Vibeguard — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "@yagyeshvyas/vibeguard",
"source": {
"kind": "package",
"origin": "@yagyeshvyas/vibeguard"
},
"server": {
"name": "@yagyeshvyas/vibeguard"
}
},
"grade": "B",
"score": {
"score": 81,
"threatScore": 88,
"grade": "B",
"band": "B",
"categorySubtotals": {
"injection": 11.25,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 1.2,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "threat",
"ruleId": "MTC-INJ-CMD-1",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"rawWeight": 3,
"confidenceMult": 0.4,
"diminishingFactor": 1,
"appliedPenalty": 1.2
},
{
"kind": "threat",
"ruleId": "MTC-INJ-CMD-1",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"rawWeight": 3,
"confidenceMult": 0.4,
"diminishingFactor": 0.5,
"appliedPenalty": 0.6
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 1,
"appliedPenalty": 6.3
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.5,
"appliedPenalty": 3.15
},
{
"kind": "threat",
"ruleId": "MTC-SUP-010",
"category": "supply-chain",
"severity": "low",
"confidence": "heuristic",
"rawWeight": 3,
"confidenceMult": 0.4,
"diminishingFactor": 1,
"appliedPenalty": 1.2
},
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "verification-discount",
"level": "repo",
"label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
"appliedPenalty": 1
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "high",
"reasons": [
"can send data / act on an external service",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code"
],
"tags": [
"code-exec",
"sensitive-source",
"external-sink"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (82 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-FLOW-004",
"title": "Sensitive-source and external-sink co-exist",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "Tools that read sensitive data ([config_dump]) and tools that can send data out ([guard_action, check_command, slack_notify, agent_guard, sandbox_exec]) are exposed together. An agent can move private data to the sink.",
"remediation": "Keep secret-reading and egress capabilities on separate, separately-approved servers.",
"location": {
"kind": "flow",
"name": "config_dump → guard_action"
},
"evidence": "sources [config_dump] → sinks [guard_action, check_command, slack_notify, agent_guard, sandbox_exec]",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"references": [],
"data": {
"sources": [
"config_dump"
],
"sinks": [
"guard_action",
"check_command",
"slack_notify",
"agent_guard",
"sandbox_exec"
]
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/interceptor.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/interceptor.js:44`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/interceptor.js"
},
"evidence": "ssh', '.aws', '.gnupg', '.npmrc', '.gitconfig'], // Block commands matching these patterns blockCommands: ['rm -rf',",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/interceptor.js",
"line": 44,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/rules-pack.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/rules-pack.js:1173`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/rules-pack.js"
},
"evidence": "rnal packages; configure .npmrc scopes correctly.', owasp: 'A08:2025 Software and Data Integrity Failures', cwe:",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/rules-pack.js",
"line": 1173,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/rules.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/rules.js:225`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/rules.js"
},
"evidence": "s token (also flagged in .npmrc).', fix: 'Remove it, use an environment variable / CI secret, and revoke it on npmj",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/rules.js",
"line": 225,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/scanner.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/scanner.js:74`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/scanner.js"
},
"evidence": ", '.env.production', '.npmrc', 'Dockerfile', '.dockerenv', ]); const MAX_FILE_BYTES = 2 * 1024 * 1024; // 2MB — s",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/scanner.js",
"line": 74,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (src/slopsquat.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/slopsquat.js:133`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/slopsquat.js"
},
"evidence": ". If internal, configure .npmrc scopes. If from an AI suggestion, remove it.`, owasp: 'A08:2025 Software and D",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "src/slopsquat.js",
"line": 133,
"nonRuntime": false
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"guard_action\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"guard_action\" appears to run shell commands or evaluate code (parameter \"command\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "guard_action"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"check_command\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"check_command\" appears to run shell commands or evaluate code (parameter \"command\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "check_command"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"agent_guard\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"agent_guard\" appears to run shell commands or evaluate code (parameter \"command\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "agent_guard"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"sandbox_exec\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"sandbox_exec\" appears to run shell commands or evaluate code (keyword \"exec\" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "sandbox_exec"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (bin/cli.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`bin/cli.js:1194`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "bin/cli.js"
},
"evidence": "variables - Never use eval() or new Function() with user input - Never concatenate SQL strings — use parameterized qu",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "bin/cli.js",
"line": 1194,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (src/ast.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/ast.js:149`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/ast.js"
},
"evidence": "ecution.', fix: 'Remove eval(). Use JSON.parse or an explicit dispatch table.', snippet: 'eval(...)' }); } i",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "src/ast.js",
