mcp-server

No direct malware behavior is evident in this configuration. It contains high-risk security settings: disabled audience validation, session-based authorization without demonstrated identity binding, broad excessive OAuth scopes, bearer-token passthrough across APIs, potential static fallback credentials, and explicit Authorization-header logging. These should be remediated before deployment by enforcing resource-specific audiences and scopes, binding sessions to authenticated principals, removing unnecessary scopes and fallback credentials, and redacting authorization headers from logs.

The fragment contains no confirmed malware or explicit exfiltration behavior. It does contain significant supply-chain and access-control risks: execution of an unpinned @acme/mcp-shell@latest package through npx and unrestricted --allow '*' permissions. Credentials are also embedded in configuration, although the displayed values appear redacted. Pin the package version and integrity, avoid sh -c where possible, use least-privilege allow rules, and store credentials in a secure secret manager.

The code is highly unsafe for use as an MCP server. Untrusted tool arguments reach shell commands and filesystem paths without escaping or validation, enabling arbitrary command execution, path traversal, unauthorized reads, writes, and deletion. The fragment does not show clear malware such as data exfiltration or persistence, but the vulnerabilities are severe and the concealment instruction in run_report is anomalous. Shell APIs should be replaced with safe filesystem APIs or spawnFile-style argument arrays, and inputs must be strictly validated and authorized.