Is Azure MCP Server safe?

The code builds an OS command out of values that can change at runtime, then runs it through a shell.

execSync(`${installCommand} --prefer-online`, installOptions)

Why it matters: If any of those values come from untrusted input, an attacker can run their own commands on the machine.

Fix: Use execFile/spawn with an argument array instead of exec; never build a shell command string from external input.

package.json runs scripts automatically when the package is installed.

"postinstall": "node ./scripts/post-install-script.js"

Why it matters: Install scripts are a favorite supply-chain foothold — they execute on every machine that installs the package.

Fix: Inspect the hook command. Install-time scripts are a common supply chain execution vector; ensure they do nothing beyond a documented build step.

The component can run operating-system commands or spawn processes.

const { execSync } = require('child_process')

execSync(installCommand, installOptions)

execSync(`${installCommand} --prefer-online`, installOptions)

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component reads files from disk.

const pid = Number(fs.readFileSync(lockPath, 'utf8'))

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

fs.writeFileSync(lockPath, String(process.pid), { flag: 'wx' })

fs.rmSync(lockPath, { force: true })

fs.rmSync(lockPath, { force: true })

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.