Silex Archaeology MCP Server

In the server's implementation (`extractors/emitters/materialize.py:91`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: out = subprocess.run( ["git", *args], capture_output=True, text=Tr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server extractors/emitters/materialize.py

In the server's implementation (`extractors/metrics/provenance_report.py:93`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: str) -> str: out = subprocess.run( ["git", *args], cwd=str(repo_root), capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server extractors/metrics/provenance_report.py

In the server's implementation (`extractors/phase2_derived/risk_marker.py:211`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["git", "blame", "-L", f"{line},{line}", "--porcelain", "--", file],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server extractors/phase2_derived/risk_marker.py

In the server's implementation (`extractors/phase5_narrative/operations_builder.py:977`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: out = subprocess.check_output( ["grep", "-rln", "--include=*.cs", f"\

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server extractors/phase5_narrative/operations_builder.py

In the server's implementation (`extractors/runtime/package_merge.py:178`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: out = subprocess.run( ["git", "merge-base", "--is-ancestor", ancestor, descendant],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server extractors/runtime/package_merge.py

In the server's implementation (`extractors/runtime/run_manifest.py:225`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: out = subprocess.run( ["git", *args], capture_output=True, text=Tr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server extractors/runtime/run_manifest.py

In the server's implementation (`fresh/hook.py:50`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: dProcess.""" return subprocess.run( ["git", *args], cwd=cwd, capture_output=True, te

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server fresh/hook.py

In the server's implementation (`fresh/hook_install.py:46`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: str) -> str: proc = subprocess.run( ["git", "rev-parse", "--show-toplevel"], cwd=cwd, captur

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server fresh/hook_install.py

In the server's implementation (`ingestao/detectors/clear_and_reingest.py:21`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return False r = subprocess.run([sys.executable, path], cwd=SCRIPT_DIR) return r.returncode == 0 def main():

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/detectors/clear_and_reingest.py

In the server's implementation (`ingestao/vendor_filter.py:402`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["git", "log", "--oneline", "--follow", "--", rel_path],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/vendor_filter.py

Untrusted-input tools ([get_rules_by_ids]) co-exist with external-action tools ([silex_export_materialized]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [get_rules_by_ids] → sinks [silex_export_materialized]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow get_rules_by_ids → silex_export_materialized

In the server's implementation (`ingestao/silex_interativo.py:36`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } r = requests.post("http://172.17.0.1:11434/api/generate", json=payload, stream=True) pri

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/silex_interativo.py

In the server's implementation (`ui_archaeology.py:1829`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rf_counter() resp = requests.post( "https://openrouter.ai/api/v1/chat/completions", headers={

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ui_archaeology.py

In the server's implementation (`ingestao/arqueologia_recruta.py:61`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ') as f: data = pickle.load(f) index = data['index'] documents = data['documents'] model = S

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/arqueologia_recruta.py

In the server's implementation (`ingestao/fase0_export_fragmentos_from_pickle.py:23`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ') as f: data = pickle.load(f) documents = data.get('documents', []) if not documents: print("[!

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/fase0_export_fragmentos_from_pickle.py

In the server's implementation (`ingestao/fase0_inspect_pickle.py:25`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ') as f: data = pickle.load(f) print("data.keys():", list(data.keys())) if 'documents' in data and data[

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/fase0_inspect_pickle.py

In the server's implementation (`ingestao/formula/auditoria_agnostica.py:8`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: s f: data = pickle.load(f) documentos = data['documents'] # Assume que os vetores es

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/formula/auditoria_agnostica.py

In the server's implementation (`ingestao/formula/auditoria_regras.py:7`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: s f: data = pickle.load(f) vetores = data['vectors'] documentos = data['documents']

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/formula/auditoria_regras.py

In the server's implementation (`ingestao/formulas/analisador_lacuna_agnostico.py:10`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ') as f: return pickle.load(f)['documents'] def aplicar_equacao_silex(): print("[*] Extraindo Lacunas Semân

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/formulas/analisador_lacuna_agnostico.py

In the server's implementation (`ingestao/formulas/ask_recruta.py:15`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 'rb') as f: data = pickle.load(f) index = data['index'] documents = data['documents'] driver = GraphDatabas

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/formulas/ask_recruta.py

In the server's implementation (`ingestao/formulas/buscador_bruto.py:12`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 'rb') as f: data = pickle.load(f) vector_index = data['index'] documents = data['documents'] def query_sil

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/formulas/buscador_bruto.py

In the server's implementation (`ingestao/formulas/buscador_principal.py:12`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 'rb') as f: data = pickle.load(f) vector_index = data['index'] documents = data['documents'] def query_sil

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/formulas/buscador_principal.py

In the server's implementation (`ingestao/formulas/buscador_sniper.py:12`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 'rb') as f: data = pickle.load(f) vector_index = data['index'] documents = data['documents'] def query_sil

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server ingestao/formulas/buscador_sniper.py