io.github.webdriverio/mcp

The BrowserStack local-binary resource reads BROWSERSTACK_ACCESS_KEY from the environment and embeds the real key in resource text (setup commands) returned to the LLM/client, exposing the secret in agent context, while the resource description tells the agent it MUST follow these instructions.

const accessKey = process.env.BROWSERSTACK_ACCESS_KEY ?? '<BROWSERSTACK_ACCESS_KEY>';

The Sauce Connect resource reads SAUCE_ACCESS_KEY from the environment and places the actual key into command lines returned in resource content to the model, leaking the secret into agent context (the key is for the wrapped service).

const accessKey = process.env.SAUCE_ACCESS_KEY ?? '<SAUCE_ACCESS_KEY>';

The TestingBot tunnel resource reads TESTINGBOT_KEY/SECRET from the environment and embeds them in setup commands returned to the model, exposing the secrets in agent context (vendor-specific, plausibly honest convenience).

const key = process.env.TESTINGBOT_KEY ?? '<TESTINGBOT_KEY>';

A resource whose description says it MUST be read and followed reads TESTINGBOT_KEY and TESTINGBOT_SECRET from the environment and embeds them in command lines returned to the agent, so the secrets enter the model context and any logs.

java -jar ${JAR_NAME} ${key} ${secret}

The testmu-local-binary resource reads the TestMu access key from the environment and embeds it in plaintext in resource content and shell commands handed to the agent, which exposes the secret to the LLM context and transcript; this is undeclared and goes beyond what the tunnel instructions need.

const accessKey = process.env.TESTMU_ACCESS_KEY ?? '<TESTMU_ACCESS_KEY>';

A resource whose description says it MUST be read and followed reads TESTMU_ACCESS_KEY from the environment and embeds it in daemon start commands returned to the agent, so the secret enters the model context and any logs.

4. Start daemon: ./${info.binaryName} --user ${username} --key ${accessKey}

The wdio-show-trace CLI reads a user-specified or latest trace zip and serves it on a localhost port, then opens the third-party player.vibium.dev viewer with the local URL; the third-party origin is granted CORS access to fetch the trace file contents (which may contain screenshots and session data).

const viewerUrl = `https://player.vibium.dev/?record=${encodeURIComponent(traceUrl)}`;

The BrowserStack upload_app tool streams any agent-supplied path to BrowserStack with no .apk/.ipa validation, so it could upload arbitrary local files off-host; the tool does not declare this.

const stream = createReadStream(path);

The cloud-provider upload_app tool reads any agent-supplied path into memory and uploads it to a third-party cloud with no extension or content check, even though the tool claims to upload only .apk/.ipa files.

const fileBuffer = readFileSync(path);

execute_electron_script runs agent-supplied JavaScript in the Electron main process via new Function. This is openly declared as privileged arbitrary execution, but it is a powerful capability.

new Function('electron', 'args', source)(electron, values)

The launch_chrome tool with copyProfileFiles=true copies the user's real Chrome profile (Local State and Default dir with cookies/logins) into a temp debug dir with remote debugging enabled; this is disclosed in the tool description and opt-in, but gives the agent access to logged-in sessions.

cpSync(join(srcDir, 'Default'), join(USER_DATA_DIR, 'Default'), { recursive: true })