Command execution is bounded
A fixed set of named commands rather than an interface that runs whatever string it is handed.
- Applies to
- MCP servers
- Standard references
- CWE-78
A finding here is not a failure
Software of any size carries something. A listing that raises findings on this check is still sold, with the findings published and their severity and reachability stated. A badge that only ever said pass would teach people to stop reading it.
Explainer · 2026-09-30
Command execution in MCP servers: a fixed program versus a shell that runs whatever it is handed
Plenty of good MCP servers start other programs. The question is whether they start a fixed program with arguments, or pass a string to a shell that will run anything written into it.
What this row checks
That command execution is bounded: a fixed set of named commands rather than an interface that runs whatever string it is handed. Starting a process is not a fault. Letting a tool argument decide what the process is, is.
How the unbounded kind happens
The usual cause is building a command as a string, pasting a tool argument into it, and handing the string to a shell. A shell treats characters such as a semicolon, a pipe or a backtick as instructions, so an argument containing them runs commands of its own. Node's documentation warns never to pass unsanitised input to exec or execSync for exactly this reason. The fix is to pass the program and its arguments separately, as execFile does, so no shell ever parses the input.
It is not hypothetical in MCP. The popular mcp-server-kubernetes package built kubectl commands this way until version 2.5.0, which fixed it as CVE-2025-53355; the advisory notes the injection could be triggered through prompt injection in pod logs.
What the hand run found
The automated scan records every place a package starts another program. Read by hand across thirty listings, every one of those notes that pointed at real code ran a fixed program: an editor, a bundled binary, a pinned package. The unbounded case the reading did find was in a fork of mcp-server-kubernetes that still builds shell strings from tool arguments, in the built code under dist/, which the automated scan does not read. Listing pages now show the automated notes as an inventory, and the row as a finding only when a reading found the unbounded kind.
In the glossary: Command injection, Lifecycle script.
What this check has found
263 listings in the catalogue raise a finding here. Every one is still sold, with the finding printed on its page.
- Azure MCP
node child_process (index.js:183)
- Hostinger Api MCP
node child_process (build.js:3)
- Ui5 MCP Server
eval (resources/docs/1.136.11/fe1a6dba940e479fb7c3bc753f92b28c.md:36)
- Comfyui MCP
node child_process (scripts/check-anti-slop.mjs:61)
- Agentic Flow
dynamic Function constructor (wasm/quic/agentic_flow_quic.js:540)
- Claude Flow Cli
node child_process (plugins/ruflo-metaharness/scripts/_darwin.mjs:35)
- MCP Win32 X64
node child_process (index.js:5)
- MCP Linux X64
node child_process (index.js:5)
- Ms 365 MCP Server
node child_process (test-calendar-fix.js:6)
- MCP Hello World
node child_process (README.md:102)
- MCP Darwin Arm64
node child_process (index.js:5)
- MCP Docs Server
node child_process (.docs/reference/workspace/local-sandbox.md:121)
- Slack MCP Server
node child_process (bin/index.js:5)
- Excel MCP Server
node child_process (launcher/launcher.ts:3)
- Neo Mjs
node child_process (test/playwright/unit/hooks/codexLaneStateStopHook.spec.mjs:2)
- MCP Ts Core
node child_process (scripts/build.ts:16)
- Drawio MCP
node child_process (src/index.js:10)
- Kubernetes MCP Server
node child_process (bin/index.js:3)
- Aiwg
node child_process (tools/verify-hermes-citations.mjs:26)
