Custom-Mcp-with-Agno

The primary security risk lies in the explicit instruction to directly embed `GROQ_API_KEY` and `SERPER_API_KEY` into `config/config.py`. If this file is committed to a public repository, these sensitive API keys will be exposed. Users must manually ensure this file is not tracked by Git or use a more secure secrets management method. The `mcp_server.py` makes external HTTP requests using `httpx` to the Serper API, handling standard network communication. No `eval` or obfuscation is found. The client directly executes `python mcp_server.py` as a subprocess to start the tool server, which is safe in this controlled context, but generally highlights command execution capabilities.