"line": 149,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (src/policy-gen.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/policy-gen.js:283`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/policy-gen.js"
},
"evidence": "'unsafe-eval' — remove eval() usage\" : null, ].filter(Boolean), }; } module.exports = { generatePrivacyPolicy, g",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "src/policy-gen.js",
"line": 283,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (src/rules-pack.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/rules-pack.js:750`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/rules-pack.js"
},
"evidence": "cy allows unsafe-eval — eval() and new Function() can be used for XSS.', fix: 'Remove unsafe-eval; refactor any code",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "src/rules-pack.js",
"line": 750,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (src/rules.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/rules.js:334`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/rules.js"
},
"evidence": "ipInString: true, // an eval() inside a quoted string is text, not a call message: 'eval() executes arbitrary code",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "src/rules.js",
"line": 334,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (src/secure-prompt.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/secure-prompt.js:24`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/secure-prompt.js"
},
"evidence": ", msg: 'Prompt requests eval() — code injection risk' }, { re: /new\\s+Function\\s*\\(/i, risk: 'high', msg: 'Prompt requ",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "src/secure-prompt.js",
"line": 24,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (src/taint-ast.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/taint-ast.js:90`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/taint-ast.js"
},
"evidence": "le: 'User input reaches eval()/Function() (dataflow-confirmed)', message: 'A value derived from user input flows int",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "src/taint-ast.js",
"line": 90,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (src/taint.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/taint.js:53`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/taint.js"
},
"evidence": "le: 'User input reaches eval()/Function() (dataflow-confirmed)', message: 'A value derived from user input flows int",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "src/taint.js",
"line": 53,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (bin/cli.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`bin/cli.js:1207`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "bin/cli.js"
},
"evidence": "ever pass user input to exec() or spawn() without sanitization - For AI agents: add maxSteps, sandbox file access, allo",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "bin/cli.js",
"line": 1207,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/auto.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/auto.js:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/auto.js"
},
"evidence": ", execSync } = require('child_process'); const STATE_DIR = '.vibeguard'; const STATE_FILE = path.join(STATE_DIR, 'auto.",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/auto.js",
"line": 17,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/daemon.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/daemon.js:29`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/daemon.js"
},
"evidence": ", execSync } = require('child_process'); const DAEMON_FILE = '.vibeguard-daemon.json'; const DAEMON_LOG = '.vibeguard-d",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/daemon.js",
"line": 29,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/deps.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/deps.js:14`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/deps.js"
},
"evidence": ", execSync } = require('child_process'); const AUDIT_TIMEOUT_MS = 60000; // npm severity -> VibeGuard severity. npm us",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/deps.js",
"line": 14,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/engine.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/engine.js:162`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/engine.js"
},
"evidence": "e: /exec\\s*\\(/g, name: 'exec()', type: 'code' }, { re: /open\\s*\\(/g, name: 'open()', type: 'file' }, { re: /pickle",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/engine.js",
"line": 162,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/external.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/external.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/external.js"
},
"evidence": ", execSync } = require('child_process'); const isWin = process.platform === 'win32'; const TIMEOUT_MS = 180000; functi",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/external.js",
"line": 16,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/guard.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/guard.js:28`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/guard.js"
},
"evidence": "{ execSync } = require('child_process'); const { checkCommand } = require('./shell-guard'); const originalExecSync =",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/guard.js",
"line": 28,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/history.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/history.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/history.js"
},
"evidence": "ecFileSync } = require('child_process'); const { secretRules, matchAll } = require('./rules'); const isWin = process.pl",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/history.js",
"line": 13,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/interceptor.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/interceptor.js:280`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/interceptor.js"
},
"evidence": "ile, spawn } = require('child_process'); if (exec) { interceptors.exec = exec; require('child_process').exec =",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/interceptor.js",
"line": 280,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (src/mcp-server.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`src/mcp-server.js:516`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/mcp-server.js"
},
