Thumbgate MCP Server

In the server's implementation (`bin/cli.js:37`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ile, spawn } = require('child_process'); const { codexAutoUpdateCliEntry, codexAutoUpdateMcpEntry, isSourceCheckou

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/cli.js

In the server's implementation (`src/api/server.js:5805`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const proxyReq = https.request('https://plausible.io/api/event', { method: 'POST', headers: {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/api/server.js

In the server's implementation (`bin/cli.js:905`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: onds)...'); try { execSync(`gcloud services enable aiplatform.googleapis.com --project=${activeProject}`, { stdio:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/cli.js

In the server's implementation (`adapters/mcp/server-stdio.js:281`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } try { return require(modulePath); } catch (error) { const message = String(error && error.message || ''

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server adapters/mcp/server-stdio.js

In the server's implementation (`bin/cli.js:2818`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { startStdioServer } = require(mcpServer); startStdioServer(); // Start watcher as a background daemon alongside MC

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/cli.js

In the server's implementation (`src/api/server.js:343`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } try { return require(modulePath); } catch (error) { const message = String(error && error.message || ''

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/api/server.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/secret-scanner.js:36`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: key', regex: /(^|\/)(?:id_rsa|id_ed25519|id_dsa|id_ecdsa)$/i }, { id: 'ssh_private_key_path', label: 'SSH private key

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/secret-scanner.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/seo-gsd.js:1086`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ectly. It can read .env, .npmrc, .pypirc, Docker config, SSH keys, and cloud tokens while an AI coding assistant repeats

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/seo-gsd.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/security-scanner.js:67`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rser library instead of eval() or dynamic Function constructors.', }, // XSS { id: 'xss-innerhtml', categ

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/security-scanner.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/agent-outcome-monitor.js:263`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Sync } = require(\'node:child_process\');', `const result = spawnSync(process.execPath, ${JSON.stringify(args)}, {`,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/agent-outcome-monitor.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/agentic-data-pipeline.js:764`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nSync } = require('node:child_process'); const result = spawnSync(process.execPath, [${args.map((entry) => JSON.stringif

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/agentic-data-pipeline.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/async-job-runner.js:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } = require('child_process'); const { captureFeedback, analyzeFeedback, getFeedbackPaths, readJSONL } = requ

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/async-job-runner.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/codegraph-context.js:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } = require('child_process'); const PROJECT_ROOT = path.join(__dirname, '..'); const DEFAULT_TIMEOUT_MS = 80

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/codegraph-context.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/contextfs.js:1098`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); const cwd = process.cwd(); gitContext = { branch: branch || execS

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/contextfs.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/feedback-loop.js:1846`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: fork } = require('node:child_process'); const localOptimizerPath = path.join(process.cwd(), 'scripts', 'sel

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/feedback-loop.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/financial-control-plane.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nSync } = require('node:child_process'); const fs = require('node:fs'); const path = require('node:path'); const { getFe

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/financial-control-plane.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/gates-engine.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } = require('child_process'); const { loadOptionalModule } = require('./private-core-boundary'); const { isP

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/gates-engine.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/generate-eval-scorecard.js:52`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nSync } = require('node:child_process'); const result = spawnSync( process.execPath, [path.join(PROJECT_ROOT,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/generate-eval-scorecard.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/billing.js:63`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) return null; return require(modulePath); } const CONFIG = { STRIPE_SECRET_KEY: process.env.STRIPE_SECRET_KEY || '

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/billing.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/dashboard.js:73`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) return null; return require(modulePath); } function buildUnavailableOrgDashboard(windowHours) { return { avai

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/dashboard.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/feedback-loop.js:230`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) return null; return require(modulePath); } /** * Update the statusline cache with latest lesson info after feedbac

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/feedback-loop.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/internal-agent-bootstrap.js:24`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) return null; return require(modulePath); } function normalizeText(value) { if (value === undefined || value === n

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/internal-agent-bootstrap.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/model-tier-router.js:24`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: if (!_config) _config = require(CONFIG_PATH); return _config; } // --------------------------------------------------

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/model-tier-router.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/private-core-boundary.js:23`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y) { try { return require(request); } catch (error) { if (!isOptionalModuleMissing(error, request)) {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/private-core-boundary.js

"thumbgate" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node bin/postinstall.js || true

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package thumbgate