.js

In the server's implementation (`dist/elements/agents/Agent.js:409`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: em\s*\(/i, 'exec() call': /exec\s*\(/i, 'eval() call': /eval\s*\(/i, 'require() call

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/elements/agents/Agent.js

In the server's implementation (`dist/handlers/GitHubAuthHandler.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: de:crypto'; import * as child_process from 'child_process'; import { SecurityMonitor } from '../security/securityMonitor

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/handlers/GitHubAuthHandler.js

In the server's implementation (`dist/security/audit/config/suppressions.js:1016`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: llowlists before use in spawn(). TypeScript types also constrain parameters at compile time. PR #292' }, {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/security/audit/config/suppressions.js

In the server's implementation (`dist/security/commandValidator.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import * as child_process from 'child_process'; import { RegexValidator } from './regexValidator.js'; import

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/security/commandValidator.js

In the server's implementation (`dist/services/BuildInfoService.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ization */ import * as child_process from 'child_process'; import { logger } from '../utils/logger.js'; import { PACKAG

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/services/BuildInfoService.js

In the server's implementation (`dist/utils/git.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nctions */ import * as child_process from 'child_process'; import { promisify } from 'util'; import { CommandValidator

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/utils/git.js

In the server's implementation (`dist/web/console/StaleProcessRecovery.js:179`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import('node:child_process'); const { promisify } = await import('node:util'); const execFileAsync =

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/web/console/StaleProcessRecovery.js

In the server's implementation (`dist/web/routes/setupRoutes.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from 'node:child_process'; import { accessSync, existsSync, constants as fsConstants } from 'node:fs'; impo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/web/routes/setupRoutes.js

In the server's implementation (`dist/web/server.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from 'node:child_process'; import { platform } from 'node:os'; import { mkdir, readdir, readFile as readFil

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/web/server.js

In the server's implementation (`dist/security/tokenManager.js:203`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch('https://api.github.com/user', { headers: { 'Authoriza

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/security/tokenManager.js

In the server's implementation (`dist/web/routes.js:421`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch('https://raw.githubusercontent.com/DollhouseMCP/collection/main/public/collection-index.js

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/web/routes.js

In the server's implementation (`dist/web/routes/setupRoutes.js:623`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const ghRes = await fetch(`https://api.github.com/repos/${GITHUB_REPO}/releases/latest`, { headers:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/web/routes/setupRoutes.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/web/public/app.js:618`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`https://raw.githubusercontent.com/DollhouseMCP/collection/main/${el.path}`); if (

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/web/public/app.js