- Goke MCP
node child_process (src/auth.ts:11)
- Devtools
node child_process (docs/terminal-platform.md:13)
- Patchwork Os
node child_process (package.json:117)
- Powerbi Modeling MCP
node child_process (index.js:9)
- Dbx App MCP Server
node child_process (bin/dbx-mcp-server.js:3)
- Monomindcli
eval (README.md:285)
- Ctxlint
node child_process (bin/ctxlint.mjs:102)
- Davinci Resolve MCP
python subprocess (install.py:176)
- Powerbi Modeling MCP Win32 X64
node child_process (index.js:10)
- Screenpipe MCP
node child_process (src/index.ts:109)
- Openai Codex
node child_process (bin/codex.js:4)
- Copilot
node child_process (npm-loader.js:7)
- Earendil Works Pi Coding Agent
node child_process (examples/rpc-extension-ui.ts:17)
- Agent Browser
node child_process (README.md:1477)
- Fallow
node child_process (schema.json:1761)
- Lobster
node child_process (bin/invoke.js:1)
- Googleworkspace CLI
node child_process (install.js:11)
- Vanguard Frontier Agentic
node child_process (tests/export-cursor-kiro-skill-notice.test.mjs:12)
- Whatshell
node child_process (npm/install.js:2)
- Accio AI CLI
node child_process (bin/workctl.js:5)
- Cline
node child_process (bin/cline:14)
- Sandcastle
node child_process (README.md:1067)
- Oh My Pi Pi Coding Agent
synchronous shell execution (src/utils/open.ts:21)
- Pi Mnemopi
synchronous shell execution (src/db.ts:24)
- Darwin
eval (LEARNINGS.md:768)
- Bike4mind CLI
node child_process (package.json:154)
- Letta Code
node child_process (image-resize-worker.js:184)
- Camofox Browser
node child_process (plugins/youtube/youtube.js:7)
- Agently CLI
node child_process (scripts/run.js:2)
- Kilocode CLI
node child_process (postinstall.mjs:3)
- Instar
node child_process (upgrades/0.28.62.md:8)
- Oh My Openagent
node child_process (postinstall.mjs:60)
- Collector
node child_process (src/tracing/instrumentation/process/childProcess.js:9)
- Kimi Code
node child_process (scripts/postinstall/reach.mjs:29)
- Oh My Opencode
node child_process (postinstall.mjs:60)
- Claude Code
node child_process (cli-wrapper.cjs:9)
- Earendil Works Pi AI
node child_process (README.md:1501)
- Anthropic Ai Sandbox Runtime
node child_process (README.md:230)
- Ruvllm
node child_process (scripts/ensemble-model-compare.js:11)
- Repomix
node child_process (lib/shared/processConcurrency.js:34)
- Qwen Code
node child_process (cli-entry.js:309)
- Langwatch
node child_process (package.json:167)
- Tobilu Qmd
node child_process (scripts/build.mjs:2)
- Vectra
node child_process (src/vectra-cli.generate.spec.ts:5)
- Vscode Sandbox Runtime
node child_process (README.md:42)
- Ui Ux Pro Max CLI
python subprocess (assets/skills/ui-styling/scripts/shadcn_add.py:126)
- Task Master AI
node child_process (index.js:26)
- Opencodex
node child_process (src/service-manager-probe.ts:21)
- Easyai CLI
node child_process (src/utils/auto-inject-setup.ts:5)
- Assist
node child_process (pi/advice.ts:1)
- Amplitude AI
node child_process (bin/amplitude-ai-instrument.mjs:13)
- Openzoo
node child_process (lib/aoe.js:23)
- Inference CLI
node child_process (bin/inf.cjs:5)
- Create Stellar Agentic
node child_process (index.mjs:58)
- Create Agentic Playwright
node child_process (template/scripts/install-playwright-cli-browsers.js:12)
- Create Agentic App
node child_process (index.js:10)
- AI Dev Setup
node child_process (src/core/vendors.js:1)
- Figma Console MCP
eval (figma-desktop-bridge/code.js:519)
- Local MCP
node child_process (download.js:13)
- Code Graph
node child_process (claude-plugin/scripts/auto-update.js:3)
- Postgres MCP
node child_process (CHANGELOG.md:822)
- MCP Excalidraw Server
node child_process (src/core/spawn.ts:1)
- Planu CLI
node child_process (CHANGELOG.md:578)
- Cds MCP Server
node child_process (esm/setup.js:8)
