Homelab (Nainounen) MCP Server

In the server's implementation (`dist/qnap.js:56`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: = true; } async exec(command) { await this.ensureConnected(); return new Promise((resolve, rejec

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/qnap.js

In the server's implementation (`dist/ssh.js:127`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ding. */ async exec(command, cwd = "/root") { for (const pattern of exports.BLOCKED_PATTERNS) {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/ssh.js

In the server's implementation (`dist/ssh.js:169`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: await this.exec(`mkdir -p ${(0, utils_js_1.shellEscape)(dir)}`); } // Encode on the client

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/ssh.js

In the server's implementation (`dist/tools/containers.js:33`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: onst result = await ssh.exec(`docker logs --tail=${input.lines} ${input.container} 2>&1`); return result.stdout || r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/containers.js

In the server's implementation (`dist/tools/dashboard.js:86`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ks ? pveSSH.exec(`df -h ${disks.split(/\s+/).map(utils_js_1.shellEscape).join(" ")} 2>/dev/null | tail -n +2

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/dashboard.js

In the server's implementation (`dist/tools/devbox.js:121`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: onst result = await ssh.exec(`cat ${(0, utils_js_1.shellEscape)(input.path)}`); if (result.exitCode !== 0) {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/devbox.js

In the server's implementation (`dist/tools/network.js:13`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: onst result = await ssh.exec(`command -v wakeonlan >/dev/null 2>&1 && wakeonlan -i ${input.broadcast} ${input.mac} || et

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/network.js

In the server's implementation (`dist/tools/qnap.js:25`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: A2 'md1'"), ssh.exec(`df -h ${storageShares()} 2>/dev/null | tail -n +2`), ssh.exec(`for d in ${driveDev

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/qnap.js

In the server's implementation (`dist/tools/watchtower.js:22`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: onst before = await ssh.exec(`docker inspect --format "{{.Image}}" ${name} 2>/dev/null`); const pull = await ssh

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/watchtower.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/tools/setup.js:59`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: lse, hint: "e.g. ~/.ssh/id_rsa" }, { key: "PROXMOX_NODE", section: "Proxmox VE", description: "Proxmox node name", d

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/setup.js