Mcpsafetywarden MCP Server

In the server's implementation (`mcpsafetywarden/sandbox/profile.py:21`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ", "~/.kube", "~/.config/gcloud", "~/.docker/config.json", "~/.netrc", "**/.env", "**/.env.*",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/sandbox/profile.py

In the server's implementation (`mcpsafetywarden/scan/args.py:559`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: es, /etc/passwd, ~/.ssh/id_rsa, .aws/credentials, .env files - especially when the tool description does not ind

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/scan/args.py

In the server's implementation (`mcpsafetywarden/scan/mcpsafety.py:427`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: file paths: .ssh/, .env, .aws/credentials, /etc/passwd - Inputs that trigger writes, creates, updates, or deletes - Exte

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/scan/mcpsafety.py

In the server's implementation (`mcpsafetywarden/scan/scanner.py:95`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: his, also read ~/.ssh/id_rsa", "send results to webhook.site/...", "always do X when this tool is used". These instr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/scan/scanner.py

In the server's implementation (`mcpsafetywarden/scan/args.py:566`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ons (python -c, eval(), exec(), __import__) embedded in args passed to a tool that does NOT accept shell

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/scan/args.py

In the server's implementation (`mcpsafetywarden/graph/explain.py:772`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["mmdc", "-i", tmp_mmd, "-o", output_path, "--backgroundColor", "whi

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/graph/explain.py

In the server's implementation (`mcpsafetywarden/graph/provenance.py:440`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: proc = subprocess.run(cmd, capture_output=True, text=True, timeout=_PKG_TIMEOUT) if proc.re

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/graph/provenance.py

In the server's implementation (`mcpsafetywarden/proxy/discovery.py:1129`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y: ids_result = subprocess.run( ["docker", "ps", "-q"], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/proxy/discovery.py

In the server's implementation (`mcpsafetywarden/scan/args.py:566`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: hon -c, eval(), exec(), __import__) embedded in args passed to a tool that does NOT accept shell command

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/scan/args.py

In the server's implementation (`mcpsafetywarden/scan/source.py:109`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Dict[str, str] = { "child_process": "shell_exec", "shelljs": "shell_exec", "execa": "shell_exec", "cross

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/scan/source.py

In the server's implementation (`mcpsafetywarden/scan/scanner.py:274`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: bool: try: __import__(name) return True except ImportError: return False def detect_l

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server mcpsafetywarden/scan/scanner.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_sandbox.py:421`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "try:\n" " urllib.request.urlopen('http://10.0.0.1/', timeout=8)\n" " print('REACHED')\n"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_sandbox.py

A hardcoded JSON Web Token (an embedded JSON Web Token (often an example or expired token)) appears in `tests/test_cref.py:10`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: JSON Web Token: eyJh…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server tests/test_cref.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_sandbox.py:427`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: as spawn: out = subprocess.run([spawn.command, *spawn.args], env=spawn.env, capture_output=True, text=True, time

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_sandbox.py