Workbench (jazz-max) MCP Server

Tools that read sensitive data ([list_files, read_file]) and tools that can send data out ([run_command]) are exposed together. An agent can move private data to the sink.

Evidence: sources [list_files, read_file] → sinks [run_command]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow list_files → run_command

Tool "run_command" appears to run shell commands or evaluate code (keyword "run_command" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool run_command

Tool "write_file" can write, overwrite or delete files (keyword "write_file" in tool name). Verify it is scoped to a safe directory.

Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.

Location: tool write_file

Tool "run_command" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool run_command

Tool "write_file" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool write_file

In a packaging/dev/install script (shipped, but not the server runtime) (`tools/claude.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from 'node:child_process'; import { randomUUID } from 'node:crypto'; import { z } from 'zod'; /** @type {M

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tools/claude.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`tools/gitStatus.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from 'node:child_process'; import { EXEC_TIMEOUT } from '../lib/safety.mjs'; function git(args, cwd) { r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tools/gitStatus.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`tools/projectInfo.mjs:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from 'node:child_process'; export function register(server, projectRoot) { server.tool('project_info', '

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tools/projectInfo.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`tools/runCommand.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from 'node:child_process'; import { z } from 'zod'; import { validateCommand, EXEC_TIMEOUT, MAX_OUTPUT } fr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tools/runCommand.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`tools/searchCode.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from 'node:child_process'; import path from 'node:path'; import { z } from 'zod'; import { EXEC_TIMEOUT, MA

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tools/searchCode.mjs