Proxy (punkpeye) MCP Server

In the server's implementation (`dist/startStdioServer-wlzPR7aW.mjs:9216`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ame = fn.name; return new Function("fn", "log", "deprecate", "message", "site", "\"use strict\"\nreturn function (" +

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/startStdioServer-wlzPR7aW.mjs

In the server's implementation (`dist/bin/mcp-proxy.mjs:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { PassThrough, Transform } from "node:stream"; import { StringDecoder } f

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/mcp-proxy.mjs

In the server's implementation (`src/StdioClientTransport.ts:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ype, spawn } from "node:child_process"; import { PassThrough, Stream } from "node:stream"; import { JSONFilterTransform

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/StdioClientTransport.ts

In the server's implementation (`dist/bin/mcp-proxy.mjs:1449`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } else config = mixin.require(resolvedConfigPath); setConfigObject(config); } catch (ex) { if (ex.name =

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/mcp-proxy.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`src/StdioClientTransport.test.ts:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from "node:child_process"; import { setTimeout as delay } from "node:timers/promises"; import { expect, it

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/StdioClientTransport.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/startStdioServer.test.ts:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ess, spawn } from "node:child_process"; import { afterEach, beforeEach, describe, expect, it } from "vitest"; import {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/startStdioServer.test.ts