Mcp Use Cli (mcp-use) MCP Server

In the server's implementation (`dist/commands/dev.js:68`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ode.process(x,d));let B=new Function(`${o.default.self}`,`${o.default.scope}`,x)(this,this.scope.get());if(this.scope.va

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/dev.js

In the server's implementation (`dist/chunk-K5AVW4TV.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import{spawn as ue}from"child_process";import{readFileSync as le}from"fs";import{chmod as de,mkdir as me}from"fs/promise

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-K5AVW4TV.js

In the server's implementation (`dist/chunk-S3WHXP7I.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port{execFile as t}from"child_process";function d(n,e=process.platform){let r;try{r=new URL(n)}catch{return}if(r.protoco

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-S3WHXP7I.js

In the server's implementation (`dist/commands/deploy.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort{execFile as Se}from"child_process";import{createReadStream as Ce}from"fs";import{appendFile as re,lstat as Ie,opendi

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/deploy.js

In the server's implementation (`dist/commands/screenshot.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ;import{spawn as $}from"child_process";import{access as j,mkdtemp as F,rm as A,writeFile as G}from"fs/promises";import{c

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/screenshot.js

In the server's implementation (`dist/commands/typecheck.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ;import{spawn as d}from"child_process";import{createRequire as u}from"module";import{dirname as l,join as m,resolve as y

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/typecheck.js

In the server's implementation (`dist/commands/dev.js:71`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: sync()=>{let ue=await w.import(g),$e=ab(ue),ye=$e.__skillsConfig(),ze=rl(ye,e.cwd,_);$e.__primeSkills(ol(ye,e.cwd,_,{onI

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/dev.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/commands/build.js:1`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: P_URL=W);let r=(await s.import(i)).default;if(r===null||typeof r!="object")throw new Error("The server entry must defaul

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/commands/build.js