mcp-server-mssql

All 5 findings

1. critical
   Tool `execute_query` exposes a code/command execution surface· execute_queryexcessive agency

   `execute_query` looks like it executes code or shell commands (Execute SQL query and return results). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.

   fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.

2. critical
   Tool `execute_scalar` exposes a code/command execution surface· execute_scalarexcessive agency

   `execute_scalar` looks like it executes code or shell commands (Execute SQL and return single value). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.

   fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.

3. high
   Tool `set_connection_timeout` name implies a side effect that is not declared· set_connection_timeoutexcessive agency

   `set_connection_timeout` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

   fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

4. high
   Tool `set_login_timeout` name implies a side effect that is not declared· set_login_timeoutexcessive agency

   `set_login_timeout` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

   fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

5. high
   Tool `set_autocommit` name implies a side effect that is not declared· set_autocommitexcessive agency

   `set_autocommit` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

   fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).