Edge Tts (s-n-n) MCP Server

In the server's implementation (`venv_win/Lib/site-packages/aiohttp/client.py:1446`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: variables or ~/.netrc file if present. """ return self._trust_env @property def

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/aiohttp/client.py

In the server's implementation (`venv_win/Lib/site-packages/aiohttp/helpers.py:215`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "trying to look for .netrc file: %s", e, ) return None netrc_

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/aiohttp/helpers.py

In the server's implementation (`venv_win/Lib/site-packages/docutils/utils/math/math2html.py:3139`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return 1 return eval(sizestring) FormulaCommand.types += [HybridFunction] def math2html(formula): "Conve

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/docutils/utils/math/math2html.py

In the server's implementation (`venv_win/Lib/site-packages/attr/_make.py:227`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , filename, "exec") eval(bytecode, globs, locs) def _linecache_and_compile( script: str, filename: str,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/attr/_make.py

In the server's implementation (`venv_win/Lib/site-packages/cffi/recompiler.py:78`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: (self): flags = eval(self.flags, G_FLAGS) fields_expr = [c_field.as_field_python_expr()

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/cffi/recompiler.py

In the server's implementation (`venv_win/Lib/site-packages/docutils/utils/math/math2html.py:3139`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return 1 return eval(sizestring) FormulaCommand.types += [HybridFunction] def math2html(formula): "Conve

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/docutils/utils/math/math2html.py

In the server's implementation (`venv_win/Lib/site-packages/typing_extensions.py:1485`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: u are familiar with how eval() and exec() work). The search order is locals first, then globals. - If

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/typing_extensions.py

In the server's implementation (`venv_win/Lib/site-packages/anyio/_backends/_trio.py:1106`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: stderr, shell=True, **kwargs, ) else: process = await tr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/anyio/_backends/_trio.py

In the server's implementation (`venv_win/Lib/site-packages/cffi/pkgconfig.py:33`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) try: pc = subprocess.Popen(a, stdout=subprocess.PIPE, stderr=subprocess.PIPE) except EnvironmentError

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/cffi/pkgconfig.py

In the server's implementation (`venv_win/Lib/site-packages/cffi/setuptools_ext.py:26`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , filename, 'exec') exec(code, glob, glob) def add_cffi_module(dist, mod_spec): from cffi.api import FFI

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/cffi/setuptools_ext.py

In the server's implementation (`venv_win/Lib/site-packages/click/_termui_impl.py:454`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: color = True c = subprocess.Popen( [str(cmd_path)] + cmd_params, shell=False, stdin=subpr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/click/_termui_impl.py

In the server's implementation (`venv_win/Lib/site-packages/click/shell_completion.py:320`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e: output = subprocess.run( [bash_exe, "--norc", "-c", 'echo "${BASH_VERSION}"'],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/click/shell_completion.py

In the server's implementation (`venv_win/Lib/site-packages/docutils/utils/math/tex2mathml_extern.py:73`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ligned}') result = subprocess.run(args, input=math_code, capture_output=True, text=True

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/docutils/utils/math/tex2mathml_extern.py

In the server's implementation (`venv_win/Lib/site-packages/typing_extensions.py:1485`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: iar with how eval() and exec() work). The search order is locals first, then globals. - If no dict arg

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/typing_extensions.py

In the server's implementation (`venv_win/Lib/site-packages/cffi/verifier.py:151`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: pkg = __import__(self.ext_package, None, None, ['__doc__']) except ImportError:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/cffi/verifier.py

In the server's implementation (`venv_win/Lib/site-packages/aiohttp/cookiejar.py:133`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: self._cookies = pickle.load(f) def clear(self, predicate: Optional[ClearCookiePredicate] = None) -> None:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/aiohttp/cookiejar.py

In the server's implementation (`venv_win/Lib/site-packages/anyio/to_interpreter.py:130`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: : res = pickle.loads(res) if is_exception: raise res return re

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/anyio/to_interpreter.py

In the server's implementation (`venv_win/Lib/site-packages/anyio/to_process.py:94`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: m exc retval = pickle.loads(pickled_response) if status == b"EXCEPTION": assert isinstance(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server venv_win/Lib/site-packages/anyio/to_process.py