Loki Mode MCP Server

In the server's implementation (`memory/ingest.py:85`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "/credentials", "/.netrc", "/.npmrc", "/.pypirc", ) _SENSITIVE_PATH_BASENAMES = ( ".env", ".env.l

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server memory/ingest.py

In the server's implementation (`loki-ts/dist/loki.js:991`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: code.process(k,N);let _=Function(`${Y.default.self}`,`${Y.default.scope}`,k)(this,this.scope.get());if(this.scope.value(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server loki-ts/dist/loki.js

In the server's implementation (`agents/hub_install.py:420`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: MPT"] = "0" subprocess.run( ["git", "clone", "--depth", "1", "--no-tags", source, tmp],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server agents/hub_install.py

In the server's implementation (`api/server.js:29`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require('child_process'); const { EventEmitter } = require('events'); //================================

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server api/server.js

In the server's implementation (`api/test.js:29`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , execSync } = require('child_process'); const path = require('path'); const fs = require('fs'); //====================

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server api/test.js

In the server's implementation (`autonomy/api-server.js:32`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , execSync } = require('child_process'); // Validate port number is in valid range function isValidPort(port) { ret

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server autonomy/api-server.js

In the server's implementation (`autonomy/checklist-verify.py:136`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: proc = subprocess.run( cmd, cwd=project_dir,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server autonomy/checklist-verify.py

In the server's implementation (`autonomy/lib/checkpoint_sync.py:79`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: proc = subprocess.run( ["git", *args], cwd=cwd, stdout=subprocess.P

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server autonomy/lib/checkpoint_sync.py

In the server's implementation (`autonomy/lib/crash_capture.py:61`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: urn None proc = subprocess.run( [exe, "--version"], capture_output=True, tex

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server autonomy/lib/crash_capture.py

In the server's implementation (`autonomy/lib/deadline.py:604`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ble") process = subprocess.Popen( [sys.executable, "-c", _EXEC_BOOTSTRAP, str(gate_read), *command],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server autonomy/lib/deadline.py

In the server's implementation (`autonomy/lib/effort_estimator.py:281`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: out = subprocess.run( base, capture_output=True, text=True, timeout=timeout, s

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server autonomy/lib/effort_estimator.py

In the server's implementation (`autonomy/lib/fast_verify.py:171`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: r: try: p = subprocess.run(["git"] + args, cwd=cwd, capture_output=True, text=Tru

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server autonomy/lib/fast_verify.py

In the server's implementation (`web-app/dist/assets/HomePage-CVJcI5pQ.js:27`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ait Promise.allSettled([fetch(`https://api.github.com/repos/${W}`),fetch(`https://api.github.com/repos/${W}/contributors

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server web-app/dist/assets/HomePage-CVJcI5pQ.js

In the server's implementation (`loki-ts/dist/loki.js:1141`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y{Q=await fW0(Z)??await import(Z)}catch{return null}for(let Y of X)if(typeof Q[Y]!=="function"){let J=Q[Y]===void 0?"mis

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server loki-ts/dist/loki.js

In the server's implementation (`web-app/dist/assets/index-CLvjO22Z.js:61`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: c[i.id];try{let r=await import(i.module);return c[i.id]=r,r}catch(r){return console.error(`Error loading route module \`

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server web-app/dist/assets/index-CLvjO22Z.js