get_config

2 findings on this tool

1. criticalexcessive agencyf-r7-get_config

   Tool `get_config` exposes a code/command execution surface

   `get_config` looks like it executes code or shell commands ( Get the complete server configuration as JSON. Config includes fields for: - blockedCommands (array of blocked shell commands) - defaultShell (shell to use for commands) - allowedDirectories (paths the server can access) - fileReadLineLimit (max lines for read_file, default 1000) - fileWriteLineLimit (max lines per write_file call, default 50) - telemetryEnabled (boolean for telemetry opt-in/out) - currentClient (information about the currently connected MCP client) - clientHistory (history of all clients that have connected) - version (version of the DesktopCommander) - systemInfo (operating system and environment details) This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.

   fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.

   OWASP LLM08NIST MANAGE-2.2ATLAS T0051CAST-01
2. highfilesystem egressf-r9-get_config

   Tool `get_config` writes to or deletes from the host filesystem

   `get_config` appears to write, create, move, or delete files on the host filesystem ( Get the complete server configuration as JSON. Config includes fields for: - blockedCommands (array of blocked shell commands) - defaultShell (shell to use for commands) - allowedDirectories (paths the server can access) - fileReadLineLimit (max lines for read_file, default 1000) - fileWriteLineLimit (max lines per write_file call, default 50) - telemetryEnabled (boolean for telemetry opt-in/out) - currentClient (information about the currently connected MCP client) - clientHistory (history of all clients that have connected) - version (version of the DesktopCommander) - systemInfo (operating system and environment details) This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). An agent manipulated by an indirect-injection payload can target sensitive paths (SSH keys, shell configs, application secrets) or establish persistence via cron / systemd.

   fix: Restrict the tool to an explicit allow-list of safe directories. Validate all path parameters server-side, reject traversal sequences (`../`), and gate write / delete operations behind a capframe-bind `path starts_with /safe/dir` caveat.

   OWASP LLM08NIST MANAGE-2.2ATLAS T0051CAST-01