Holoviz MCP Server

In the server's implementation (`src/holoviz_mcp_server/display/pages/view_page.py:132`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: result = eval(last_expr, namespace) # noqa: S307 else: result = None

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/holoviz_mcp_server/display/pages/view_page.py

In the server's implementation (`src/holoviz_mcp_server/server/main.py:148`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n None result = eval(last_expr, namespace) # noqa: S307 if result is None: return None

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/holoviz_mcp_server/server/main.py

In the server's implementation (`src/holoviz_mcp_server/display/pages/view_page.py:132`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: result = eval(last_expr, namespace) # noqa: S307 else: result = None

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/holoviz_mcp_server/display/pages/view_page.py

In the server's implementation (`src/holoviz_mcp_server/server/main.py:148`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n None result = eval(last_expr, namespace) # noqa: S307 if result is None: return None

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/holoviz_mcp_server/server/main.py

In the server's implementation (`src/holoviz_mcp_server/display/manager.py:164`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: self.process = subprocess.Popen( [sys.executable, str(app_path)], env=env,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/holoviz_mcp_server/display/manager.py

In the server's implementation (`src/holoviz_mcp_server/utils.py:159`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: odule try: exec(code, module.__dict__) # noqa: S102 return module.__dict__ except Exception:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/holoviz_mcp_server/utils.py

In the server's implementation (`src/holoviz_mcp_server/validation.py:111`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( [ sys.executable, "-m",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/holoviz_mcp_server/validation.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_validation.py:41`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eck("import subprocess\nsubprocess.run(['ls'])") def test_blocked_import_socket_raises(self): with pytest.r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_validation.py