Web Tools (mlawsonking) MCP Server

In the server's implementation (`core/engines/code.js:20`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: s+Function\s*\(/, msg: 'new Function() executes arbitrary code from strings.', fix: 'Avoid dynamic code generation.' },

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server core/engines/code.js

In the server's implementation (`core/engines/code.js:23`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ec)\s*\(/, msg: 'eval()/exec() executes arbitrary code.', fix: 'Use ast.literal_eval for data; avoid dynamic execution.'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server core/engines/code.js

In the server's implementation (`core/engines/email.js:191`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ); const r = await fetch('https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/maste

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server core/engines/email.js

In the server's implementation (`core/engines/url.js:65`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 0); const r = await fetch('https://check.torproject.org/torbulkexitlist', { signal: ctrl.signal }); clearTimeout

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server core/engines/url.js

In the server's implementation (`core/tools/firewall.js:179`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const r = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`, { signal: ctrl.signal, headers: { 'Add-P

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server core/tools/firewall.js

In the server's implementation (`core/tools/web.js:40`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: tional.set(name, { mod: require(name), error: null }); } catch (e) { const absent = e && e.code === 'MODULE_NO

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server core/tools/web.js