Is CodeScene MCP server safe?

The code builds an OS command out of values that can change at runtime, then runs it through a shell.

execSync(`node scripts/download-binary.js ${binaryTarget}`, {

execSync(`npx @vscode/vsce package --target ${vsTarget}`, {

Why it matters: If any of those values come from untrusted input, an attacker can run their own commands on the machine.

Fix: Use execFile/spawn with an argument array instead of exec; never build a shell command string from external input.

An MCP server entry launches a command on your host.

"command": "npx",

"command": "${__dirname}/bin/darwin/cs-mcp",

Why it matters: Trusting the manifest means running that binary — verify what it is and where it comes from.

Fix: Verify the launched command and its source before trusting this MCP server configuration.

The component references credential locations like ~/.ssh or .aws/credentials.

let config = ssh_home_dir()?.join(".ssh/config");

Why it matters: Touching secret locations is a common first step before stealing them — confirm why it's needed.

Fix: Verify why the component references credential locations; reading these is a common precursor to secret exfiltration.

The component can run operating-system commands or spawn processes.

import { execFileSync } from "node:child_process";

import { spawn } from "node:child_process";

const child = spawn(binaryPath, args, {

import { execFileSync } from 'node:child_process';

import { execSync } from 'node:child_process';

execSync(`node scripts/download-binary.js ${binaryTarget}`, {

execSync(`npx @vscode/vsce package --target ${vsTarget}`, {

import { execFile } from 'child_process';

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component makes outbound network requests.

import https from "node:https";

import http from "node:http";

import https from 'node:https';

import http from 'node:http';

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An MCP tool surface (manifest or tool definitions) was found.

"mcpServers": {

{

{

{

"command": "${__dirname}/bin/darwin/cs-mcp",

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.