Monitor MCP Server

In the server's implementation (`src/loop-check.ts:224`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: itmodules", ".env", ".npmrc", ".pypirc", "credentials", "credentials.json", "secrets.json", "secret.json",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/loop-check.ts

Tool "monitor_exec" appears to run shell commands or evaluate code (keyword "exec" in tool name, parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool monitor_exec

Tool "monitor_cron_jobs" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool monitor_cron_jobs

In the server's implementation (`bins/monitor-web.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: execSync, spawn } from "child_process"; import { existsSync } from "fs"; import { join } from "path"; import { fileURLTo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bins/monitor-web.js

In the server's implementation (`bins/monitor-web.ts:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: execSync, spawn } from "child_process"; import { existsSync } from "fs"; import { join } from "path"; import { fileURLTo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bins/monitor-web.ts

In the server's implementation (`src/cli/index.ts:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { listKnownMachineIds } from "../collectors/index.js"; import type { Syst

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/index.ts

In the server's implementation (`src/collectors/command.ts:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; export interface CommandOptions { timeoutMs?: number; cwd?: string; env?:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/collectors/command.ts

Untrusted-input tools ([monitor_container_logs]) co-exist with external-action tools ([monitor_exec, monitor_cron_jobs]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [monitor_container_logs] → sinks [monitor_exec, monitor_cron_jobs]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow monitor_container_logs → monitor_exec

Tool "monitor_exec" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool monitor_exec · inputSchema.properties.command

Tool "monitor_cron_jobs" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool monitor_cron_jobs · inputSchema.properties.command

In a packaging/dev/install script (shipped, but not the server runtime) (`src/mcp/http.test.ts:57`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const res = await fetch(`http://${handle.host}:${handle.port}/health`); expect(res.status).toBe(200); expe

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp/http.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/db/migrate-v2.test.ts:123`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , 22, "/home/hasna/.ssh/id_ed25519", '{"region":"eu"}', "offline"] ); // metrics for (let i = 0; i < 3; i++) {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/db/migrate-v2.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/security.test.ts:599`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: h_key_path: "/root/.ssh/id_rsa" }, { id: "b", ssh_key_path: null }, ]); expect(JSON.stringify(rows)).not.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/security.test.ts

Tool "monitor_exec" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool monitor_exec

Tool "monitor_cron_jobs" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool monitor_cron_jobs

In a packaging/dev/install script (shipped, but not the server runtime) (`src/api/api.test.ts:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; // ── DB Setup ────────────────────────────────────────────────────────────────

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/api/api.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/cli/cli.test.ts:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort { spawnSync } from "child_process"; let configDir: string | undefined; afterEach(() => { if (configDir) rmSync(c

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/cli.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/cli/health.test.ts:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { mkdtempSync, rmSync } from "node:fs"; import { tmpdir } from "node:os";

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/health.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/cli/index.test.ts:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import type { SystemSnapshot } from "../collectors/local.js"; import { formatCom

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/index.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/cli/kill.test.ts:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from "node:child_process"; import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs"; import

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/kill.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/config.test.ts:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort { spawnSync } from "child_process"; // The config module supports MONITOR_CONFIG_DIR so tests can exercise the // r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/config.test.ts

"@hasna/monitor" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: bun ./scripts/ensure-data-dir.mjs

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package @hasna/monitor