Garak-MCP

The server uses `subprocess.Popen` to execute `garak` commands with user-provided arguments (`model_name`, `probe_name`). While passing arguments as a list of strings (`command: list[str]`) mitigates direct shell injection by avoiding shell interpretation, an attacker with access to the MCP client could still attempt to craft malicious strings to exploit potential vulnerabilities in `garak`'s CLI parsing or to trigger unintended resource consumption. The server runs over `stdio` and is not directly exposed as a network service. API keys are correctly loaded from environment variables. Output from `garak` processes is captured and printed, which could potentially expose sensitive information if probes generate it.