Orchestrator (crAK1644) MCP Server

In the server's implementation (`smoke_workflow_live.py:135`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: str) -> str: done = subprocess.run(["git", *args], cwd=repo, capture_output=True, text=True) if done.returncode

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server smoke_workflow_live.py

A hardcoded GitHub token (a live-looking credential hardcoded in shipped code) appears in `tests/test_review_secrets.py:28`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: GitHub token: ghp_…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server tests/test_review_secrets.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/fixtures/fake_cli.py:50`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: N) grandchild = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(300)"]) with open(sys.a

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/fixtures/fake_cli.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_cli_entrypoint.py:89`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: r(tmp_path) done = subprocess.run( [sys.executable, "-m", "orchestrator_mcp.server"], cwd=tmp_path,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_cli_entrypoint.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_code_execution.py:103`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: first"], ): subprocess.run(["git", *args], cwd=path, check=True, capture_output=True) return path @pyt

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_code_execution.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_consult_store.py:335`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: art_at)] openers = [subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_consult_store.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_workflow_service.py:211`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ", "t"], ): subprocess.run(command, cwd=path, check=True) (path / "src").mkdir() (path / "src" / "a.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_workflow_service.py