Email (Wh1isper) MCP Server

In the server's implementation (`dev/build_frontend.py:160`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: the frontend") subprocess.run([npm, "ci"], cwd=FRONTEND, check=True) # noqa: S603 - maintainer tool su

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dev/build_frontend.py

In the server's implementation (`dev/verify_container.py:35`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ess[str]: process = subprocess.run( # noqa: S603 - fixed Docker executable with maintainer-supplied image tag

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dev/verify_container.py

In a packaging/dev/install script (shipped, but not the server runtime) (`frontend/e2e/local-management.spec.ts:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from 'node:child_process' import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs' import {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server frontend/e2e/local-management.spec.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/e2e/test_stdio_greenmail.py:298`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: -> str: completed = subprocess.run( # noqa: S603 - fixed installed script with test-owned arguments [str(co

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/e2e/test_stdio_greenmail.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_packaging.py:46`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: process = subprocess.Popen( # noqa: S603 - exact test-owned executable and arguments command,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_packaging.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_stdio_protocol.py:265`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ndle: process = subprocess.Popen( # noqa: S603 - exact test-owned executable and arguments [str(exe

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_stdio_protocol.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_windows_security.py:81`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: .Popen[str]: return subprocess.Popen( # noqa: S603 - fixed current interpreter and test-owned script [sys.e

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_windows_security.py