Gitlab (zereight) MCP Server

In the server's implementation (`build/utils/version-check.js:86`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: NFIG ?? join(homedir(), ".npmrc")); paths.push(join(process.cwd(), ".npmrc")); return paths; } function unquoteN

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/utils/version-check.js

In the server's implementation (`build/oauth.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execFile } from "child_process"; import { promisify } from "util"; import open from "open"; import pkceChallenge

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/oauth.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/dynamic-api-url-allowlist.test.js:109`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch(`http://${HOST}:${mcpPort}/downloads/job-artifacts?project_id=1&job_id=1`, { h

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/dynamic-api-url-allowlist.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/sse-auth-guard.test.js:59`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch(`http://${LOOPBACK}:${port}/health`); if (response.ok) return;

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/sse-auth-guard.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/streamable-http-dns-rebinding.test.js:61`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch(`http://${hostWithPort(HOST, port)}/health`); if (response.ok)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/streamable-http-dns-rebinding.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/streamable-http-static-token-auth.test.js:60`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch(`http://${HOST}:${port}/health`); if (response.ok) return;

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/streamable-http-static-token-auth.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/test-all-transport-server.js:220`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch(`http://${HOST}:${port}/mcp`); assert.strictEqual(response.status, 406, 'GET /mcp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/test-all-transport-server.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/test-remote-downloads.js:120`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`http://${HOST}:${serverPort}/downloads/job-artifacts?project_id=${TEST_PROJECT_ID}&job_id

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/test-remote-downloads.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/utils/server-launcher.js:205`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch(`http://${HOST}:${port}/health`, { method: "GET", signal:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/utils/server-launcher.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/utils/version-check.test.js:26`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: gPath = join(configDir, ".npmrc"); const globalconfigPath = join(configDir, "global.npmrc"); writeFileSync(userc

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/utils/version-check.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/config-allowed-groups.test.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from "node:child_process"; import * as path from "node:path"; import * as url from "node:url"; import { des

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/config-allowed-groups.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/sse-auth-guard.test.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { once } from "node:events"; import { afterEach, describe, test } from "n

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/sse-auth-guard.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/stateless/config-ttl.test.js:21`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from "node:child_process"; import * as path from "node:path"; import * as url from "node:url"; import { des

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/stateless/config-ttl.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/streamable-http-dns-rebinding.test.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import http from "node:http"; import { afterEach, describe, test } from "node:te

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/streamable-http-dns-rebinding.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/streamable-http-static-token-auth.test.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { once } from "node:events"; import { afterEach, describe, test } from "n

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/streamable-http-static-token-auth.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/test-ci-catalog.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/test-ci-catalog.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/test-ci-lint.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/test-ci-lint.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/test-ci-variables.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/test-ci-variables.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/test/test-create-repository.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/test/test-create-repository.js