T08 · Insecure Dependencies
Error
- Location
scripts/sources/_mcp_client.py:27- Finding
Mutable Third-Party MCP Packages Execute with the Agent's Full Environment
- Content
View full analysis
Vulnerability Details
File Location:
scripts/sources/_mcp_client.py:27-39
Vulnerability Type: Remote dependency execution with excessive environment exposure
Risk Level: HighVulnerable Code
python def start(self): import os env = os.environ.copy() if self._env: env.update(self._env) self._proc = subprocess.Popen( self._cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=env, text=True, bufsize=1, ) self._initialize()The affected MCP commands are configured through mutable remote package references:
python # scripts/sources/linkedin_mcp.py:31-39 def _get_client(auth: dict) -> _MCPClient: global _client if _client is None or _client._proc is None or _client._proc.poll() is not None: env = {} for key in ("LINKEDIN_USER_DATA_DIR", "LINKEDIN_CHROME_PATH"): val = auth.get(key) or auth.get(key.lower()) if val: env[key] = val _client = _MCPClient(["uvx", "linkedin-scraper-mcp@latest"], env=env if env else None) _client.start() return _clientpython # scripts/sources/reddit_mcp_buddy.py:143-152 def _get_client(auth: dict) -> _MCPClient: global _client if _client is None or _client._proc is None or _client._proc.poll() is not None: env = {} for key in ("REDDIT_CLIENT_ID", "REDDIT_CLIENT_SECRET", "REDDIT_USERNAME", "REDDIT_PASSWORD"): val = auth.get(key) or auth.get(key.lower()) if val: env[key] = val _client = _MCPClient(["npx", "-y", "reddit-mcp-buddy"], env=env if env else None) _client.start() return _clientpython # scripts/sources/yahoo_finance_mcp.py:27-38 def _get_client(auth: dict) -> _MCPClient: global _client if _cl ...[truncated 2727 chars]- Remediation
View remediation
Remediation Suggestions
- Replace
os.environ.copy()with a minimal environment allowlist. Include only essential runtime variables such as a controlledPATH, locale settings, and the credentials required by the selected connector. - Do not pass unrelated agent credentials to MCP subprocesses.
- Pin npm and Python packages to reviewed, immutable versions. Replace
@latestand unversionednpxexecution with exact versions. - Pin Git dependencies to a reviewed commit hash rather than a mutable default branch.
- Resolve and install dependencies during an explicit installation step rather than silently fetching executable code during a normal query.
- Verify downloaded artifacts using hashes, lockfiles, or equivalent integrity metadata.
- Run MCP servers in a restricted subprocess or sandbox with limited filesystem and network access.
- Apply the same environment filtering to the duplicate MCP implementation in
scripts/sources/reddit_mcp_buddy.py.
- Replace