rossum-mcp

The agent utilizes Python's `exec()` function within the `evaluate_python_hook` tool to execute user-defined code for hook debugging. While efforts are made to sandbox this execution (e.g., stripping imports, whitelisting built-ins), `exec()` inherently carries a significant risk for arbitrary code execution if the sandboxing mechanisms are bypassed. This makes the system more vulnerable if exposed to untrusted inputs. However, other security practices like using environment variables for sensitive credentials (API tokens, AWS keys), and implementing URL and file path sanitization for SSRF and path traversal prevention in the API, are well-observed.