- Photoshop MCP
node child_process (scripts/prepare.mjs:8)
- Pi MCP Extension
node child_process (src/index.ts:16)
- Firefox Devtools MCP
node child_process (scripts/build-mcpb.mjs:9)
- Postgres MCP
node child_process (bin/postgres-mcp.js:11)
- Slack MCP
node child_process (src/cli.js:11)
- MCP Google Drive
node child_process (test-mcp-drive.cjs:1)
- Aws MCP
node child_process (README.md:261)
- Postgres MCP Hardened
node child_process (scripts/run-tests.js:22)
- Slack MCP
node child_process (bin/index.js:3)
- MCP Atlassian
node child_process (src/index.js:12)
- MCP Server Browser Automation
eval (README.md:189)
- MCP Server Mysql
node child_process (start-server.js:3)
- Jira MCP
node child_process (index.js:22)
- Kubeview MCP
node child_process (src/utils/CliUtils.ts:1)
- Rust MCP Filesystem
node child_process (binary-install.js:9)
- Opencode Gitlab Dap
node child_process (src/git.ts:1)
- Kubectl MCP Server
node child_process (bin/cli.js:3)
- MCP Merchant
node child_process (scripts/run_tools_sse.js:1)
- Omni MCP Server
node child_process (src/tools/git.ts:1)
- MCP Server Redis
node child_process (start-server.js:3)
- Selenide MCP
node child_process (index.js:3)
- Mnemo
node child_process (tests/cli.test.ts:5)
- MCP Server Docker Npx
node child_process (bin/mcp-server-docker.js:3)
- Scrobblercontext MCP
node child_process (bin/scrobblercontext-mcp:3)
- MCP Server Kubernetes
Read by hand on 2026-09-30: Tool arguments such as the pod name and namespace are written into shell command strings run with execSync. That is the pattern the original package fixed in version 2.5.0 (CVE-2025-53355); this fork still has it. The automated scan missed it because it does not read dist/, which is the only code the package ships.
- MCP Simple Timeserver
python subprocess (dxt/prepare-DXT.py:100)
- Arxiv MCP Server
python subprocess (tests/test_import_boundaries.py:16)
- Mysql MCP Server
python subprocess (src/mysql_mcp_server/server.py:93)
- MCP Salesforce Connector
python subprocess (src/salesforce/server.py:149)
- Arduino CLI MCP
python subprocess (arduino_cli_mcp/main.py:205)
- Kubernetes MCP Server
python subprocess (kubernetes_mcp_server/kubernetes_mcp_server.py:82)
- Run MCP Servers With Aws Lambda
python subprocess (tests/test_clean_tool_schema.py:152)
- Knowledge MCP
python subprocess (knowledge_mcp/shell.py:236)
- Awslabs Postgres MCP Server
python subprocess (tests/e2e/e2e_integration_test.py:240)
- Azure Fhir MCP Server
python subprocess (tests/run_all_tests.py:47)
- Awslabs Dynamodb MCP Server
python subprocess (tests/repo_generation_tool/conftest.py:259)
- Podman MCP Server
python subprocess (podman_mcp_server/podman_mcp_server.py:85)
- MCP Kql Server
python subprocess (tests/test_mcp_server.py:121)
- Aviationstack MCP
node child_process (.github/scripts/uv-lock-pre-commit.cjs:10)
- Iam MCP Server
python subprocess (tests/test_dxt_build.py:45)
- Enhanced MCP Memory
python subprocess (project_conventions.py:111)
- Aceflow MCP Server
python subprocess (aceflow_mcp_server/contract_tools.py:84)
- MCP Platform
python subprocess (scripts/build_docs.py:150)
- Marm MCP Server
python subprocess (tests/test_cli_entrypoint.py:33)
- MCP Personal Assistant
python subprocess (archive/setup.py:15)
- Context MCP
python subprocess (CLAUDE.md:59)
- Huggingface Paper MCP
python subprocess (test_mcp_server.py:16)
- Sensei MCP
python subprocess (src/sensei_mcp/server.py:457)
- Fedramp 20x MCP
python subprocess (PKG-INFO:461)
- Better Confluence MCP
python subprocess (CLAUDE.md:85)
- Github MCP Server
eval (PKG-INFO:947)
- Talos MCP Server
python subprocess (tests/test_server.py:12)
- Code Review MCP
python subprocess (src/code_review_mcp/providers.py:500)
- Chromium Sync MCP
