whistle-mcp

The server's primary function is to expose powerful network proxy capabilities (Whistle) to an AI. While the server's code itself does not show obvious direct code injection or hardcoded secrets, granting an AI control over a network proxy via tools like `replayRequest` (allowing arbitrary URL, method, headers, and body) or rule management (creating/updating rules) carries inherent risks. A malicious or unconstrained AI could potentially be instructed to perform network attacks, bypass security, or intercept sensitive data if the underlying Whistle server is not properly secured or is exposed beyond a trusted local environment. The `getInterceptInfo` tool uses user-provided `url` as a regular expression, which is mitigated by a `try-catch` block for invalid regex, falling back to a string `includes` check.