Itechsmart MCP Server

Tool "trmm_run_script" appears to run shell commands or evaluate code (keyword "run_script" in tool name, parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool trmm_run_script

In the server's implementation (`dist/index.js:68`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: require("http")); const child_process_1 = require("child_process"); const API_KEYS = new Map(); function loadApiKeys(raw

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

Untrusted-input tools ([get_receipt_chain, get_incident_details]) co-exist with external-action tools ([trmm_run_script, ghl_send_email, itsm_register_webhook]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [get_receipt_chain, get_incident_details] → sinks [trmm_run_script, ghl_send_email, itsm_register_webhook]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow get_receipt_chain → trmm_run_script

In the server's implementation (`dist/index.js:1947`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch('http://172.18.0.1:8210/api/v1/cluster'); const data = await res.json();

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

Tool "itsm_register_webhook" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).

Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.

Location: tool itsm_register_webhook · inputSchema.properties.url

Tool "trmm_run_script" takes a command-shaped parameter "script_id" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool trmm_run_script · inputSchema.properties.script_id

Tool "trmm_run_script" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool trmm_run_script