Proxmox (JoshuaGreeff) MCP Server

This server (without client built-ins) exposes a complete data-exfiltration chain: proxmox_storage_download_url → proxmox_vm_cloud_init_dump → proxmox_node_terminal_run. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.

Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.

Location: flow proxmox_storage_download_url → proxmox_vm_cloud_init_dump → proxmox_node_terminal_run

Tool "proxmox_shell_run" appears to run shell commands or evaluate code (keyword "shell" in tool name, parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool proxmox_shell_run

Tool "proxmox_node_terminal_run" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool proxmox_node_terminal_run

Tool "proxmox_vm_guest_exec" appears to run shell commands or evaluate code (keyword "exec" in tool name, parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool proxmox_vm_guest_exec

In the server's implementation (`dist/schema.js:91`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t sandbox = {}; vm.runInNewContext(`${raw}\nthis.apiSchema = apiSchema;`, sandbox); const roots = sandbo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/schema.js

In the server's implementation (`dist/ssh.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { Client } from "ssh2"; import { shellJoin } from "./utils.js"; /** Verif

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/ssh.js

Tool "proxmox_storage_download_url" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).

Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.

Location: tool proxmox_storage_download_url · inputSchema.properties.url

Tool "proxmox_shell_run" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool proxmox_shell_run · inputSchema.properties.command

Tool "proxmox_node_terminal_run" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool proxmox_node_terminal_run · inputSchema.properties.command

Tool "proxmox_vm_guest_exec" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool proxmox_vm_guest_exec · inputSchema.properties.command

Tool "proxmox_shell_run" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool proxmox_shell_run

Tool "proxmox_node_terminal_run" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool proxmox_node_terminal_run

Tool "proxmox_vm_guest_exec" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool proxmox_vm_guest_exec