Why this verdict
- inconclusive: gap manifest_unparseable at mcp.json
- inconclusive: gap no_tools_extracted at package.json
- inconclusive: unresolved question on EXEC
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions and coverage gaps below; 3 candidate findings were refuted on review.
Open questions 1
What the analysis could not settle from the code alone.
How robust is S3ScopeEvaluator.evaluate in blocking dangerous commands passed to aletheia_safe_bash, and can a mandate be loosened without the operatorSecret?
Code execution
Refuted findings 3
Candidates the review stage examined and rejected, kept for transparency.
Credential access
highRefutedlow confidenceThe proxy spawns an arbitrary operator-supplied downstream command and passes it the full parent environment (including any secrets such as ALETHEIA_OPERATOR_SECRET); this is plausibly required for a transparent proxy but is not declared.
env: process.env,
Why it was refuted
The proxy's declared purpose is to wrap and spawn a downstream MCP server; passing the parent environment to that child is standard transparent-proxy behavior with no exfiltration sink, so harm and chain fail.
Code execution
highRefutedlow confidenceThe aletheia_safe_bash tool passes a caller-supplied command string to child_process.exec (shell) after a heuristic evaluator check, so any command the evaluator fails to block runs with host privileges; this is the declared core function, and its safety depends on the unseen evaluator.
const { stdout, stderr } = await execAsync(command, {Why it was refuted
Shell execution is the declared core capability of aletheia_safe_bash, gated by an evaluator that blocks or requires confirmation first, so this is a carve-out rather than hidden behavior.
Code execution
highRefutedlow confidenceThe aletheia_safe_bash tool runs agent-supplied shell commands through a shell via exec after only a lexical deny-list check; this is disclosed in the tool description but remains a broad execution capability that depends on filter completeness.
const { stdout, stderr } = await execAsync(command, {Why it was refuted
Same as the sibling finding: the shell execution is openly disclosed in the tool description as the core function and is preceded by an evaluator block/confirm gate; no undeclared behavior.
Coverage gaps 2
Parts of the artifact the static analysis could not fully examine.
no_tools_extracted MCP server target with no statically extractable tools/prompts/resources
package.json
manifest_unparseable server configuration is not an object
mcp.json