"evidence": "process.env, no fs, no child_process, no network. Time-limited and memory-limited. Full audit log of every operation at",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "src/mcp-server.js",
"line": 516,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (src/daemon.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`src/daemon.js:117`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/daemon.js"
},
"evidence": "const gitResult = execSync(`git show HEAD:\"${relPath}\" 2>NUL`, { cwd: rootDir,",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "src/daemon.js",
"line": 117,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (src/mcp-server.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`src/mcp-server.js:889`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/mcp-server.js"
},
"evidence": "s; try { diffFiles = execSync(`git diff ${base} --name-only`, { cwd: dir, encoding: 'utf8' }).trim().split('\\n').filt",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "src/mcp-server.js",
"line": 889,
"nonRuntime": false
}
},
{
"ruleId": "MTC-CAP-006",
"title": "Unconstrained command parameter \"command\" on \"guard_action\"",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"guard_action\" takes a command-shaped parameter \"command\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
"remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
"location": {
"kind": "tool",
"name": "guard_action",
"field": "inputSchema.properties.command"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"param": "command"
}
},
{
"ruleId": "MTC-CAP-006",
"title": "Unconstrained command parameter \"command\" on \"check_command\"",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"check_command\" takes a command-shaped parameter \"command\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
"remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
"location": {
"kind": "tool",
"name": "check_command",
"field": "inputSchema.properties.command"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"param": "command"
}
},
{
"ruleId": "MTC-CAP-006",
"title": "Unconstrained command parameter \"command\" on \"agent_guard\"",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"agent_guard\" takes a command-shaped parameter \"command\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
"remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
"location": {
"kind": "tool",
"name": "agent_guard",
"field": "inputSchema.properties.command"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"param": "command"
}
},
{
"ruleId": "MTC-CAP-006",
"title": "Unconstrained command parameter \"code\" on \"sandbox_exec\"",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"sandbox_exec\" takes a command-shaped parameter \"code\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
"remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
"location": {
"kind": "tool",
"name": "sandbox_exec",
"field": "inputSchema.properties.code"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"param": "code"
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (src/plugin.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`src/plugin.js:80`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "src/plugin.js"
},
"evidence": "try { mod = require(name); } catch { // Try resolving from the root directory co",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "src/plugin.js",
"line": 80,
"nonRuntime": false
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"guard_action\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"guard_action\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "guard_action"
},
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"check_command\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"check_command\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "check_command"
},
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"agent_guard\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"agent_guard\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "agent_guard"
},
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"sandbox_exec\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"sandbox_exec\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "sandbox_exec"
},
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-INJ-CMD-1",
"title": "Shell command embedded in tool metadata",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"description": "Shell command embedded in tool metadata detected in the description of tool \"check_command\". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.",
"remediation": "Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.",
"location": {
"kind": "tool",
"name": "check_command",
"field": "description"
},
"evidence": "rm -rf",
"owasp": "LLM01:2025 Prompt Injection",
"data": {
"kind": "command-in-prose"
}
},
{
"ruleId": "MTC-INJ-CMD-1",
"title": "Shell command embedded in tool metadata",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"description": "Shell command embedded in tool metadata detected in the description of tool \"agent_guard\". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.",
"remediation": "Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.",
"location": {
"kind": "tool",
"name": "agent_guard",
"field": "description"
},
"evidence": "rm -rf",
"owasp": "LLM01:2025 Prompt Injection",
"data": {
"kind": "command-in-prose"
}
},
{
"ruleId": "MTC-SUP-010",
"title": "Package runs install-time scripts (postinstall)",
"category": "supply-chain",
"severity": "low",
"confidence": "heuristic",
"description": "\"@yagyeshvyas/vibeguard\" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.",
"remediation": "Review the scripts; install with --ignore-scripts where possible and vet what they do.",
"location": {
"kind": "package",
"name": "@yagyeshvyas/vibeguard"
},
"evidence": "node scripts/postinstall.js",
"owasp": "LLM03:2025 Supply Chain",
"references": [
"https://github.com/ossf/package-analysis",
"https://owasp.org/www-project-top-10-ci-cd-security-risks/"
],
"data": {
"scripts": [
"postinstall"
]
}
}
],
"toxicFlows": [
{
"id": "flow-1",
"severity": "high",
"confidence": "strong",
"untrustedInput": [],
"sensitiveSource": [
"config_dump"
],
"externalSink": [
"guard_action",
"check_command",
"slack_notify",
"agent_guard",
"sandbox_exec"
],
"selfContained": false,
"path": [
"config_dump",
"agent_guard"
],
"pathWired": true,
"description": "A sensitive-source → external-sink chain exists: config_dump ⇒ agent_guard."
