Ha (homeassistant-ai) MCP Server

In the server's implementation (`src/ha_mcp/_vendor/websockets/cli.py:214`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: orm == "win32": os.system("") try: import readline # noqa: F401 except ImportError: # readlin

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ha_mcp/_vendor/websockets/cli.py

In the server's implementation (`src/ha_mcp/_vendor/websockets/version.py:54`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: description = subprocess.run( ["git", "describe", "--dirty", "--tags", "--long"],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ha_mcp/_vendor/websockets/version.py

In the server's implementation (`src/ha_mcp/stdio_settings_sidecar.py:170`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t + secret for the next spawn (best effort).""" try: _atomic_write_0600( _state_file(),

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ha_mcp/stdio_settings_sidecar.py

In the server's implementation (`src/ha_mcp/utils/python_sandbox.py:386`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: bles) try: exec(expr, safe_globals, safe_locals) except (MemoryError, RecursionError): # Resour

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ha_mcp/utils/python_sandbox.py

A hardcoded JSON Web Token (an embedded JSON Web Token (often an example or expired token)) appears in `src/ha_mcp/config.py:27`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: JSON Web Token: eyJh…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server src/ha_mcp/config.py

In the server's implementation (`src/ha_mcp/_vendor/websockets/imports.py:28`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: supported" module = __import__(source[level:], namespace, None, [name], level) return getattr(module, name) de

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ha_mcp/_vendor/websockets/imports.py

A hardcoded JSON Web Token (an embedded JSON Web Token (often an example or expired token)) appears in `tests/test_constants.py:13`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: JSON Web Token: eyJh…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server tests/test_constants.py

In a packaging/dev/install script (shipped, but not the server runtime) (`src/ha_mcp/resources/skills-vendor/scripts/check_eval_cases.py:290`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rn try: r = subprocess.run([node, "-e", NODE_SRC], input=json.dumps(probes), capt

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ha_mcp/resources/skills-vendor/scripts/check_eval_cases.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_env_manager.py:223`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y: result = subprocess.run( cmd, env=env, cwd=Path(__file__).parent.parent, check=False

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_env_manager.py

In a packaging/dev/install script (shipped, but not the server runtime) (`src/ha_mcp/smoke_test.py:38`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: __import__(module_name) print(f" ✓ {module_name} ({description})") except I

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ha_mcp/smoke_test.py