Quantall MCP Server

In the server's implementation (`src_aid/icon_glod.py:1504`): Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \x96\xba\xd4\xb8\xb2\xe4\xdc\xc0\xc6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_aid/icon_glod.py

In the server's implementation (`src_build/icon_black.py:1504`): Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \x96\xba\xd4\xb8\xb2\xe4\xdc\xc0\xc6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/icon_black.py

In the server's implementation (`src_build/icon_blue.py:1504`): Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \x96\xba\xd4\xb8\xb2\xe4\xdc\xc0\xc6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/icon_blue.py

In the server's implementation (`src_build/icon_cyan.py:1504`): Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \x96\xba\xd4\xb8\xb2\xe4\xdc\xc0\xc6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/icon_cyan.py

In the server's implementation (`src_build/icon_glod.py:1504`): Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \x96\xba\xd4\xb8\xb2\xe4\xdc\xc0\xc6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/icon_glod.py

In the server's implementation (`src_build/icon_gray.py:1504`): Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \x96\xba\xd4\xb8\xb2\xe4\xdc\xc0\xc6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/icon_gray.py

In the server's implementation (`src_build/icon_green.py:1504`): Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \x96\xba\xd4\xb8\xb2\xe4\xdc\xc0\xc6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/icon_green.py

In the server's implementation (`src_build/icon_pink.py:1504`): Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \x96\xba\xd4\xb8\xb2\xe4\xdc\xc0\xc6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/icon_pink.py

In the server's implementation (`src_build/icon_purple.py:1504`): Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \x96\xba\xd4\xb8\xb2\xe4\xdc\xc0\xc6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/icon_purple.py

In the server's implementation (`src_build/icon_red.py:1504`): Decoding an encoded blob and executing it is how malicious logic is hidden from human review of the source. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \x96\xba\xd4\xb8\xb2\xe4\xdc\xc0\xc6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/icon_red.py

In the server's implementation (`src_aid/creat_dialog.py:184`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eval(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_aid/creat_dialog.py

In the server's implementation (`src_aid/exec_add_fun.py:648`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eval(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_aid/exec_add_fun.py

In the server's implementation (`src_aid/creat_dialog.py:184`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eval(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_aid/creat_dialog.py

In the server's implementation (`src_aid/exec_add_fun.py:216`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eval(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_aid/exec_add_fun.py

In the server's implementation (`src/RunExec.py:127`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: exec(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/RunExec.py

In the server's implementation (`src_aid/exec_add_fun.py:216`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: exec(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_aid/exec_add_fun.py

In the server's implementation (`src_aid/icon_build.py:120`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: subprocess.run(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_aid/icon_build.py

In the server's implementation (`src_build/load_hc.py:316`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: exec(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/load_hc.py

In the server's implementation (`src_build/wid_cur_2.py:3765`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: pickle.load(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src_build/wid_cur_2.py

"quantall" declares no repository URL, so its published artifact cannot be compared against reviewable source.

Fix: Prefer packages that link to public, reviewable source.

Location: package quantall