}
],
"capabilities": [
{
"tool": "scan_project",
"tags": [],
"reasons": {}
},
{
"tool": "suggest_fixes",
"tags": [],
"reasons": {}
},
{
"tool": "verify_fixes",
"tags": [],
"reasons": {}
},
{
"tool": "review_hotspots",
"tags": [],
"reasons": {}
},
{
"tool": "scan_url",
"tags": [],
"reasons": {}
},
{
"tool": "check_code",
"tags": [],
"reasons": {}
},
{
"tool": "scan_staged",
"tags": [],
"reasons": {}
},
{
"tool": "scan_dependencies",
"tags": [],
"reasons": {}
},
{
"tool": "scan_secrets",
"tags": [],
"reasons": {}
},
{
"tool": "check_package_health",
"tags": [],
"reasons": {}
},
{
"tool": "compliance_report",
"tags": [],
"reasons": {}
},
{
"tool": "export_sarif",
"tags": [],
"reasons": {}
},
{
"tool": "fix_code",
"tags": [],
"reasons": {}
},
{
"tool": "secure_this",
"tags": [],
"reasons": {}
},
{
"tool": "guard_action",
"tags": [
"code-exec"
],
"reasons": {
"code-exec": [
"parameter \"command\""
]
}
},
{
"tool": "agent_scan",
"tags": [],
"reasons": {}
},
{
"tool": "mcp_audit",
"tags": [],
"reasons": {}
},
{
"tool": "audit_config",
"tags": [],
"reasons": {}
},
{
"tool": "generate_policy",
"tags": [],
"reasons": {}
},
{
"tool": "review_pr",
"tags": [],
"reasons": {}
},
{
"tool": "scan_secrets_history",
"tags": [],
"reasons": {}
},
{
"tool": "analyze_dataflow",
"tags": [],
"reasons": {}
},
{
"tool": "analyze_cross_file_dataflow",
"tags": [],
"reasons": {}
},
{
"tool": "check_command",
"tags": [
"code-exec"
],
"reasons": {
"code-exec": [
"parameter \"command\""
]
}
},
{
"tool": "scan_config_change",
"tags": [],
"reasons": {}
},
{
"tool": "repo_security_posture",
"tags": [],
"reasons": {}
},
{
"tool": "explain_remediation",
"tags": [],
"reasons": {}
},
{
"tool": "scan_file",
"tags": [],
"reasons": {}
},
{
"tool": "scan_changed_files",
"tags": [],
"reasons": {}
},
{
"tool": "security_stats",
"tags": [],
"reasons": {}
},
{
"tool": "guardvibe_doctor",
"tags": [],
"reasons": {}
},
{
"tool": "auth_coverage",
"tags": [],
"reasons": {}
},
{
"tool": "deep_scan",
"tags": [],
"reasons": {}
},
{
"tool": "full_audit",
"tags": [],
"reasons": {}
},
{
"tool": "remediation_plan",
"tags": [],
"reasons": {}
},
{
"tool": "verify_remediation",
"tags": [],
"reasons": {}
},
{
"tool": "secure_prompt",
"tags": [],
"reasons": {}
},
{
"tool": "scan_hallucinated_packages",
"tags": [],
"reasons": {}
},
{
"tool": "redact_pii",
"tags": [],
"reasons": {}
},
{
"tool": "detect_pii",
"tags": [],
"reasons": {}
},
{
"tool": "trace_prompt",
"tags": [],
"reasons": {}
},
{
"tool": "list_rules",
"tags": [],
"reasons": {}
},
{
"tool": "cve_intel",
"tags": [],
"reasons": {}
},
{
"tool": "generate_html_report",
