Unified (Om-Shree-0709) MCP Server

In the server's implementation (`bin/index.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: execSync, spawn } from 'child_process' import { createRequire } from 'module' import inquirer from 'inquirer' import cha

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/index.js

In the server's implementation (`template/backend/code_executor_server.py:107`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e result = subprocess.run( [sys.executable, tmp_path], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server template/backend/code_executor_server.py

In the server's implementation (`template/backend/system_info_server.py:118`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: result = subprocess.run( [sys.executable, "-m", "pip", "list", "--format=freeze"]

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server template/backend/system_info_server.py

In the server's implementation (`template/backend/server.py:89`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: /min FREE""" resp = requests.post( "https://models.inference.ai.azure.com/chat/completions", headers

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server template/backend/server.py

In the server's implementation (`bin/index.js:110`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: stall python deps execSync( `${pythonCmd} -m pip install -r ${path.join(BACKEND_DIR, 'requirements.txt')}

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/index.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/check.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from 'child_process' import chalk from 'chalk' console.log(chalk.blue('\n🔍 Checking system requireme

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/check.js

"unified-mcp" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node scripts/check.js

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package unified-mcp