Docs (voltagent) MCP Server

A live-looking JSON Web Token is hardcoded in `examples/with-voltagent-actions/src/config.ts:66`. Secrets in source ship to everyone who installs the package and are a direct credential leak.

Evidence: JSON Web Token: eyJh…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server examples/with-voltagent-actions/src/config.ts

In the server's implementation (`examples/next-js-chatbot-starter-template/lib/tools/calculator.ts:24`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eval(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server examples/next-js-chatbot-starter-template/lib/tools/calculator.ts

In the server's implementation (`examples/with-playwright/src/tools/interactionTool.ts:94`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eval(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server examples/with-playwright/src/tools/interactionTool.ts

In the server's implementation (`examples/github-star-stories/src/tools.ts:13`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: fetch(`https://api.github.com/users/${username}`

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server examples/github-star-stories/src/tools.ts

In the server's implementation (`examples/with-tavily-search/src/tools.ts:63`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: fetch("https://api.tavily.com/search"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server examples/with-tavily-search/src/tools.ts

In the server's implementation (`examples/with-whatsapp/src/webhooks/whatsapp.ts:13`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: fetch(`https://graph.facebook.com/v18.0/${phoneNumberId}/messages`

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server examples/with-whatsapp/src/webhooks/whatsapp.ts