Kage Graph (kage-core) MCP Server

Tool "kage_observe" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool kage_observe

In the server's implementation (`dist/cli.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ue: true }); const node_child_process_1 = require("node:child_process"); const node_fs_1 = require("node:fs"); const nod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli.js

In the server's implementation (`dist/daemon.js:23`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ("node:fs"); const node_child_process_1 = require("node:child_process"); const node_os_1 = require("node:os"); const nod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/daemon.js

In the server's implementation (`dist/delegation/adapters/cli-agent.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: cooperation. const node_child_process_1 = require("node:child_process"); const node_fs_1 = require("node:fs"); const nod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/delegation/adapters/cli-agent.js

In the server's implementation (`dist/delegation/adapters/index.js:14`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: he contract. const node_child_process_1 = require("node:child_process"); const cli_agent_js_1 = require("./cli-agent.js"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/delegation/adapters/index.js

In the server's implementation (`dist/delegation/adapters/stub.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: egradation). const node_child_process_1 = require("node:child_process"); const node_fs_1 = require("node:fs"); const nod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/delegation/adapters/stub.js

In the server's implementation (`dist/delegation/app-daemon.js:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: face's code. const node_child_process_1 = require("node:child_process"); const node_path_1 = require("node:path"); const

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/delegation/app-daemon.js

In the server's implementation (`dist/delegation/dispatch.js:23`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: two minutes. const node_child_process_1 = require("node:child_process"); const node_crypto_1 = require("node:crypto"); c

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/delegation/dispatch.js

In the server's implementation (`dist/delegation/git.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: han a crash. const node_child_process_1 = require("node:child_process"); const node_fs_1 = require("node:fs"); const nod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/delegation/git.js

In the server's implementation (`dist/delegation/manager-client.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: could touch. const node_child_process_1 = require("node:child_process"); const index_js_1 = require("./adapters/index.js

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/delegation/manager-client.js

Untrusted-input tools ([kage_fetch]) co-exist with external-action tools ([kage_observe]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [kage_fetch] → sinks [kage_observe]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow kage_fetch → kage_observe

In the server's implementation (`dist/daemon.js:1012`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`http://${host}:${restPort}${path}`, { headers: { host: `${host}:${res

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/daemon.js

In the server's implementation (`dist/delegation/app-daemon.js:34`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`http://${host}:${port}/app`, { signal: AbortSignal.timeout(2000) }); return res.s

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/delegation/app-daemon.js

Tool "kage_observe" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool kage_observe · inputSchema.properties.command

Tool "kage_observe" takes a command-shaped parameter "exit_code" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool kage_observe · inputSchema.properties.exit_code

In the server's implementation (`dist/kernel.js:11316`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ? [`${imports} outgoing import(s)`] : []), ]; return { path: file.path, kind: file.kind, language: file.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/kernel.js

Tool "kage_observe" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool kage_observe

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/bench/run.js:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ue: true }); const node_child_process_1 = require("node:child_process"); const node_path_1 = require("node:path"); funct

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bench/run.js