Onetool MCP Server

In the server's implementation (`src/otdev/tools/aws_util.py:749`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ession and write it to ~/.aws/credentials. Looks up the MFA device associated with the profile's IAM user, call

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/otdev/tools/aws_util.py

In the server's implementation (`packages/onetool-pack/src/otpack/text.py:62`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ut """ result = subprocess.run( args, timeout=timeout, cwd=cwd, capture_output=T

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server packages/onetool-pack/src/otpack/text.py

In the server's implementation (`src/onetool/cli_commands/direct_app.py:261`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 32": proc = subprocess.Popen( cmd, creationflags=subprocess.DETACHED_PROCESS

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/onetool/cli_commands/direct_app.py

In the server's implementation (`src/ot/executor/linter.py:37`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y: result = subprocess.run( ["ruff", "--version"], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ot/executor/linter.py

In the server's implementation (`src/ot/executor/pack_proxy.py:270`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ict suitable for use as exec() globals """ from ot.executor.worker_proxy import WorkerPackProxy from ot.prox

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ot/executor/pack_proxy.py

In the server's implementation (`src/ot/executor/runner.py:312`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ut_buffer): exec(wrapped_code, namespace) result = namespace.get("__result__") stdout_output

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ot/executor/runner.py

In the server's implementation (`src/ot/executor/validator.py:638`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e code specifically for exec() execution. This is a stricter validation that also checks for patterns that are

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ot/executor/validator.py

In the server's implementation (`src/ot/executor/worker_pool.py:229`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: _cwd process = subprocess.Popen( cmd, stdin=subprocess.PIPE, stdout=subproc

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ot/executor/worker_pool.py

In the server's implementation (`src/ot/utils/truncate.py:62`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: """ result = subprocess.run( args, timeout=timeout, cwd=cwd, capture_outp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/ot/utils/truncate.py

In the server's implementation (`src/otdev/tools/webfetch.py:198`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: content = webfetch.fetch("https://docs.python.org/3/library/asyncio.html") # Get plain text with faster ex

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/otdev/tools/webfetch.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/otutil/unit/tools/test_mem.py:1804`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ic="test", file="~/.ssh/id_rsa") assert "Error" in result assert "not found" in result.lower() or "outs

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/otutil/unit/tools/test_mem.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/unit/core/test_code_validator.py:289`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e = """ exec('x = 1') eval('2 + 2') """ result = validate_python_code(code) assert result.valid is False

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/unit/core/test_code_validator.py

In a packaging/dev/install script (shipped, but not the server runtime) (`packages/onetool-pack/tests/test_boundary.py:18`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: tions).""" result = subprocess.run( [sys.executable, str(SCRIPT)], capture_output=True, text

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server packages/onetool-pack/tests/test_boundary.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/release_publish.py:45`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: " $ {cmd}") return subprocess.run(cmd, shell=True, cwd=PROJECT_ROOT, check=check) def confirm(prompt: str) -> boo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/release_publish.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/unit/core/test_result_store.py:601`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: io.run( __import__( "ot.executor.runner", fromlist=["execute_command"]

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/unit/core/test_result_store.py