Is Packmind MCP server safe?

The code builds an OS command out of values that can change at runtime, then runs it through a shell.

execSync(`${whichCommand} ${command}`, { stdio: 'pipe' });

const stdout = execSync(`git ${cmd}`, {

execSync(`npm install -g ${NPM_PACKAGE}@${version}`, {

Why it matters: If any of those values come from untrusted input, an attacker can run their own commands on the machine.

Fix: Use execFile/spawn with an argument array instead of exec; never build a shell command string from external input.

The code turns strings into live code at runtime (eval / new Function / exec).

const func = new Function(

Why it matters: If those strings aren't fixed and trusted, they become a way to run arbitrary code.

Fix: Avoid evaluating dynamically constructed code; if unavoidable, ensure the input is a trusted constant and never derived from external data.

An MCP server entry launches a command on your host.

"command": "npx",

"command": "npx",

Why it matters: Trusting the manifest means running that binary — verify what it is and where it comes from.

Fix: Verify the launched command and its source before trusting this MCP server configuration.

The component can run operating-system commands or spawn processes.

const match = CLI_USER_AGENT_REGEX.exec(userAgent);

const embedResult = await Bun.spawn(['bun', 'run', embedWasmScript], {

const compileResult = await Bun.spawn(

import { execSync } from 'child_process';

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component can run operating-system commands or spawn processes.

result = subprocess.run(
                ["git", "-C", cwd, "symbolic-ref", "--short", "HEAD"],
                capture_output=True, text=True, timeout=2
            )

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.

A server is bound to all network interfaces (0.0.0.0), not just your own machine.

host: process.env.NX_WATCHER ? '0.0.0.0' : 'localhost',

Why it matters: Without authentication, other hosts on the network can reach it.

Fix: Bind to 127.0.0.1 for local-only use, or require authentication and restrict access if remote exposure is intended.

The component reads files from disk.

const packageJsonContent = fs.readFileSync(packageJsonPath, 'utf-8');

let content = fs.readFileSync(mainCjsPath, 'utf8');

const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));

const mainContent = fs.readFileSync(mainCjsPath, 'utf8');

return await fs.readFile(filePath, 'utf-8');

content = await fs.readFile(filePath, 'utf-8');

const existingContent = await fs.readFile(fullPath, 'utf-8');

const existingContent = await fs.readFile(fullPath, 'utf-8');

currentContent = await fs.readFile(fullPath, 'utf-8');

const existingContent = await fs.readFile(fullPath, 'utf-8');

currentContent = await fs.readFile(fullPath, 'utf-8');

const actual = await fs.readFile(fullPath);

const actual = await fs.readFile(fullPath, 'utf-8');

localContent = await fs.readFile(fullPath, 'utf-8');

return await fs.readFile(filePath, 'utf-8');

const buffer = await fs.readFile(filePath);

localContent = await fs.readFile(fullPath, 'utf-8');

const content = fs.readFileSync(lockFilePath, 'utf-8');

cas.push(fs.readFileSync(certFile));

const configContent = await fs.readFile(configPath, 'utf-8');

return await fs.readFile(filePath, 'utf-8');

const content = await fs.readFile(lockFilePath, 'utf-8');

const content = fs.readFileSync(this.storagePath, 'utf-8');

const content = fs.readFileSync(credentialsPath, 'utf-8');

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

fs.writeFileSync(mainCjsPath, content);

fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');

fs.writeFileSync(mainCjsPath, '#!/usr/bin/env node\n' + mainContent);

fs.writeFileSync(path.join(moduleDir, 'index.js'), stubContent.trim());

fs.writeFileSync(

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

The component reads files from disk.

content = skill_md.read_text()

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

skill_md_path.write_text(skill_content)

example_script.write_text(EXAMPLE_SCRIPT.format(skill_name=skill_name))

example_reference.write_text(EXAMPLE_REFERENCE.format(skill_title=skill_title))

example_asset.write_text(EXAMPLE_ASSET)

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

package.json has a 'prepare' script (runs on git/local installs and before publishing).

"prepare": "node scripts/prepare.mjs",

Why it matters: Usually a build step, but confirm it doesn't fetch or run remote code.

Fix: Usually a legitimate build step; confirm it only builds and does not fetch or execute remote code.

The component makes outbound network requests.

import axios from 'axios';

const response = await axios.post<typeof conversionData>(

if (axios.isAxiosError(error) && error.response) {

import axios from 'axios';

await axios.post(WEBHOOK_URL, payload, {

nodemailer: STUB_MODULE,

'nodemailer',

'@types/nodemailer',

// ioredis, typeorm, nodemailer, @nestjs/common

'nodemailer',

'@types/nodemailer',

'nodemailer',

'@types/nodemailer',

const response = await fetch(url, {

const response = await fetch(url, {

// @ts-expect-error — Node.js fetch (undici) accepts a dispatcher option not present in the DOM types

const response = await fetch(

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An MCP tool surface (manifest or tool definitions) was found.

"mcpServers": {

{

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.