PyBun

The MCP server (`pybun mcp serve`) exposes JSON-RPC methods (`call_run`, `call_gc`, `call_doctor`) that execute `pybun` commands as subprocesses. While Rust's `std::process::Command::args` API generally prevents shell injection, allowing an external entity (e.g., an AI agent) to call `call_run` with arbitrary Python script paths or inline code without robust input validation or mandatory sandboxing is a severe privilege escalation risk. The `--sandbox` feature in `pybun run` provides a lightweight Python-level sandbox (blocking subprocesses, optional network access), but it is an opt-in argument, not enforced by the MCP server's `call_run` method. If the MCP server is exposed to untrusted inputs, it effectively grants arbitrary code execution on the host machine.