mcp-beads-village

The server's `tool_init` function accepts a `ws` (workspace) argument, which is then passed to `os.path.abspath()` and subsequently used as the `cwd` for `subprocess.run()` calls (e.g., `bd init`). If an untrusted agent can control this `ws` argument, it could potentially direct the server to execute `bd` commands in an arbitrary malicious directory. This poses a supply chain risk if a malicious `bd` binary or other executables were placed there, or an execution context risk if an attacker could control the environment of the `bd` calls. While `normalize_path` is used for file reservations to prevent path traversal within those specific calls, the broader `cwd` context for `bd` commands is vulnerable to manipulation. The server also downloads the optional `bv` binary from GitHub releases via `urllib.request`, relying on the security of the source and network.