Mirdan MCP Server

In the server's implementation (`src/mirdan/core/code_validator.py:288`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "Avoid eval() - use JSON.parse() for data or proper parsing libraries", ), (

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/core/code_validator.py

In the server's implementation (`src/mirdan/core/python_ast_validator.py:49`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: """PY001-ast: Detect eval() calls via AST (no false positives from strings).""" return [ Violation(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/core/python_ast_validator.py

In the server's implementation (`src/mirdan/core/violation_explainer.py:130`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , with risks similar to eval() for dynamic input." ), "PY003": ( "Bare except catches all exceptions inc

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/core/violation_explainer.py

In the server's implementation (`src/mirdan/cli/check_command.py:171`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: subprocess.run WITHOUT shell=True, preventing shell injection via malicious config values or filenames. Args:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/cli/check_command.py

In the server's implementation (`src/mirdan/cli/export_command.py:156`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["git", "diff", "--name-only", "HEAD"], # noqa: S607 ca

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/cli/export_command.py

In the server's implementation (`src/mirdan/cli/fix_command.py:145`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["git", "diff", "--cached", "--name-only", "--diff-filter=ACMR"], #

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/cli/fix_command.py

In the server's implementation (`src/mirdan/cli/gate_command.py:183`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["git", "diff", "--name-only", "HEAD"], # noqa: S607 ca

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/cli/gate_command.py

In the server's implementation (`src/mirdan/cli/validate_command.py:176`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["git", "diff", "--staged", "--unified=0"], # noqa: S607

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/cli/validate_command.py

In the server's implementation (`src/mirdan/core/auto_fixer.py:147`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "SEC003": ( "subprocess.run(cmd, shell=False, check=True)", "Use subprocess with shell=False and expl

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/core/auto_fixer.py

In the server's implementation (`src/mirdan/core/code_validator.py:103`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rror", "exec() usage detected - potential code injection risk", "Avoid exec() - use safe

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/core/code_validator.py

In the server's implementation (`src/mirdan/core/python_ast_validator.py:67`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: """PY002-ast: Detect exec() calls via AST.""" return [ Violation( id="PY002", rul

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/core/python_ast_validator.py

In the server's implementation (`src/mirdan/core/rules/ai002_imports.py:93`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "buffer", "child_process", "cluster", "console", "constants", "crypto",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mirdan/core/rules/ai002_imports.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_ai_quality_checker.py:684`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: requests\n\nresponse = requests.get('https://example.com')\n" violations = checker.check(code, "python")

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_ai_quality_checker.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_code_validator.py:130`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: code = "response = requests.get('https://example.com')" result = validator.validate(code, language="python"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_code_validator.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_ai_quality_checker.py:219`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: code = 'result = eval(f"{user_input}")\n' violations = checker.check(code, "python") ai008 = [v f

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_ai_quality_checker.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_auto_fix.py:85`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: code = "result = eval(user_input)" result = self.code_validator.validate(code, language="python")

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_auto_fix.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_code_validator.py:29`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: """Should detect eval() usage.""" code = "result = eval(user_input)" result = validator.validate(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_code_validator.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_compare_approaches.py:62`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: dirty = "result = eval(user_input)\n" validator = CodeValidator(QualityStandards()) results = []

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_compare_approaches.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_convention_extractor.py:72`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: return eval(x) except: pass def another_func{i}(y): exec(y) return None class han

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_convention_extractor.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_diff_full_file.py:94`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nc_a(): eval("bad_code") def func_b(): x = 1 y = 2

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_diff_full_file.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_output_formatter.py:218`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "message": "Avoid eval()", "line": 5, "column": 10, "c

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_output_formatter.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/measure_baseline.py:65`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["git", "-C", str(repo_root), "log", "--oneline", "--all", "--grep",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/measure_baseline.py