Research (MABAAM) MCP Server

In the server's implementation (`src/mcp_research/_extractors.py:164`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t.wav" try: subprocess.run( ["ffmpeg", "-i", path, "-vn", "-acodec", "pcm_s16le", "-ar", "16000"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp_research/_extractors.py

In the server's implementation (`src/mcp_research/twitter.py:79`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: proc = subprocess.run( cmd, capture_output=True, text=True, timeout=30, ) i

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp_research/twitter.py

In the server's implementation (`src/mcp_research/youtube.py:123`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 1}) meta_proc = subprocess.run( ["yt-dlp", "--dump-json", "--no-download", url], capture

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp_research/youtube.py

Untrusted-input tools ([web_search, fetch_url, academic_lookup, twitter_extract]) co-exist with external-action tools ([twitter_extract]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [web_search, fetch_url, academic_lookup, twitter_extract] → sinks [twitter_extract]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow web_search → twitter_extract

In the server's implementation (`src/mcp_research/academic.py:280`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: resp = requests.get( "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/esummary.fcgi",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp_research/academic.py

In the server's implementation (`src/mcp_research/search.py:78`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: resp = requests.get( "https://api.search.brave.com/res/v1/web/search", params={

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp_research/search.py

In the server's implementation (`src/mcp_research/twitter.py:257`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: resp = requests.get( "https://api.x.com/2/tweets/search/recent", params={

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp_research/twitter.py

In the server's implementation (`src/mcp_research/cli.py:276`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: us.""" try: __import__(module_name) print(f" {package_name:18s} OK") return True except

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp_research/cli.py