python subprocess (src/chromium_sync/passphrase_setup.py:73)
- Kubectl MCP Server
python subprocess (kubectl_mcp_tool/crd_detector.py:93)
- Chronicle MCP
python subprocess (chronicle_mcp/cli.py:152)
- Gnosis MCP
python subprocess (src/gnosis_mcp/clients.py:575)
- MCP Maker
python subprocess (src/mcp_maker/core/generator.py:137)
- W8s Astro MCP
python subprocess (tests/test_release_notes.py:100)
- Sql Query MCP
python subprocess (tests/test_release_metadata.py:139)
- Yantrikdb MCP
python subprocess (tests/test_cli.py:8)
- MCP Workspace
python subprocess (tools/tach_docs.py:16)
- Berth MCP
python subprocess (tests/conftest.py:32)
- Datris MCP Server
python subprocess (doctor.py:86)
- Unraid MCP
python subprocess (tests/test_load_env_sh.py:38)
- Kontrol Freek MCP
python subprocess (install.py:34)
- Forge Manager MCP
python subprocess (tests/test_adapter_local_store.py:39)
- Memory Map MCP
python subprocess (tests/test_e2e.py:149)
- Custom MCP Database
python subprocess (scripts/bump_version.py:31)
- Wredis MCP
python subprocess (src/wredis_mcp/server.py:517)
- Local Shell MCP
node child_process (vscode-extension/src/extension.ts:1)
- Firebase Tools
node child_process (standalone/firepit.js:71)
- Snyk
node child_process (wrapper_dist/common.js:15)
- Argent
node child_process (bin/argent-simulator-server.cjs:9)
- Codebase Memory MCP
node child_process (bin.js:8)
- Brightdata MCP
eval (browser_tools.js:285)
- Gk
node child_process (lib.js:10)
- Dynoxide
node child_process (bin/dynoxide:6)
- Memorix
node child_process (CHANGELOG.md:1258)
- Doc Bridge
node child_process (src/study/adjudication.ts:1)
- Agent Swarm
node child_process (templates/community/dora-metrics/report.mjs:3)
- AI Appsec
eval (rules/public-core/haiec-ai-security.yml:224)
- Sem
node child_process (scripts/postinstall.mjs:5)
- Wdio MCP
node child_process (lib/server.js:1894)
- Ruv Swarm
dynamic Function constructor (wasm/ruv_swarm_wasm.js:2004)
- Trace MCP
python subprocess (scripts/bench-edit-latency.sh:59)
- Yaver CLI
node child_process (src/agent-runtime.js:4)
- Hermoso
node child_process (bin/hermoso.mjs:438)
- Loki Mode
python subprocess (web-app/server.py:622)
- Crawlforge MCP Server
dynamic Function constructor (src/core/ActionExecutor.js:1269)
- MCP Gsheets
node child_process (scripts/setup-mcp-config.js:8)
- Codesign MCP
node child_process (assets/docs/guide/plugins/print-ready-pdf.md:426)
- Roast My Design System
node child_process (skills/roast-my-design-system/scripts/mcp/server.mjs:19)
- MCP Accessibility Scanner
node child_process (lib/browserContextFactory.js:17)
- Pm Claude Skills
node child_process (web/build-skills.mjs:175)
- Safari MCP
node child_process (index.js:24)
- Genexus MCP
node child_process (scripts/test-one.js:2)
- Premiere Pro MCP
eval (README.md:1504)
- Flow Nexus
node child_process (cli.js:10)
- Arkgate
node child_process (templates/hooks/opencode-ark-write-gate.mjs:16)
- Token Optimizer MCP
node child_process (cli-wrapper.mjs:17)
- Hunch
node child_process (tooling/md1-benchmark.mjs:2)
- Delimit CLI
node child_process (lib/agent.js:8)
- Kin MCP
node child_process (src/index.js:4)
- Superlocalmemory
node child_process (scripts/postinstall-interactive.js:223)
- Sigrank
node child_process (omp-cache.mjs:26)
- Code Index MCP
node child_process (scripts/postinstall.js:19)
- Kya
node child_process (claude/run-stdio.mjs:5)
- Docdex
node child_process (lib/cli_entry.js:6)
- Hana CLI
node child_process (utils/base.js:8)
- Nichedb
node child_process (src/index.js:12)
- Fabric MCP
node child_process (index.js:43)
- Hostinger MCP
node child_process (build.js:3)
- Vibgrate CLI
node child_process (scripts/postinstall.mjs:6)
- Prism MCP Server
python subprocess (scripts/dev/browse.py:569)
- Codehealth MCP
