Trace (nikolai-vysotskyi) MCP Server

In the server's implementation (`dist/extract-worker.js:12356`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: json", // SSH keys "id_rsa", "id_rsa.*", "id_ed25519", "id_ed25519.*", "id_dsa", "id_ecdsa", // Auth / c

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/extract-worker.js

In the server's implementation (`dist/proxy.js:26541`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: FileSync, spawn } from "child_process"; import fs11 from "fs"; import { constants as osConstants } from "os"; import pat

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/proxy.js

In the server's implementation (`dist/proxy.js:26688`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { const out = execSync(`launchctl list ${PLIST_LABEL} 2>&1`, { encoding: "utf-8" }); return !out.includes(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/proxy.js

In the server's implementation (`dist/proxy.js:7486`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ; return (await import(href)).default; } catch (error48) { try { return (0, exports.load

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/proxy.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/ga4-snapshot.mjs:89`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ('base64url'); return fetch('https://oauth2.googleapis.com/token', { method: 'POST', headers: { 'Content-Type'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/ga4-snapshot.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/verify-upgrade-path.mjs:63`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const res = await fetch(`https://api.github.com/repos/${REPO}/releases?per_page=10`, { headers: { 'User-Agen

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/verify-upgrade-path.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/bench-index-throughput.ts:14`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from 'node:child_process'; import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/bench-index-throughput.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/bench-name-tokens.ts:26`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from 'node:child_process'; import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'; i

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/bench-name-tokens.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/bench-pr-context.ts:33`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from 'node:child_process'; import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/bench-pr-context.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/bench-pr-quality.ts:28`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from 'node:child_process'; import fs from 'node:fs'; import path from 'node:path'; import { fileURLToPath }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/bench-pr-quality.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/bench-response-tokens.ts:18`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from 'node:child_process'; import { readFileSync, writeFileSync } from 'node:fs'; import { fileURLToPath, p

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/bench-response-tokens.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/bench-session-scaling.ts:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from 'node:child_process'; import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/bench-session-scaling.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/bench-toon.ts:30`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from 'node:child_process'; import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/bench-toon.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/calibrate-health-metrics.mjs:30`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from 'node:child_process'; const FIX_PATTERN = /\b(fix|bug|patch|hotfix|repair|resolve|correct)\b/i; const

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/calibrate-health-metrics.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/capture-screenshots.mjs:56`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ync, spawn } from 'node:child_process'; import { createHash } from 'node:crypto'; import fs from 'node:fs'; import os fr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/capture-screenshots.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/bench-name-tokens.ts:49`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rd<string, unknown>> => import(spec); { const o200k = await import('gpt-tokenizer/encoding/o200k_base'); tokenizers

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/bench-name-tokens.ts

"trace-mcp" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package trace-mcp