netease-mcp-server

The server stores session cookies in a cleartext JSON file (`src/storage/cookies.json`) locally. While this is explicitly stated to be for local privacy, it means the file contains sensitive authentication data. If the local system is compromised or file permissions are lax, these cookies could be exposed. The server uses `pyncm` for API interactions and `subprocess.run` / `os.startfile` for opening local QR code images and URL schemes for playback, which are generally safe operations given controlled inputs. No 'eval' or other direct command injection vectors from user input were found.