Entroly (juyterman1000) MCP Server

In the server's implementation (`entroly/work_graph_path_policy.py:11`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: filename is the leak. ``id_rsa`` and ``credentials.json`` disclose that a secret exists and what kind, and a vendored de

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server entroly/work_graph_path_policy.py

In the server's implementation (`entroly/cli.py:271`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: uest resp = urllib.request.urlopen( "https://pypi.org/pypi/entroly/json", timeout=3

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server entroly/cli.py

In the server's implementation (`entroly/server.py:2249`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , "CWE-502","Critical","pickle.loads(", None, "Unsafe deserialization"), ("CRYPTO-001","CWE-327","High",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server entroly/server.py

Instruction-override directive detected in the description of tool "security_scan". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.

Evidence: ignore previous instructions

Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.

Location: tool security_scan · description

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/language_symbol_coverage.py:246`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: dule_name] = module exec(compile(source, module.__file__, "exec"), module.__dict__) return module def _module_

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/language_symbol_coverage.py

In a packaging/dev/install script (shipped, but not the server runtime) (`bench/fix_nb6.py:31`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: entroly'):\n", " subprocess.run(['git', 'clone', '--depth', '1', 'https://github.com/juyterman1000/entroly.git',

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bench/fix_nb6.py

In a packaging/dev/install script (shipped, but not the server runtime) (`bench/quality_eval.py:162`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 8" try: r = subprocess.run( [ "entroly", "optimize", "--task", q

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bench/quality_eval.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/agent_symbol_delivery.py:60`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: str) -> str: return subprocess.run( ["git", *args], cwd=REPO_ROOT, capture_output=True, text=True, check=Tru

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/agent_symbol_delivery.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/agentic_task_miner.py:51`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: etedProcess: return subprocess.run( ["git", "-C", str(repo), *args], capture_output=True, te

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/agentic_task_miner.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/agentic_tasks_run.py:447`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ") completed = subprocess.run( [sys.executable, "-m", "pytest", task.test_file, "-q", "--no-header"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/agentic_tasks_run.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/audited_runner.py:90`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: return subprocess.check_output( ["git", "rev-parse", "HEAD"], cwd=ROOT, text=True )

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/audited_runner.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/closed_set_selection_frontier.py:52`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: -> str: completed = subprocess.run( ["git", "rev-parse", "HEAD"], cwd=ROOT, check=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/closed_set_selection_frontier.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/coding_tasks.py:99`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: subprocess.run( task.setup_command, shell=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/coding_tasks.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/competitive_provenance.py:64`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: () -> str: result = subprocess.run( ["git", "rev-parse", "HEAD"], cwd=ROOT, capture_output=True, text=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/competitive_provenance.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/compression_frontier.py:526`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , Any]: completed = subprocess.run( command, cwd=root, input=json.dumps(payload), ca

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/compression_frontier.py