> ## Documentation Index
> Fetch the complete documentation index at: https://aspex.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Capabilities and attack paths

> What a server can do, with evidence, and what two of them can do together.

## Capabilities

A **capability** is what a server can do, with **evidence**: the tool that grants it, or the config line (an allowed root, a package identity). Aspex classifies tools by whole tokens in their names, descriptions and schemas: `create_pull_request` is a GitHub channel, not HTTP egress; `slack_reply_to_thread` is not a REPL.

| Capability                          | Meaning                                                                                                                                                                                               |
| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `file-read`, `file-write`           | Files by path. **Scope** comes from the allowed roots in your config: `sensitive` (home, `/`, credential directories), `project`, or `unknown` (undeclared, treated as sensitive at lower confidence) |
| `shell-exec`                        | Arbitrary command or code execution                                                                                                                                                                   |
| `network-send`                      | Egress; `egress_open` unless the tool declares a destination allowlist                                                                                                                                |
| `external-send`                     | A fixed external channel (GitHub, Slack, email)                                                                                                                                                       |
| `untrusted-ingress`                 | Brings external content into the agent's context (fetch, browser, web search, issues)                                                                                                                 |
| `credential-read`, `env-read`       | Explicit secret or environment access                                                                                                                                                                 |
| `data-read`, `db-write`             | Database access and writes                                                                                                                                                                            |
| `memory-write`, `persistence-write` | Persists what the agent remembers; writes to startup locations                                                                                                                                        |
| `browser`                           | Drives a browser session (also egress and ingress)                                                                                                                                                    |
| `package-install`                   | Installs code                                                                                                                                                                                         |

In static scans (`--no-exec`) capabilities are inferred for well-known packages (the official filesystem, fetch, GitHub, GitLab, Slack, Brave, memory, Postgres and SQLite servers, browser automation, shell servers) at `confidence: medium`. Roots still come from your config.

## Attack paths

A **path** is a security conclusion about a composition of capabilities, never about a single one. A shell server alone, a fetch server alone, or a home-scoped filesystem server alone produce no path; the per-server rules cover risky configuration.

| ID    | Composition                                                                     | Highest severity |
| ----- | ------------------------------------------------------------------------------- | ---------------- |
| AP001 | Local file read + network egress or external channel                            | critical         |
| AP002 | Credential or environment read + egress                                         | critical         |
| AP003 | External content ingress + writable agent config, hooks, instructions or memory | critical         |
| AP004 | External content ingress + persistent memory write                              | medium           |
| AP005 | Command execution + open egress                                                 | critical         |
| AP006 | External content ingress + command execution, no open egress                    | high             |

**Severity** comes from what the composition reaches. AP001 is critical when the read reaches home or credential directories and the egress is unconstrained; high for project-scoped reads or authenticated channels (GitHub, Slack, email); medium or low when both are limited. AP003 is critical when a reachable file executes at the next session start (`.mcp.json`, `~/.claude.json`, hooks, shell startup files); high for instruction files such as `CLAUDE.md`.

**Confidence** comes from how the capabilities were observed: live tool list high, package inference medium, undeclared scope lower.

Paths compose over name-sorted servers, so they never depend on discovery order.

## Scope matters

For filesystem servers the allowed roots come from the arguments in your client config. `~` or `/` (or any ancestor of home) is *sensitive*: it reaches `~/.ssh`, `~/.aws`, browser profiles. A project directory is *project*: it may still hold `.env` or key files, so a project read plus open egress is HIGH rather than CRITICAL.

<Tip>
  The same two servers can be critical or medium depending on one argument in your config. Narrowing a root is usually the cheapest fix Aspex will suggest.
</Tip>

## Resources and destinations

Sensitive resources are derived, not configured: credential directories and browser profiles when a read reaches home; agent-state files when a write reaches them; the database when a database server exists. Destinations are fixed hosts implied by a package (github.com, slack.com) or "arbitrary https" for open egress.

## In the output

Every path shows the two capabilities, the evidence for both, the path hop by hop, the impact and a fix. `aspex scan --json` adds `attackPaths` and `scoreCapReason`; `aspex scan attack-paths --json` lists every server's capabilities with evidence. [aspex scan →](/tools/scan)