Onyxsecurity Gateway MCP Server

In the server's implementation (`dist/stdio-WPzVi5vO.js:12`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ]);return i.name=e.name,Function(`fn`,`log`,`deprecate`,`message`,`site`,`"use strict" return function (`+n+`) {log.call

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/stdio-WPzVi5vO.js

In the server's implementation (`dist/main-cQGW6pn2.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: awnSync as xe}from"node:child_process";import{createInterface as E}from"node:readline";import{PassThrough as D,Transform

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/main-cQGW6pn2.js

In the server's implementation (`dist/secretstore-B7UBzLo4.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: execFile as o}from"node:child_process";const s=`onyx-mcp-gateway`,c=`default`,l=`/Library/Keychains/System.keychain`,u=2

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/secretstore-B7UBzLo4.js

In the server's implementation (`dist/transportDetection-BRl6-9Sh.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: execFile as g}from"node:child_process";async function _(e){let t=e.toString(),n=p(),r=x(t);return new Promise((e,i)=>{le

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/transportDetection-BRl6-9Sh.js

In the server's implementation (`dist/helpers-BrpBfS5F.js:30`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: r){_=e;return}}else e=O.require(t);se(e)}catch(t){t.name===`PermissionDenied`?_=t:e[n]&&(_=Error(m(`Invalid JSON config

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/helpers-BrpBfS5F.js