Cortex (rikaidev) MCP Server

In the server's implementation (`dist/core/mcp/services/pr-review-service.js:352`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: l\s*\(/, issue: "Use of eval() is a security risk" }, { regex: /innerHTML\s*=/,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/pr-review-service.js

In the server's implementation (`dist/core/mcp/services/security-service.js:213`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: remediation: "Avoid eval(). Use safer alternatives like JSON.parse()", owasp: "A03:2021-Injection",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/security-service.js

In the server's implementation (`src/core/mcp/services/pr-review-service.ts:479`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: l\s*\(/, issue: "Use of eval() is a security risk" }, { regex: /innerHTML\s*=/, issue: "innerHTML

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/core/mcp/services/pr-review-service.ts

In the server's implementation (`src/core/mcp/services/security-service.ts:250`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: remediation: "Avoid eval(). Use safer alternatives like JSON.parse()", owasp: "A03:2021-Injection",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/core/mcp/services/security-service.ts

In the server's implementation (`dist/core/mcp/handlers/checkpoint/checkpoint-handler.js:33`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import("node:child_process"); branch = execSync("git rev-parse --abbrev-ref HEAD", {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/handlers/checkpoint/checkpoint-handler.js

In the server's implementation (`dist/core/mcp/services/change-analyzer.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; /** * Service for analyzing code changes from git history and workflows. * *

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/change-analyzer.js

In the server's implementation (`dist/core/mcp/services/ci-pipeline-service.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from "node:child_process"; import * as path from "node:path"; import fs from "fs-extra"; /** * Service for

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/ci-pipeline-service.js

In the server's implementation (`dist/core/mcp/services/gitignore-validator.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { exec } from "child_process"; import { promisify } from "util"; import * as fs from "fs-extra"; import * as pa

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/gitignore-validator.js

In the server's implementation (`dist/core/mcp/services/implementation-validator.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; import { DangerZoneService } from "./danger-zone-service.js"; import { Environme

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/implementation-validator.js

In the server's implementation (`dist/core/mcp/services/pr-review-service.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; /** * Service for automating pull request reviews. * * Reviews PRs against te

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/pr-review-service.js

In the server's implementation (`dist/core/mcp/services/project-detector.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; /** * Service for detecting project conventions and configuration. * * Analyz

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/project-detector.js

In the server's implementation (`dist/core/mcp/services/security-service.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; import { v4 as uuidv4 } from "uuid"; /** * Service for security scanning and vu

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/security-service.js

In the server's implementation (`dist/core/mcp/services/team-knowledge-service.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from "child_process"; import { v4 as uuidv4 } from "uuid"; /** * Service for managing team knowledge

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/team-knowledge-service.js

In the server's implementation (`dist/core/mcp/services/template-generator.js:61`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import("node:child_process"); const branch = execSync("git rev-parse --abbrev-ref HEAD", {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/template-generator.js

In the server's implementation (`dist/core/mcp/services/change-analyzer.js:61`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const log = execSync(`git log ${range} --format=%H|||%s|||%b|||%n|||`, { cwd: this.projectRo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/change-analyzer.js

In the server's implementation (`dist/core/mcp/services/ci-pipeline-service.js:45`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const result = execSync(`gh ${args}`, { cwd: this.projectRoot, encoding: "utf-8

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/ci-pipeline-service.js

In the server's implementation (`dist/core/mcp/services/pr-review-service.js:167`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const prJson = execSync(`gh pr view ${prNumber} --json number,title,body,author,baseRefName,headRefName,state,f

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/pr-review-service.js

In the server's implementation (`dist/core/mcp/services/team-knowledge-service.js:115`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const reviewsJson = execSync(`gh pr view ${prNumber} --json reviews,comments`, { cwd: this.projectRo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/mcp/services/team-knowledge-service.js

In the server's implementation (`src/core/mcp/services/change-analyzer.ts:99`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: EAD"; const log = execSync(`git log ${range} --format=%H|||%s|||%b|||%n|||`, { cwd: this.projectRoot,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/core/mcp/services/change-analyzer.ts

In the server's implementation (`src/core/mcp/services/ci-pipeline-service.ts:73`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const result = execSync(`gh ${args}`, { cwd: this.projectRoot, encoding: "utf-8", stdio

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/core/mcp/services/ci-pipeline-service.ts

In the server's implementation (`src/core/mcp/services/pr-review-service.ts:223`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const prJson = execSync( `gh pr view ${prNumber} --json number,title,body,author,baseRefName,headRefNam

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/core/mcp/services/pr-review-service.ts

In the server's implementation (`src/core/mcp/services/team-knowledge-service.ts:162`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const reviewsJson = execSync( `gh pr view ${prNumber} --json reviews,comments`, { cwd: thi

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/core/mcp/services/team-knowledge-service.ts