br-automation-mcp

The server uses `subprocess.run` and `subprocess.Popen` to invoke external B&R Automation Studio tools. While arguments are passed explicitly, reliance on external executables and user-provided paths (e.g., project_file, ruc_package) always introduces a potential for command injection if inputs are not sanitized or validated carefully. The server hardcodes default OPC UA credentials ('Admin'/'password'); while the README instructs users to change them, their presence as defaults is a security risk if not updated to match project-specific secure settings. No 'eval' or obvious malicious patterns were detected.