drafts-mcp

The server uses `child_process.execFile` to interact with the Drafts app via URL schemes (`open` command) and directly with the local SQLite database (`sqlite3` command). While input sanitization (`encodeURIComponentSafe` for URLs and `replace(/'/g, "''")` for SQL queries) is implemented, the use of external execution commands inherently carries a risk if the sanitization were to be bypassed or if the underlying commands themselves had unpatched vulnerabilities. However, given the context of a local-only tool integration for a specific app, this approach is standard and seems reasonably secured for its intended purpose. No hardcoded secrets or arbitrary code execution (`eval`) were found.