gym-mcp-server

The server uses `importlib.import_module` to dynamically load environment classes specified by the `--entry-point` command-line argument at startup. While this is a common Python extensibility pattern and not directly exposed via an API endpoint, it means that if an attacker could control the server's startup command (e.g., via a misconfigured deployment), they could potentially load arbitrary Python code. API endpoints (`/reset`, `/step`, etc.) are protected by FastAPI's Pydantic validation and internal checks against the Gymnasium action space, mitigating common injection risks. No obvious hardcoded secrets or other direct code execution vulnerabilities from user input via HTTP were found.