mcp-server-mysql
pypi:mcp-server-mysql@0.1.4
Severity breakdown
Worst finding
Tool `Query Execution` exposes a code/command execution surface
· Query Execution
`Query Execution` looks like it executes code or shell commands (`execute_query`: Execute an arbitrary SQL query. - Takes a SQL string (`query`) - Returns query results for SELECT/SHOW/DESCRIBE, or a success message for other commands). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.
fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.
All 1 finding
- criticalTool `Query Execution` exposes a code/command execution surface· Query Executionexcessive agency
`Query Execution` looks like it executes code or shell commands (`execute_query`: Execute an arbitrary SQL query. - Takes a SQL string (`query`) - Returns query results for SELECT/SHOW/DESCRIBE, or a success message for other commands). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.
fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.
How this was scored
Source registry — tool surface extracted from the package's README + manifest (R3/R5/R6/R7 fire; schema-dependent rules deferred). Findings are emitted by the public capframe.findings.v1 schema. Score = 100 − (10·Critical + 4·High + 2·Medium + 1·Low), clamped to [0, 100].
Disagree with a finding? Open an issue.