Sdl MCP Server

In the server's implementation (`dist/mcp/tools/search-edit/planner.js:210`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ENYLIST = new Set([ ".npmrc", ".netrc", ".pgpass", ".my.cnf", ".boto", ]); const SECRET_FILENAME_RE

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/mcp/tools/search-edit/planner.js

In the server's implementation (`dist/cli/setup-wizard/lsp.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { platform } from "node:os"; const LSP_REGISTRY = { ts: { lan

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/setup-wizard/lsp.js

In the server's implementation (`dist/db/ladybug-algorithms.js:54`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { await exec(conn, "INSTALL algo"); } catch (installErr) { logger.debug("lad

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/ladybug-algorithms.js

In the server's implementation (`dist/db/ladybug-clusters.js:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: (conn, row) { await exec(conn, `MATCH (r:Repo {repoId: $repoId}) MERGE (c:Cluster {clusterId: $clusterId})

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/ladybug-clusters.js

In the server's implementation (`dist/db/ladybug-config.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: (conn, row) { await exec(conn, `MERGE (p:ToolPolicyHash {policyHash: $policyHash}) SET p.policyBlob = $policyBl

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/ladybug-config.js

In the server's implementation (`dist/db/ladybug-core.js:657`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: })); } export function exec(conn, statement, params = {}) { const checkpointError = rawCheckpointError(statement);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/ladybug-core.js

In the server's implementation (`dist/db/ladybug-derived-state.js:57`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: onn) => { await exec(wConn, "MERGE (d:DerivedState {repoId: $repoId}) ON CREATE SET d.clustersDirty = $clustersD

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/ladybug-derived-state.js

In the server's implementation (`dist/db/ladybug-edges.js:80`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: N_FILE joins. await exec(conn, `MATCH (r:Repo {repoId: $repoId}) MERGE (a:Symbol {symbolId: $fromSymbolId})

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/ladybug-edges.js

In the server's implementation (`dist/db/ladybug-embeddings.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: (conn, row) { await exec(conn, `MERGE (e:SymbolEmbedding {symbolId: $symbolId}) SET e.model = $model,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/ladybug-embeddings.js

In the server's implementation (`dist/db/ladybug-feedback.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: (conn, row) { await exec(conn, `MERGE (a:Audit {eventId: $eventId}) SET a.timestamp = $timestamp, a.to

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/db/ladybug-feedback.js

In the server's implementation (`dist/indexer/adapter/plugin/loader.js:71`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const module = await import(importUrl); const pluginModule = module.default ?? module; if (!pluginMod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/indexer/adapter/plugin/loader.js

In the server's implementation (`dist/indexer/language-packs.js:618`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return (await import(adapterModule)); } catch (err) { lastErr = err; i

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/indexer/language-packs.js

In the server's implementation (`dist/indexer/treesitter/grammarLoader.js:127`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { return require(packageName); } catch (error) { const packageRoot = grammarPackageRoots.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/indexer/treesitter/grammarLoader.js

In the server's implementation (`dist/native/addon-loader.js:7`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: didate = (candidate) => require(candidate); const defaultLogFailure = (failure) => { logger.debug("Native addon unav

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/native/addon-loader.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/benchmark/external-runner.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ync, spawn } from "node:child_process"; import { createHash } from "node:crypto"; import fs, { existsSync } from "node:f

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/benchmark/external-runner.js

"sdl-mcp" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node scripts/postinstall.mjs

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package sdl-mcp