mcp-react-native-expo

The server includes robust security analysis tools that detect common vulnerabilities like hardcoded secrets, insecure network requests (HTTP instead of HTTPS), sensitive data logging, and potential code injection vectors (e.g., `eval()`, `Function` constructor). It also offers automatic remediation for some of these issues. For its own operation, the `ExpoExecutor` explicitly sanitizes command-line arguments (`DANGEROUS_CHARS` regex) and uses `shell: false` in `spawn` to mitigate command injection risks. The primary security concern comes from the inherent nature of a tool that executes arbitrary CLI commands and analyzes external code, but the codebase demonstrates strong defensive programming practices to handle these risks.