switch-mcp-server

The server operates over stdin/stdout (stdio) primarily, limiting direct network attack vectors. It has zero external runtime dependencies, relying only on Node.js built-ins. Crucially, it implements robust path sanitization (uriToPath, sanitizeUri, abs.startsWith(DOC_ROOT)) to prevent directory traversal attacks when reading resources. JSON parsing includes error handling. There are no signs of 'eval' usage, arbitrary command execution from user input, or hardcoded secrets. The only minor potential risk could be denial-of-service if very large documentation files are repeatedly requested via 'resources/read' or 'search_docs' leading to high memory/CPU usage, but this is inherent to serving large documents and mitigated by the application's single-threaded Node.js nature and typical MCP client behavior.