Silex Archaeology — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "silex-archaeology",
"source": {
"kind": "package",
"origin": "silex-archaeology"
},
"server": {
"name": "silex-archaeology"
}
},
"grade": "C",
"score": {
"score": 78,
"threatScore": 85,
"grade": "C",
"band": "C",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 15.44,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 1,
"appliedPenalty": 6.3
},
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.5,
"appliedPenalty": 3.15
},
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.25,
"appliedPenalty": 1.58
},
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-007",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "verification-discount",
"level": "repo",
"label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
"appliedPenalty": 1
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "high",
"reasons": [
"ingests untrusted external content (a prompt-injection entry point)",
"can send data / act on an external service",
"can execute shell commands or code"
],
"tags": [
"untrusted-input",
"external-sink",
"code-exec"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (116 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (extractors/emitters/materialize.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`extractors/emitters/materialize.py:91`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "extractors/emitters/materialize.py"
},
"evidence": "try: out = subprocess.run( [\"git\", *args], capture_output=True, text=Tr",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "extractors/emitters/materialize.py",
"line": 91,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (extractors/metrics/provenance_report.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`extractors/metrics/provenance_report.py:93`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "extractors/metrics/provenance_report.py"
},
"evidence": "str) -> str: out = subprocess.run( [\"git\", *args], cwd=str(repo_root), capture_output=True,",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "extractors/metrics/provenance_report.py",
"line": 93,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (extractors/phase2_derived/risk_marker.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`extractors/phase2_derived/risk_marker.py:211`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "extractors/phase2_derived/risk_marker.py"
},
"evidence": "try: result = subprocess.run( [\"git\", \"blame\", \"-L\", f\"{line},{line}\", \"--porcelain\", \"--\", file],",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "extractors/phase2_derived/risk_marker.py",
"line": 211,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (extractors/phase5_narrative/operations_builder.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`extractors/phase5_narrative/operations_builder.py:977`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "extractors/phase5_narrative/operations_builder.py"
},
"evidence": "try: out = subprocess.check_output( [\"grep\", \"-rln\", \"--include=*.cs\", f\"\\",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "extractors/phase5_narrative/operations_builder.py",
"line": 977,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (extractors/runtime/package_merge.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`extractors/runtime/package_merge.py:178`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "extractors/runtime/package_merge.py"
},
"evidence": "try: out = subprocess.run( [\"git\", \"merge-base\", \"--is-ancestor\", ancestor, descendant],",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "extractors/runtime/package_merge.py",
"line": 178,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (extractors/runtime/run_manifest.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`extractors/runtime/run_manifest.py:225`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "extractors/runtime/run_manifest.py"
},
"evidence": "try: out = subprocess.run( [\"git\", *args], capture_output=True, text=Tr",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "extractors/runtime/run_manifest.py",
"line": 225,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (fresh/hook.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`fresh/hook.py:50`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "fresh/hook.py"
},
"evidence": "dProcess.\"\"\" return subprocess.run( [\"git\", *args], cwd=cwd, capture_output=True, te",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "fresh/hook.py",
"line": 50,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (fresh/hook_install.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`fresh/hook_install.py:46`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "fresh/hook_install.py"
},
"evidence": "str) -> str: proc = subprocess.run( [\"git\", \"rev-parse\", \"--show-toplevel\"], cwd=cwd, captur",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "fresh/hook_install.py",
"line": 46,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (ingestao/detectors/clear_and_reingest.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/detectors/clear_and_reingest.py:21`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/detectors/clear_and_reingest.py"
},
"evidence": "return False r = subprocess.run([sys.executable, path], cwd=SCRIPT_DIR) return r.returncode == 0 def main():",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "ingestao/detectors/clear_and_reingest.py",
"line": 21,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (ingestao/vendor_filter.py)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/vendor_filter.py:402`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/vendor_filter.py"
},
"evidence": "try: result = subprocess.run( [\"git\", \"log\", \"--oneline\", \"--follow\", \"--\", rel_path],",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "ingestao/vendor_filter.py",
"line": 402,
"nonRuntime": false
}
},
{
"ruleId": "MTC-FLOW-005",
"title": "Untrusted input can drive an external action",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "Untrusted-input tools ([get_rules_by_ids]) co-exist with external-action tools ([silex_export_materialized]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.",
"remediation": "Require confirmation for state-changing/egress actions triggered after processing untrusted content.",
"location": {
"kind": "flow",