node child_process (lib/download.js:13)
- Codegraph MCP
node child_process (bin/codegraph-daemon.js:14)
- Cmdxray
python subprocess (README.md:284)
- Kepta MCP
node child_process (bin/kepta.js:1434)
- Browser MCP
node child_process (index.js:17)
- Agent Security Scanner MCP
node child_process (index.js:6)
- Nexo Brain
python subprocess (templates/nexo_helper.py:145)
- Code Auditor MCP
dynamic Function constructor (README.md:50)
- Homebutler
node child_process (install.js:4)
- Verify
node child_process (test/conformance.js:15)
- MCP Ssh Manager
node child_process (src/hooks-system.js:8)
- Layers CLI
node child_process (bin/run.js:1)
- Docguard CLI
node child_process (cli/ensure-skills.mjs:16)
- Amicus
node child_process (src/mcp-server.js:5)
- Deepbom
node child_process (skills/deepbom/scripts/verify-deepbom.mjs:3)
- Arc 1
node child_process (package.json:98)
- Geml
node child_process (codemap/build.mjs:41)
- Dsh Novel Writer
node child_process (lib/core.js:14)
- Uisight
node child_process (src/cli.mjs:18)
- Contextstream MCP Server
node child_process (npm/launcher.mjs:2)
- Apiguru MCP
node child_process (bin/apiguru-mcp.mjs:26)
- Controlkeel
node child_process (index.js:35)
- Ucn
node child_process (core/analysis.js:12)
- Cyberchef MCP
node child_process (src/core/config/scripts/newMinorVersion.mjs:15)
- Getmarrow MCP
node child_process (scripts/control-path-canary.cjs:2)
- Crbro Memory
node child_process (bin/crbro.mjs:120)
- Weavatrix
node child_process (bin/run-native.mjs:1)
- Remem
node child_process (scripts/install.js:5)
- Minitok
node child_process (src/workspace/isolation.js:7)
- Tada MCP
node child_process (package.json:42)
- Mneme AI
node child_process (package.json:32)
- MCP Observatory
node child_process (docs/automatic-ci-integration.md:18)
- Prumo
node child_process (src/budget.mjs:7)
- Tailscale MCP
node child_process (README.md:735)
- Deja Vu
node child_process (bin/deja:3)
- Knownfix
node child_process (test.mjs:2)
- MCP Compliance
node child_process (bin/mcp-compliance.mjs:108)
- Provardx CLI
node child_process (lib/services/auth/loginFlow.js:11)
- Usetrail
node child_process (bin.js:2)
- Adeu MCP Server
node child_process (tsup.config.ts:25)
- Simframe
node child_process (src/cli.js:1591)
- Smolanalytics
node child_process (lib/connect.mjs:18)
- MCP Gmail
eval (bin/server.js:9)
- Caddy MCP
node child_process (bin/caddy-mcp.mjs:138)
- MCP Sheets
eval (bin/server.js:9)
- Klypix MCP
node child_process (src/bench.mjs:27)
- Rn Devtools Hub
node child_process (src/cli/stdio.mjs:16)
- MCP Outlook
eval (bin/server.js:10)
- Dryrun
node child_process (bin/dryrun.js:9)
- Better Godot MCP
node child_process (bin/cli.mjs:98)
- Maps MCP
node child_process (src/cli.js:8)
- Fetch MCP
node child_process (CHANGELOG.md:153)
- Gogcli MCP
node child_process (tests/runner.test.ts:3)
- Attio MCP
node child_process (CHANGELOG.md:390)
- Stellaroid Earn
node child_process (scripts/capture-demo-video.ts:21)
- AI School by Lilly Tech Systems
node child_process (smoke-test.mjs:16)
- Conta Azul MCP
node child_process (index.mjs:16)
- PandaDoc MCP Server
node child_process (scripts/package-plugin.mjs:14)
- Vlak
node child_process (scripts/smoke-tarball.mjs:11)
- Runcomfy MCP
python subprocess (tests/test_request_auth.py:201)
- Optionsahoy MCP
dynamic Function constructor (tests/pages-functions-process-free.test.ts:59)
- Kagura Memory Cloud
eval (Makefile:165)
- LightShip
python subprocess (examples/retail-demo/runner.py:291)
- Cosmetic Regulatory
node child_process (import_aafa.js:2)
- lurq
node child_process (tests/agentLink.test.ts:8)
Every listing in the catalogue shows its result on this check, with the findings summarised in public and the full report to whoever bought it. Open the catalogue.