AGENTFORCE-MCP-20: MCP Tool Argument Reaches a Network, File or Code-Execution Sink
🔴 High · Injection
Detects MCP tools (Python FastMCP / mcp SDK, TypeScript SDK) whose arguments reach eval / exec / new Function (critical), an HTTP request whose URL starts with the argument (SSRF), or a file open / write / delete path (path traversal, arbitrary file write) with no allowlist, private-address check or base-directory check.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-MCP-20 |
| Severity | High |
| Category | Injection |
| Compliance | EU_AI_ACT_HIGH_RISK, SOC2_CC7 |
Remediation
Never evaluate tool input as code (parse it with a safe evaluator such as ast.literal_eval or a math parser). For URLs, accept only https URLs whose host is on an allowlist and resolve the host to reject private / link-local addresses. For paths, resolve them against a fixed base directory and reject anything outside it (Path.resolve().is_relative_to(base) / path.resolve + startsWith), or accept only a file name (basename).