GATE005: Arbitrary command execution capability

A tool or configuration lets the agent run arbitrary commands, code or SQL.

Name
Severity
Type
Critical
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Capabilities
Type
execute
Description
Capability classes this rule reasons about.
Name
Explain locally
Type
gate explain GATE005
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate classified a tool or standing grant as carrying the execute capability: a shell tool, a code interpreter, a container exec, or a database tool that runs unrestricted SQL. Classification comes from the known-server mapping when Gate recognises the server, and from the tool name otherwise, never from the tool description alone, because a description is written by whoever wrote the tool.

Why this matters

Execution is the capability that makes every other control advisory. An agent that can run sh -c can read any file the process can read, write anywhere the process can write, delete anything, and open a network connection to anywhere: regardless of which other tools you did or did not give it. Unrestricted SQL is the same problem wearing a different hat: execute_query can read every table, write every table, drop every table, and on many engines read the filesystem or open a socket.

This is worse for agents than for scripts, because an agent decides what to run based on text it read somewhere. Prompt injection turns a shell tool into a remote shell for whoever wrote the text.

Example

This is the shape of configuration that triggers the rule.

{
  "mcpServers": {
    "postgres": {
      "command": "mcp-postgres",
      "env": { "DATABASE_URL": "${env:PROD_DATABASE_URL}" }
    }
  }
}

// postgres.execute_query -> execute, read, write, delete

Remediation

Remove the capability if the agent does not need it. If it does: constrain it. Replace an arbitrary SQL tool with named, parameterised operations. Replace a shell tool with the two or three specific commands you actually wanted. Where arbitrary execution is genuinely required, run it in a sandbox with no credentials and no network, and require human approval.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE005',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.