Unity (iflow-mcp) MCP Server

Tools that read sensitive data ([get_logs]) and tools that can send data out ([execute_code]) are exposed together. An agent can move private data to the sink.

Evidence: sources [get_logs] → sinks [execute_code]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow get_logs → execute_code

In the server's implementation (`dist/unity/MockUnityClient.js:273`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return eval(code); } // For other code, return a mock object with a custom mess

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/unity/MockUnityClient.js

In the server's implementation (`src/unity/MockUnityClient.ts:320`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: code)) { return eval(code); } // For other code, return a mock object with a custom message r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/unity/MockUnityClient.ts

Tool "execute_code" appears to run shell commands or evaluate code (keyword "execute code" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool execute_code

In the server's implementation (`dist/unity/MockUnityClient.js:273`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return eval(code); } // For other code, return a mock object with a custom mess

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/unity/MockUnityClient.js

In the server's implementation (`src/unity/MockUnityClient.ts:320`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: code)) { return eval(code); } // For other code, return a mock object with a custom message r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/unity/MockUnityClient.ts

In the server's implementation (`dist/dev/runner.js:40`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ire("chokidar")); const child_process_1 = require("child_process"); const path = __importStar(require("path")); const ch

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/dev/runner.js

In the server's implementation (`src/dev/runner.ts:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n, ChildProcess } from 'child_process'; import * as path from 'path'; import * as fs from 'fs'; import chalk from 'chalk

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/dev/runner.ts

In the server's implementation (`test-mcp-client.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require('child_process'); const path = require('path'); // Create a JSON-RPC 2.0 initialize request cons

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server test-mcp-client.js

Tool "execute_code" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool execute_code