Ssh (tufantunc) MCP Server

Tool "run-command" appears to run shell commands or evaluate code (keyword "run_command" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool run-command

In the server's implementation (`build/config/windows-acl.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execFile } from 'child_process'; import { promisify } from 'util'; import { existsSync, realpathSync } from 'fs';

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/config/windows-acl.js

In the server's implementation (`build/ssh/connection.js:217`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: mand}`; } async exec(rawCommand, opts = {}) { await this.ensureConnected(); const command = this

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/ssh/connection.js

Untrusted-input tools ([sftp-download]) co-exist with external-action tools ([run-command]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [sftp-download] → sinks [run-command]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow sftp-download → run-command

Tool "run-command" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool run-command