touchdesigner-mcp

The server's core functionality includes executing arbitrary Python code (`exec_python_script`) directly within the TouchDesigner environment, which is inherently powerful and could be misused by an unconstrained AI agent. While the `get_module_help` tool's Python `help()` proxy was hardened to prevent code injection, the `exec_python_script` explicitly uses `exec` and `eval` as intended mechanisms. Network configurations default to loopback for HTTP mode in Docker, limiting external exposure by default. The security score reflects the high capabilities granted to an AI agent, which require careful management of the AI's permissions and input, rather than unaddressed vulnerabilities within the server's own implementation of its stated purpose.