[Rule Request] TypeScript rules for mcp-command-injection and mcp-ssrf

[Lonkins]

Gap

All five MCP security rules in ai/ai-best-practices/ exist only for Python. The official MCP
TypeScript SDK (@modelcontextprotocol/sdk) is the primary language for MCP server development,
yet none of these rules fire on TypeScript code.

Proposed additions

Two new TypeScript rules (extending existing Python ones):

• mcp-command-injection-typescript — flags exec()/execSync()/eval() with a non-literal
  argument inside server.tool() or server.registerTool() callbacks (CWE-78, ERROR)
• mcp-ssrf-typescript — flags fetch()/axios.get/post/put/delete()/https.get() with a
  non-literal URL inside MCP tool handler callbacks (CWE-918, ERROR)

Both cover the MCP SDK v1 (server.tool) and v2 (server.registerTool) APIs.

[xlyoung]

Great initiative! I've been working on MCP security scanning and can share some TypeScript-specific patterns that would be valuable for these rules:

For mcp-command-injection-typescript:
Beyond exec()/execSync()/eval(), I'd recommend also flagging:

• child_process.spawn() with shell: true and non-literal args
• node:child_process dynamic imports inside tool callbacks
• Template literal construction passed to any exec family function
• Function() constructor (often overlooked but equivalent to eval)

For mcp-ssrf-typescript:
Key patterns in MCP TypeScript servers:

• fetch() / axios() / http.get() with URLs from tool parameters without allowlist validation
• new URL(userInput) without hostname validation (bypass via @evil.com in userinfo)
• net.Socket.connect() with user-controlled host/port
• DNS rebinding bypass: validate AFTER DNS resolution, not just hostname

Additional rule suggestions from my scanning experience:

• mcp-path-traversal-typescript: fs.readFile(path.join(base, userInput)) without realpath check — found in 82% of MCP servers we analyzed (per OX Security data)
• mcp-credential-leak: Tool descriptions containing hardcoded API keys, tokens, or connection strings
• mcp-prompt-injection: Tool descriptions with embedded instructions (Unicode steganography, markdown injection)

I've been building MCP Doctor which implements these same detection patterns as a CLI scanner. Happy to contribute test cases or regex patterns from our detection engines if that would help.

The MCP ecosystem is growing fast and these semgrep rules would be a huge win for shifting security left.