N8n (czlonkowski) MCP Server

In the server's implementation (`dist/services/node-specific-validators.js:1516`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \s*\(/, message: 'Avoid eval() - it\'s a security risk' }, { pattern: /(?<![.\w$])Function\s*\(/, message: '

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/services/node-specific-validators.js

In the server's implementation (`dist/database/database-adapter.js:160`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: tement(stmt); } exec(sql) { this.db.exec(sql); } close() { this.db.close(); } pr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/database/database-adapter.js

In the server's implementation (`dist/services/config-validator.js:380`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: l(') || code?.includes('exec(')) { warnings.push({ type: 'security', message

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/services/config-validator.js

In the server's implementation (`dist/services/node-specific-validators.js:1520`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \s*\(/, message: 'Avoid exec() - it\'s a security risk' }, { pattern: /process\.env/, message: 'Limited envi

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/services/node-specific-validators.js

In the server's implementation (`dist/utils/enhanced-documentation-fetcher.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: uire("./logger"); const child_process_1 = require("child_process"); class EnhancedDocumentationFetcher { constructor

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/utils/enhanced-documentation-fetcher.js

In the server's implementation (`dist/utils/npm-version-checker.js:20`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch('https://registry.npmjs.org/n8n-mcp/latest', { headers: { 'Acc

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/utils/npm-version-checker.js

In the server's implementation (`dist/loaders/node-loader.js:57`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ry { return require(absolutePath); } catch (error) { if (error.code !== 'MODULE_

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/loaders/node-loader.js