The report
The esp-mcp disclosure identifies a command-construction flaw at the point where a tool call becomes an operating-system process. In code through commit 28afddf, attacker-influenced arguments could reach asyncio.create_subprocess_shell and be interpreted as shell syntax rather than data for a constrained operation. Affected execution path.
The advisory points to parameters including target, port, project_path and project_name. The key precondition is control over a tool input that reaches the vulnerable invocation. The effect runs with the MCP host's permissions; the advisory does not show automatic privilege escalation across machines or a broad campaign of exploited deployments. Scope and consequence.
At the time of the pinned source, affected package versions and a patched release were not specified. It would be inaccurate to tell operators that an unnamed version upgrade definitively removes the flaw. Validation must instead examine the actual call path and reject shell parsing of attacker-controlled strings, for example by using a fixed executable and an argument array for the required operation. Advisory limitation.
The agent-specific lesson is about authority translation. A model can be allowed to select a tool, and that tool can still be unsafe when it converts a structured argument into a command language. Tool registration establishes availability; it does not establish that every input will remain data after crossing into the operating system.