mcpm

CRITICAL: The `mcpm` tool allows arbitrary code execution from remote repositories during the installation and build process. Specifically, the `internal/builder/shell.go` `runShellCmd` function executes user-defined or inferred build commands (e.g., `npm install`, `python -m venv`, `go build`) using system shells (zsh, bash, sh) with `-l -c` or `-c` flags. If a malicious MCP server repository is installed via `mcpm install`, its `mcp.json` file can specify a `buildCmd` or a `.js`/`.py`/`.go` project can be crafted to execute arbitrary shell commands, leading to complete compromise of the user's system. Additionally, the `add` command constructs `claude mcp add` commands using user-provided inputs, which could be a vector for command injection if the `claude` CLI does not properly sanitize its arguments.