What happened
Zuke's MCP registry authorizes remote module descriptors via ZUKE_REGISTRY_LAUNCH_HOSTS, but command-form registry descriptors bypass that check, letting a remote MCP descriptor launch a command on the host.
Why it matters
This is an MCP-registry authorization gap in a build system that connects to AI agents: a crafted registry entry can run a command on the build/agent host, undermining the MCP-control boundary.
Attack vector
The MCP registry mode accepts a command-form registry descriptor without applying ZUKE_REGISTRY_LAUNCH_HOSTS, so a remote descriptor can launch a process on the host even though remote module descriptors are host-restricted.
Affected systems
@zuke/core before 1.51.0 — MCP registry mode.
Mitigation
Upgrade to @zuke/core 1.51.0 or later (commit 4257b0b).