Science (PyPI) MCP Server

In the server's implementation (`servers/ssh-exec/src/ssh_exec/ssh_client.py:33`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ~/.ssh

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server servers/ssh-exec/src/ssh_exec/ssh_client.py

In the server's implementation (`servers/python-code-execution/src/python_code_execution/server.py:38`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: subprocess.run(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server servers/python-code-execution/src/python_code_execution/server.py

In the server's implementation (`src/mcp_science/__init__.py:50`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: subprocess.run(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp_science/__init__.py

In the server's implementation (`servers/web-fetch/src/web_fetch/fetch.py:30`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: requests.post("https://r.jina.ai/"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server servers/web-fetch/src/web_fetch/fetch.py

In the server's implementation (`servers/python-code-execution/src/python_code_execution/local_python_executor.py:1106`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: __import__(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server servers/python-code-execution/src/python_code_execution/local_python_executor.py

"mcp-science" declares no repository URL, so its published artifact cannot be compared against reviewable source.

Fix: Prefer packages that link to public, reviewable source.

Location: package mcp-science