"tags": [],
"reasons": {}
},
{
"tool": "risk_score",
"tags": [],
"reasons": {}
},
{
"tool": "batch_fix",
"tags": [],
"reasons": {}
},
{
"tool": "ignore_rule",
"tags": [],
"reasons": {}
},
{
"tool": "baseline",
"tags": [],
"reasons": {}
},
{
"tool": "rule_info",
"tags": [],
"reasons": {}
},
{
"tool": "severity_matrix",
"tags": [],
"reasons": {}
},
{
"tool": "dependency_tree",
"tags": [],
"reasons": {}
},
{
"tool": "config_dump",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"dump\""
]
}
},
{
"tool": "trend_report",
"tags": [],
"reasons": {}
},
{
"tool": "security_scorecard",
"tags": [],
"reasons": {}
},
{
"tool": "pr_comment",
"tags": [],
"reasons": {}
},
{
"tool": "slack_notify",
"tags": [
"external-sink"
],
"reasons": {
"external-sink": [
"keyword \"webhook\""
]
}
},
{
"tool": "preset_apply",
"tags": [],
"reasons": {}
},
{
"tool": "interactive_dashboard",
"tags": [],
"reasons": {}
},
{
"tool": "privacy_audit",
"tags": [],
"reasons": {}
},
{
"tool": "network_audit",
"tags": [],
"reasons": {}
},
{
"tool": "ai_data_guard",
"tags": [],
"reasons": {}
},
{
"tool": "generate_privacy_policy",
"tags": [],
"reasons": {}
},
{
"tool": "generate_csp",
"tags": [],
"reasons": {}
},
{
"tool": "generate_sbom",
"tags": [],
"reasons": {}
},
{
"tool": "dep_reachability",
"tags": [],
"reasons": {}
},
{
"tool": "scan_container_image",
"tags": [],
"reasons": {}
},
{
"tool": "license_compliance",
"tags": [],
"reasons": {}
},
{
"tool": "ai_firewall",
"tags": [],
"reasons": {}
},
{
"tool": "agent_guard",
"tags": [
"code-exec"
],
"reasons": {
"code-exec": [
"parameter \"command\""
]
}
},
{
"tool": "exfil_check",
"tags": [],
"reasons": {}
},
{
"tool": "dep_firewall",
"tags": [],
"reasons": {}
},
{
"tool": "threat_model",
"tags": [],
"reasons": {}
},
{
"tool": "output_guard",
"tags": [],
"reasons": {}
},
{
"tool": "env_lock",
"tags": [],
"reasons": {}
},
{
"tool": "self_check",
"tags": [],
"reasons": {}
},
{
"tool": "tamper_check",
"tags": [],
"reasons": {}
},
{
"tool": "sandbox_exec",
"tags": [
"code-exec"
],
"reasons": {
"code-exec": [
"keyword \"exec\" in tool name"
]
}
},
{
"tool": "behavior_analysis",
"tags": [],
"reasons": {}
},
{
"tool": "supply_chain_audit",
"tags": [],
"reasons": {}
},
{
"tool": "vault_manage",
"tags": [],
"reasons": {}
},
{
"tool": "audit_log",
"tags": [],
"reasons": {}
},
{
"tool": "pre_deploy",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "b4cf30e833db8eabc082f7ccfab4f4d33929c04e3698cd0e3fb149f1ce6e50b3",
"stats": {
"tools": 82,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 28,
"medium": 7,
"low": 7,
"info": 0
}
}
}