Kya Os I MCP Server

In the server's implementation (`dist/compiler/parse-xmcp-config.js:148`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const func = new Function("module", "exports", "require", "__filename", "__dirname", bundledCode);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/compiler/parse-xmcp-config.js

In the server's implementation (`dist/runtime/adapter-express.js:8`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ]);return n.name=e.name,new Function("fn","log","deprecate","message","site",'"use strict"\nreturn function ('+i+") {log

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/runtime/adapter-express.js

In the server's implementation (`dist/runtime/adapter-nextjs.js:8`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ]);return n.name=e.name,new Function("fn","log","deprecate","message","site",'"use strict"\nreturn function ('+r+") {log

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/runtime/adapter-nextjs.js

In the server's implementation (`dist/runtime/http.js:8`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ]);return n.name=e.name,new Function("fn","log","deprecate","message","site",'"use strict"\nreturn function ('+i+") {log

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/runtime/http.js

In the server's implementation (`dist/runtime/stdio.js:7`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e.process(g,e));const r=new Function(`${o.default.self}`,`${o.default.scope}`,g)(this,this.scope.get());if(this.scope.va

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/runtime/stdio.js

In the server's implementation (`dist/295.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: dScript(e,t),this}async exec(e=!1){return e?this.execAsPipeline():f(this,s,"f").handleExecReplies(await f(this,o,"f").ca

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/295.js

In the server's implementation (`dist/compiler/on-first-build.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: d = onFirstBuild; const child_process_1 = require("child_process"); const spawn_process_1 = require("../utils/spawn-proc

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/compiler/on-first-build.js

In the server's implementation (`dist/compiler/start-http-server.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: /spawn-process"); const child_process_1 = require("child_process"); let httpServerProcess = null; function spawnHttpServ

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/compiler/start-http-server.js

In the server's implementation (`dist/runtime/adapter-nextjs.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: dScript(e,t),this}async exec(e=!1){return e?this.execAsPipeline():l(this,i,"f").handleExecReplies(await l(this,o,"f").ca

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/runtime/adapter-nextjs.js

In the server's implementation (`dist/utils/spawn-process.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: id not terminate. const child_process_1 = require("child_process"); const watchdogCode = String.raw ` const pid = parseI

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/utils/spawn-process.js

In the server's implementation (`dist/runtime/utils/tools.js:82`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st configModule = await import(runtimeConfigPath); const runtimeConfig = typeof configModule.getRuntimeConfig ==

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/runtime/utils/tools.js