react-doctor/mcp-tool-capability-risk

An MCP tool runs with the connecting client's authority, so reaching shell, filesystem, or network primitives without validation lets injected input abuse them.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires only when all three co-occur in one production file: an MCP SDK import or symbol (from '@modelcontextprotocol/sdk…', McpServer, McpAgent), a tool-surface registration (server.tool/resource/prompt(, registerTool/Resource/Prompt(, setRequestHandler(CallToolRequestSchema|ListToolsRequestSchema, or new McpServer/McpAgent(), and a dangerous-capability token (exec/spawn/child_process/eval/new Function/vm.run/readFile/writeFile/fs.read|write/fetch/axios/http.request/sandbox/runCode/executeCode). Comments are stripped first.

Suppress when: the dangerous capability lives elsewhere in the file and is not actually reachable from the tool handler (the gate is file-level co-occurrence, not data flow), or the call already validates/authorizes its input: the tool may be safe even though all three tokens appear.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Validate and constrain every tool input with a strict schema and enforce per-tool authorization, since MCP handlers run with the client's authority. Avoid raw shell, filesystem, and network access in tool bodies; when unavoidable, run fixed binaries with a validated argument array (no shell strings), confine filesystem access to an allowlisted base directory with traversal checks, and restrict outbound fetch/axios to an allowlist to prevent server-side request forgery (SSRF).

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.