FerrumMCP

The server's core functionality includes tools for executing arbitrary JavaScript (e.g., `execute_script`, `evaluate_js`) and navigating to any URL (`navigate`). This design relies on a trusted client environment as explicitly stated in the `SECURITY.md`. The `find_by_text` tool's XPath escaping prevents simple injection, but `SECURITY.md` mentions 'Partial escaping' and 'Full XPath sanitization planned for v1.1', indicating potential edge cases. The server implements session limits and HTTP rate limiting, mitigating some resource exhaustion and DoS risks. The Docker images run as a non-root user. Overall, the server is designed for a trusted, agent-controlled environment; exposing it to untrusted users without additional security layers (e.g., authentication, network segmentation) is a significant risk.