"name": "get_rules_by_ids → silex_export_materialized"
},
"evidence": "untrusted [get_rules_by_ids] → sinks [silex_export_materialized]",
"owasp": "LLM06:2025 Excessive Agency",
"references": [],
"data": {
"untrusted": [
"get_rules_by_ids"
],
"sinks": [
"silex_export_materialized"
]
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (ingestao/silex_interativo.py)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/silex_interativo.py:36`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/silex_interativo.py"
},
"evidence": "} r = requests.post(\"http://172.17.0.1:11434/api/generate\", json=payload, stream=True) pri",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "ingestao/silex_interativo.py",
"line": 36,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (ui_archaeology.py)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ui_archaeology.py:1829`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ui_archaeology.py"
},
"evidence": "rf_counter() resp = requests.post( \"https://openrouter.ai/api/v1/chat/completions\", headers={",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "ui_archaeology.py",
"line": 1829,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (ingestao/arqueologia_recruta.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/arqueologia_recruta.py:61`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/arqueologia_recruta.py"
},
"evidence": "') as f: data = pickle.load(f) index = data['index'] documents = data['documents'] model = S",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "ingestao/arqueologia_recruta.py",
"line": 61,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (ingestao/fase0_export_fragmentos_from_pickle.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/fase0_export_fragmentos_from_pickle.py:23`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/fase0_export_fragmentos_from_pickle.py"
},
"evidence": "') as f: data = pickle.load(f) documents = data.get('documents', []) if not documents: print(\"[!",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "ingestao/fase0_export_fragmentos_from_pickle.py",
"line": 23,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (ingestao/fase0_inspect_pickle.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/fase0_inspect_pickle.py:25`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/fase0_inspect_pickle.py"
},
"evidence": "') as f: data = pickle.load(f) print(\"data.keys():\", list(data.keys())) if 'documents' in data and data[",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "ingestao/fase0_inspect_pickle.py",
"line": 25,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (ingestao/formula/auditoria_agnostica.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/formula/auditoria_agnostica.py:8`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/formula/auditoria_agnostica.py"
},
"evidence": "s f: data = pickle.load(f) documentos = data['documents'] # Assume que os vetores es",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "ingestao/formula/auditoria_agnostica.py",
"line": 8,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (ingestao/formula/auditoria_regras.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/formula/auditoria_regras.py:7`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/formula/auditoria_regras.py"
},
"evidence": "s f: data = pickle.load(f) vetores = data['vectors'] documentos = data['documents']",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "ingestao/formula/auditoria_regras.py",
"line": 7,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (ingestao/formulas/analisador_lacuna_agnostico.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/formulas/analisador_lacuna_agnostico.py:10`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/formulas/analisador_lacuna_agnostico.py"
},
"evidence": "') as f: return pickle.load(f)['documents'] def aplicar_equacao_silex(): print(\"[*] Extraindo Lacunas Semân",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "ingestao/formulas/analisador_lacuna_agnostico.py",
"line": 10,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (ingestao/formulas/ask_recruta.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/formulas/ask_recruta.py:15`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/formulas/ask_recruta.py"
},
"evidence": "'rb') as f: data = pickle.load(f) index = data['index'] documents = data['documents'] driver = GraphDatabas",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "ingestao/formulas/ask_recruta.py",
"line": 15,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (ingestao/formulas/buscador_bruto.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/formulas/buscador_bruto.py:12`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/formulas/buscador_bruto.py"
},
"evidence": "'rb') as f: data = pickle.load(f) vector_index = data['index'] documents = data['documents'] def query_sil",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "ingestao/formulas/buscador_bruto.py",
"line": 12,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (ingestao/formulas/buscador_principal.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/formulas/buscador_principal.py:12`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/formulas/buscador_principal.py"
},
"evidence": "'rb') as f: data = pickle.load(f) vector_index = data['index'] documents = data['documents'] def query_sil",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "ingestao/formulas/buscador_principal.py",
"line": 12,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-007",
"title": "Unsafe deserialization (ingestao/formulas/buscador_sniper.py)",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`ingestao/formulas/buscador_sniper.py:12`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "ingestao/formulas/buscador_sniper.py"
},
"evidence": "'rb') as f: data = pickle.load(f) vector_index = data['index'] documents = data['documents'] def query_sil",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-007",
"file": "ingestao/formulas/buscador_sniper.py",
"line": 12,
"nonRuntime": false
}
}
],
"toxicFlows": [
{
"id": "flow-1",
"severity": "medium",
"confidence": "strong",
"untrustedInput": [
"get_rules_by_ids"
],
"sensitiveSource": [],
"externalSink": [
"silex_export_materialized"
],
"selfContained": false,
"description": "Untrusted input can drive an external action even though no sensitive source is exposed."
