Rosetta (tikoci) MCP Server

Tool "routeros_lookup_property" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool routeros_lookup_property

Tool "routeros_explain_command" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool routeros_explain_command

Tool "routeros_command_version_check" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool routeros_command_version_check

In the server's implementation (`bin/rosetta.js:23`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import("node:child_process"); const proc = spawn("bun", ["run", entry, ...process.argv.slice(2)], { std

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/rosetta.js

Untrusted-input tools ([routeros_get_page, routeros_lookup_property, routeros_explain_command, routeros_command_tree, routeros_stats, routeros_search_changelogs, routeros_dude_search, routeros_dude_get_page, routeros_command_version_check, routeros_command_diff, routeros_current_versions]) co-exist with external-action tools ([routeros_lookup_property, routeros_explain_command, routeros_command_version_check]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [routeros_get_page, routeros_lookup_property, routeros_explain_command, routeros_command_tree, routeros_stats, routeros_search_changelogs, routeros_du

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow routeros_get_page → routeros_lookup_property

In the server's implementation (`src/extract-changelogs.ts:162`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const resp = await fetch(`https://upgrade.mikrotik.com/routeros/NEWESTa7.${channel}`); if (!resp.ok) {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/extract-changelogs.ts

Tool "routeros_lookup_property" takes a command-shaped parameter "command_path" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool routeros_lookup_property · inputSchema.properties.command_path

Tool "routeros_explain_command" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool routeros_explain_command · inputSchema.properties.command

Tool "routeros_command_version_check" takes a command-shaped parameter "command_path" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool routeros_command_version_check · inputSchema.properties.command_path

In the server's implementation (`bin/rosetta.js:18`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: entry directly await import(entry); } else { // Running under Node — try to delegate to Bun, but warn the user co

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/rosetta.js

Tool "routeros_lookup_property" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool routeros_lookup_property

Tool "routeros_explain_command" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool routeros_explain_command

Tool "routeros_command_version_check" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool routeros_command_version_check

In a packaging/dev/install script (shipped, but not the server runtime) (`src/release.test.ts:779`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: oContain("MCP retrieval eval (Phase 0)"); expect(src).not.toContain("MCP retrieval eval (Phase 1, self-supervised, n

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/release.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/export.test.ts:506`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: tch(", "new Database", "child_process", "readFile(", "Bun.file(", "require("]) { expect(src).not.toContain(primiti

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/export.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/release.test.ts:98`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: expect(src).toContain('spawn("bun"'); }); }); // -------------------------------------------------------------------

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/release.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`src/setup.ts:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from "node:child_process"; import { closeSync, existsSync, fstatSync, openSync, readdirSync, re

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/setup.ts