T08 · Insecure Dependencies
Error
- Location
- scripts/sources/_mcp_client.py:27
- Finding
- Mutable Third-Party MCP Packages Execute with the Agent's Full Environment## Vulnerability Details **File Location**: `scripts/sources/_mcp_client.py:27-39` **Vulnerability Type**: Remote dependency execution with excessive environment exposure **Risk Level**: High ### Vulnerable Code ```python def start(self): import os env = os.environ.copy() if self._env: env.update(self._env) self._proc = subprocess.Popen( self._cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=env, text=True, bufsize=1, ) self._initialize() ``` The affected MCP commands are configured through mutable remote package references: ```python # scripts/sources/linkedin_mcp.py:31-39 def _get_client(auth: dict) -> _MCPClient: global _client if _client is None or _client._proc is None or _client._proc.poll() is not None: env = {} for key in ("LINKEDIN_USER_DATA_DIR", "LINKEDIN_CHROME_PATH"): val = auth.get(key) or auth.get(key.lower()) if val: env[key] = val _client = _MCPClient(["uvx", "linkedin-scraper-mcp@latest"], env=env if env else None) _client.start() return _client ``` ```python # scripts/sources/reddit_mcp_buddy.py:143-152 def _get_client(auth: dict) -> _MCPClient: global _client if _client is None or _client._proc is None or _client._proc.poll() is not None: env = {} for key in ("REDDIT_CLIENT_ID", "REDDIT_CLIENT_SECRET", "REDDIT_USERNAME", "REDDIT_PASSWORD"): val = auth.get(key) or auth.get(key.lower()) if val: env[key] = val _client = _MCPClient(["npx", "-y", "reddit-mcp-buddy"], env=env if env else None) _client.start() return _client ``` ```python # scripts/sources/yahoo_finance_mcp.py:27-38 def _get_client(auth: dict) -> _MCPClient: global _client if _cl ...[truncated 2727 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `os.environ.copy()` with a minimal environment allowlist. Include only essential runtime variables such as a controlled `PATH`, locale settings, and the credentials required by the selected connector. 2. Do not pass unrelated agent credentials to MCP subprocesses. 3. Pin npm and Python packages to reviewed, immutable versions. Replace `@latest` and unversioned `npx` execution with exact versions. 4. Pin Git dependencies to a reviewed commit hash rather than a mutable default branch. 5. Resolve and install dependencies during an explicit installation step rather than silently fetching executable code during a normal query. 6. Verify downloaded artifacts using hashes, lockfiles, or equivalent integrity metadata. 7. Run MCP servers in a restricted subprocess or sandbox with limited filesystem and network access. 8. Apply the same environment filtering to the duplicate MCP implementation in `scripts/sources/reddit_mcp_buddy.py`.