}
],
"capabilities": [
{
"tool": "silex.business_mermaid.status",
"tags": [],
"reasons": {}
},
{
"tool": "silex.business_mermaid.run",
"tags": [],
"reasons": {}
},
{
"tool": "silex.code_decision.symbol_story",
"tags": [],
"reasons": {}
},
{
"tool": "silex.code_decision.file_story",
"tags": [],
"reasons": {}
},
{
"tool": "silex.code_symbol.search",
"tags": [],
"reasons": {}
},
{
"tool": "silex.communities.status",
"tags": [],
"reasons": {}
},
{
"tool": "silex.code_decision.context_pack",
"tags": [],
"reasons": {}
},
{
"tool": "silex.code_decision.community_story",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.fact.generate",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.ledger.propose",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.ledger.generate_batch",
"tags": [],
"reasons": {}
},
{
"tool": "silex.refactoring.crosscutting",
"tags": [],
"reasons": {}
},
{
"tool": "silex.curation.community_nature",
"tags": [],
"reasons": {}
},
{
"tool": "silex.curation.budget",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.ledger.list_proposed",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.ledger.promote",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.ledger.reject",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.ledger.correct",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.goal.upsert",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.goal.list",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.goal.get",
"tags": [],
"reasons": {}
},
{
"tool": "silex.contract.search",
"tags": [],
"reasons": {}
},
{
"tool": "silex.community.code_pack",
"tags": [],
"reasons": {}
},
{
"tool": "silex.entity.pack",
"tags": [],
"reasons": {}
},
{
"tool": "silex.business_logic.submit",
"tags": [],
"reasons": {}
},
{
"tool": "silex.community.label_submit",
"tags": [],
"reasons": {}
},
{
"tool": "silex.feedback.investigate_rule",
"tags": [],
"reasons": {}
},
{
"tool": "silex.feedback.report_extractor_gap",
"tags": [],
"reasons": {}
},
{
"tool": "silex.feedback.list_extractor_gaps",
"tags": [],
"reasons": {}
},
{
"tool": "ingest_field_graph",
"tags": [],
"reasons": {}
},
{
"tool": "get_field_graph_summary",
"tags": [],
"reasons": {}
},
{
"tool": "get_operation_fields",
"tags": [],
"reasons": {}
},
{
"tool": "get_field_operations",
"tags": [],
"reasons": {}
},
{
"tool": "list_unresolved_field_references",
"tags": [],
"reasons": {}
},
{
"tool": "silex.fsm_evidence.run",
"tags": [],
"reasons": {}
},
{
"tool": "silex.fsm_evidence.inspect",
"tags": [],
"reasons": {}
},
{
"tool": "silex.fsm_evidence.build_transitions_offline",
"tags": [],
"reasons": {}
},
{
"tool": "silex.llm_provider.status",
"tags": [],
"reasons": {}
},
{
"tool": "silex.phase5_narrative.status",
"tags": [],
"reasons": {}
},
{
"tool": "silex.phase5_narrative.run",
"tags": [],
"reasons": {}
},
{
"tool": "silex.pipeline_run.create",
"tags": [],
"reasons": {}
},
{
"tool": "silex.pipeline_run.list",
"tags": [],
"reasons": {}
},
{
"tool": "silex.pipeline_run.get",
"tags": [],
"reasons": {}
},
{
"tool": "silex.pipeline_run.status",
"tags": [],
"reasons": {}
},
{
"tool": "silex.pipeline_run.artifacts",
"tags": [],
"reasons": {}
},
{
"tool": "silex.pipeline_run.resume",
"tags": [],
"reasons": {}
},
{
"tool": "silex.packages.list",
"tags": [],
"reasons": {}
},
{
"tool": "silex.packages.get",
"tags": [],
"reasons": {}
},
{
"tool": "silex.packages.merge",
"tags": [],
"reasons": {}
},
{
"tool": "silex.packages.run",
"tags": [],
"reasons": {}
},
{
"tool": "silex.extractors.list",
"tags": [],
"reasons": {}
},
{
"tool": "silex.extractors.describe",
"tags": [],
"reasons": {}
},
{
"tool": "silex.extractors.run",
"tags": [],
"reasons": {}
},
{
"tool": "silex.extractors.run_batch",
"tags": [],
"reasons": {}
},
{
"tool": "silex.extractors.get_output",
"tags": [],
"reasons": {}
},
{
"tool": "silex.extractors.validate_output",
"tags": [],
"reasons": {}
},
{
"tool": "silex.product_surface.diagnose",
"tags": [],
"reasons": {}
},
{
"tool": "silex.qdrant_gate.diagnose",
"tags": [],
"reasons": {}
},
{
