Homelab (npm) MCP Server

In the server's implementation (`dist/history/gitEngine.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; export class GitEngine { gitPath; repoDir; // Single promise chain t

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/history/gitEngine.js

In the server's implementation (`dist/node/sshBackend.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eoutMs; } async exec(cmd) { const res = await this.transport.exec(cmd, this.timeoutMs); if (res.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/node/sshBackend.js

In the server's implementation (`dist/ssh/fakeTransport.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y ?? 0; } async exec(command, _timeoutMs) { if (this.execDelay > 0) { await new Promise((r)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/ssh/fakeTransport.js

In the server's implementation (`dist/ssh/ssh2Client.js:132`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: }); } async exec(command, timeoutMs) { const client = await this.ensureConnected(); const ti

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/ssh/ssh2Client.js

In the server's implementation (`dist/node/sshBackend.js:46`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e) { await this.exec(`${sshType(type)} reboot ${vmid}`); return { upid: `ssh:reboot:${type}:${vmid}` };

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/node/sshBackend.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/test/global-setup.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Sync, spawnSync } from "child_process"; import fs from "fs"; import path from "path"; import os from "os"; import net fr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/test/global-setup.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/doctor.mjs:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort { spawnSync } from "child_process"; import { existsSync } from "fs"; import https from "https"; import path from "pa

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/doctor.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/setup.mjs:25`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: c, execFileSync } from "child_process"; import { existsSync, mkdirSync, readFileSync } from "fs"; import https from "htt

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/setup.mjs