highcharts_mcp

The server itself primarily acts as a JSON configuration generator and does not execute user-provided code directly. Communication is via `stdio`, limiting network exposure of the server process. However, the generated Highcharts configuration includes a `data_url` which the client (Claude Desktop) will fetch. A malicious `data_url` could lead to client-side issues (e.g., DoS from large files, or potential vulnerabilities in client-side data processing). Additionally, the `filter_column` value, if provided by a malicious prompt, is embedded directly into a JavaScript string within the output HTML/JS component without explicit sanitization, posing a potential client-side Cross-Site Scripting (XSS) risk if crafted to break out of the string context.