For Splunk MCP Server

In the server's implementation (`src/resources/processors/html_processor.py:315`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e to match, format X as eval(field="value"). | | **dc(X)** | Returns the count of distinct values of the field X. | | **

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/resources/processors/html_processor.py

In the server's implementation (`src/cli/build_and_run.py:172`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nd works code = subprocess.run( # nosec B603 B607 ["docker", "compose", "version"], std

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/build_and_run.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_token_auth.py:105`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: }) service.http.request("https://splunk.example.com:8089/services/server/info", {"headers": []}) a

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_token_auth.py

A hardcoded JSON Web Token (an embedded JSON Web Token (often an example or expired token)) appears in `tests/security/test_credentials_handling.py:123`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: JSON Web Token: eyJh…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server tests/security/test_credentials_handling.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/security/test_http_surface.py:206`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "index=main\"; exec('rm -rf /')", "index=main` && cat /etc/passwd`", "index=main | $(wh

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/security/test_http_surface.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_mcp_server_comprehensive.py:1107`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: requested result = subprocess.run( ["uv", "run", "pytest", __file__, "-v", "--tb=short"], cwd=os.pa

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_mcp_server_comprehensive.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_server_dotenv_loading.py:38`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ), })) """ result = subprocess.run( [sys.executable, "-c", script], cwd=cwd, env=env,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_server_dotenv_loading.py