"tool": "silex.qdrant_gate.run",
"tags": [],
"reasons": {}
},
{
"tool": "silex.review.surface_status",
"tags": [],
"reasons": {}
},
{
"tool": "silex.roadmap.score",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.governance",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.status",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.plan",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.queue",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.manifest",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.arch_findings",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.merge_ready",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.enqueue",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.claim",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.set_blocked",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.set_done",
"tags": [],
"reasons": {}
},
{
"tool": "silex.runner.comment_gate",
"tags": [],
"reasons": {}
},
{
"tool": "label_communities",
"tags": [],
"reasons": {}
},
{
"tool": "get_communities",
"tags": [],
"reasons": {}
},
{
"tool": "get_code_communities",
"tags": [],
"reasons": {}
},
{
"tool": "get_domain_map",
"tags": [],
"reasons": {}
},
{
"tool": "get_class_references",
"tags": [],
"reasons": {}
},
{
"tool": "get_bridges",
"tags": [],
"reasons": {}
},
{
"tool": "get_structural_findings",
"tags": [],
"reasons": {}
},
{
"tool": "get_workspace_stats",
"tags": [],
"reasons": {}
},
{
"tool": "search_code_semantic",
"tags": [],
"reasons": {}
},
{
"tool": "discover_features",
"tags": [],
"reasons": {}
},
{
"tool": "create_workspace",
"tags": [],
"reasons": {}
},
{
"tool": "rescan_workspace",
"tags": [],
"reasons": {}
},
{
"tool": "invalidate_paths",
"tags": [],
"reasons": {}
},
{
"tool": "generate_domain_jsons",
"tags": [],
"reasons": {}
},
{
"tool": "validate_domain_jsons",
"tags": [],
"reasons": {}
},
{
"tool": "generate_domain_report",
"tags": [],
"reasons": {}
},
{
"tool": "discover_entity_candidates",
"tags": [],
"reasons": {}
},
{
"tool": "discover_workflows",
"tags": [],
"reasons": {}
},
{
"tool": "list_pending_reviews",
"tags": [],
"reasons": {}
},
{
"tool": "review_artifact",
"tags": [],
"reasons": {}
},
{
"tool": "publish_domain",
"tags": [],
"reasons": {}
},
{
"tool": "get_published_domain",
"tags": [],
"reasons": {}
},
{
"tool": "get_state_machines",
"tags": [],
"reasons": {}
},
{
"tool": "get_operation_detail",
"tags": [],
"reasons": {}
},
{
"tool": "get_workflows_for_operation",
"tags": [],
"reasons": {}
},
{
"tool": "get_operation_workflow_context",
"tags": [],
"reasons": {}
},
{
"tool": "get_rules_by_ids",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"fetch\""
]
}
},
{
"tool": "silex_export_materialized",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"export_to\""
]
}
},
{
"tool": "list_extractors",
"tags": [],
"reasons": {}
},
{
"tool": "run_extractor",
"tags": [],
"reasons": {}
},
{
"tool": "silex.state_review.list_pending",
"tags": [],
"reasons": {}
},
{
"tool": "silex.state_review.get_next",
"tags": [],
"reasons": {}
},
{
"tool": "silex.state_review.apply",
"tags": [],
"reasons": {}
},
{
"tool": "silex.state_review.summary",
"tags": [],
"reasons": {}
},
{
"tool": "silex.state_review.list_targets",
"tags": [],
"reasons": {}
},
{
"tool": "silex.tool_surface.list",
"tags": [],
"reasons": {}
},
{
"tool": "silex.tool_surface.describe",
"tags": [],
"reasons": {}
},
{
"tool": "silex.transition_review.list_pending",
"tags": [],
"reasons": {}
},
{
"tool": "silex.transition_review.get_next",
"tags": [],
"reasons": {}
},
{
"tool": "silex.transition_review.apply",
"tags": [],
"reasons": {}
},
{
"tool": "silex.transition_review.summary",
"tags": [],
"reasons": {}
},
{
"tool": "silex.transition_review.list_targets",
"tags": [],
"reasons": {}
},
{
"tool": "list_workspaces",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "01e5ede9f1e01b8b2804db489dcfa3b713e501bbe38d9047b3c52153c6b96534",
"stats": {
"tools": 116,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 10,
"medium": 13,
"low": 0,
"info": 0
}
}
}