Rules / CFG070

CFG070 MCP server command is a repo-relative path

Severity: warn OWASP: LLM04:2026 – Supply Chain OWASP Agentic: ASI04:2026 – Agentic Supply Chain Vulnerabilities: LLM04:2026 now covers the model and data supply chain and refers the agentic one, "including MCP servers and tool registries", to ASI04 OWASP MCP: MCP04:2025 – Software Supply Chain Attacks & Dependency Tampering — provisional (MCP Top 10 v0.1) CVE: CVE-2025-54135, CVE-2025-64109, CVE-2025-61260

What cfgaudit checks

Several agents (Cursor, Codex CLI, Claude Code) launch the MCP servers defined in a project-local config when the project is opened — in some agents without a per-server confirmation. If the server's command is a repo-relative path (./install.sh, ../tools/run, scripts/server.py), the executable lives in the repository: anyone who clones it runs committed code automatically (the "CurXecute"-class supply-chain attack, CVE-2025-54135 / -64109 / -61260).

cfgaudit flags an MCP server (in settings.json mcpServers, .mcp.json, and the cross-agent MCP configs like .cursor/mcp.json / .vscode/mcp.json) whose command is a relative path with a directory component.

What is not flagged

• The normal pattern — an interpreter/runner with a script in args (node ./dist/index.js, npx pkg): the command is node/npx, not a path.
• An absolute path (/usr/local/bin/mcp-server, C:\…, \\host\…) or a bare PATH name (my-server).

Because a relative command can also be a legitimate locally-built binary (e.g. ./node_modules/.bin/...), this is a warn: confirm the in-repo executable is reviewed, or reference a vetted binary. (A shell/interpreter command such as sh/bash/node -e is the higher-severity CFG019.)

Trigger example

{
  "mcpServers": {
    "setup": { "command": "./scripts/mcp-bootstrap.sh" }
  }
}

Committed as .cursor/mcp.json / .mcp.json → warn.

Safe alternative

{ "mcpServers": { "fs": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem@1.2.3"] } } }

References

• CVE-2025-54135 (Cursor "CurXecute"), CVE-2025-64109, CVE-2025-61260
• CFG019 (MCP command is an inline-script interpreter), CFG010 (unpinned package) — related MCP command rules
• CFG013 (per-developer .claude files not gitignored) — note: project MCP configs (.mcp.json, .cursor/mcp.json) are meant to be committed, so their mere presence is not flagged
• OWASP Top 10 for MCP — MCP04 (Software Supply Chain Attacks & Dependency Tampering)

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation