Combos

Tool pairs that can make a leak

Each server below is reasonable on its own; the risk comes from giving one agent both. Other tools, such as MSCC, also map cross-server paths (see Benchmarks). These are candidate pairs from the rulebook; the path query on your config decides whether a route exists.

labelling rules in the rulebook

server tool-sets expanded

50/50

gold-set rows matched

servers that declare their own trust level

example pairs · not ranked server-level · coarse on purpose

#	pair	why the pair is lethal
01	github+filesystem	reads public issues and private repos, writes to a shared folder
02	browser+slack	reads any web page, posts to a channel other people can read
03	github+git	private read plus an outbound push, in the same agent session
04	gmail+postgres	reads mail, queries customer rows, and can send outward
05	puppeteer+filesystem	browses untrusted pages and writes whatever it finds to disk
06	slack+github	reads channel messages, reads private code, can post anywhere

↳ the fs-git fixture — the real path, from the committed run chain

stranger's words github issue · github.read
  ↓ agent context · tainted
  ↓ project folder · ~/work/stats · private
  ↓ filesystem.read
  ↓ git.push
  ↓ public sink public repo · github.com/acme/notes

How to read this

legs shows which of the three a pair covers: a stranger's words, your private data, a way out.
A pair is only lethal when all three legs are present and the agent's context joins them.
This table is coarse on purpose. It finds candidates; running scan on your config runs the real path query — the expanded row below is that query's output on the committed fixture.
Colour is never the only signal — each leg is named in the text too.

What this table is not

Not a vulnerability report. A combination is not a bug in either server. Both behave as documented.
Not a full exploit. We describe capabilities only. We never publish payloads.
Not authoritative. Labels are inferred. Method is on Benchmarks.
Disputable. Maintainers can ask us to correct or remove an entry — see Disclosure.