Octopoda MCP Server

In the server's implementation (`synrix_runtime/dashboard/static/assets/NeuralGraph-JivWmplo.js:4060`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: {let t=ov(s,e),{Body:n}=new Function(t)();return n}function ov(s,e){return` ${lv(s,e)} ${av(s)} return {Body: Body, V

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server synrix_runtime/dashboard/static/assets/NeuralGraph-JivWmplo.js

In the server's implementation (`synrix_runtime/dashboard/static/assets/NeuralGraph-JivWmplo.js:4060`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: {let t=ov(s,e),{Body:n}=new Function(t)();return n}function ov(s,e){return` ${lv(s,e)} ${av(s)} return {Body: Body, V

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server synrix_runtime/dashboard/static/assets/NeuralGraph-JivWmplo.js

In the server's implementation (`synrix_runtime/dashboard/static/assets/index-DTLPD_iM.js:6193`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: }\r result = eval(expression, {"__builtins__": {}}, allowed_names)\r return str(result)\r excep

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server synrix_runtime/dashboard/static/assets/index-DTLPD_iM.js

In the server's implementation (`octopoda_zf/active/sandbox.py:80`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ct = {} exec(code, self._safe_globals(), ns) # noqa: S102 - sandboxed; see docstring bo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server octopoda_zf/active/sandbox.py

In the server's implementation (`synrix/engine.py:183`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( [str(engine_path), "--version"], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server synrix/engine.py

In the server's implementation (`synrix_runtime/dashboard/static/assets/index-DTLPD_iM.js:10404`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: s\r store_result = subprocess.run(\r [sys.executable, "-c", """\r from octopoda import AgentRuntime\r ag

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server synrix_runtime/dashboard/static/assets/index-DTLPD_iM.js

In the server's implementation (`synrix_runtime/loop_intel_v2/circuit_breaker.py:73`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } try: subprocess.run( ["curl", "-s", "-X", "POST", "https://api.resend.com/emails",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server synrix_runtime/loop_intel_v2/circuit_breaker.py

Untrusted-input tools ([octopoda_read_messages]) co-exist with external-action tools ([octopoda_send_message]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [octopoda_read_messages] → sinks [octopoda_send_message]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow octopoda_read_messages → octopoda_send_message

In the server's implementation (`synrix/fact_extractor.py:409`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ry: resp = requests.post( "https://api.anthropic.com/v1/messages", header

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server synrix/fact_extractor.py

In the server's implementation (`synrix_runtime/api/cloud_server.py:3486`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ode.js): await fetch("https://api.octopoda.dev/v1/ingest", { method: "POST", headers:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server synrix_runtime/api/cloud_server.py

In the server's implementation (`synrix_runtime/dashboard/static/assets/index-DTLPD_iM.js:24982`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: `const response = await fetch("https://api.octopodas.com/v1/agents/my_agent/remember", { method: "POST", headers:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server synrix_runtime/dashboard/static/assets/index-DTLPD_iM.js

In the server's implementation (`octopoda_zf/active/sandbox.py:60`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: he sandbox") return __import__(name, *args, **kwargs) class RestrictedSandbox: """Dev/benchmark sandbox. See m

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server octopoda_zf/active/sandbox.py

In the server's implementation (`octopoda_zf/instrument/autogen_hook.py:88`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: mod = __import__(path, fromlist=["BaseGroupChat"]) base_group_chat = getattr(mod, "BaseGro

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server octopoda_zf/instrument/autogen_hook.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_full_system.py:350`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ps_redirect(): r = requests.get("http://octopodas.com", timeout=10, allow_redirects=False) return r.status_cod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_full_system.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_full_system.py:230`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import(): result = subprocess.run( [sys.executable, "-c", "from octopoda import AgentRuntime; print('OK')"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_full_system.py