screenshot_mcp

The server uses `execFile` and `spawn` to run a Swift CLI for its core functionality. While numeric arguments are sanitized, the `output_path` argument can be fully controlled by the caller. This means a user could specify an absolute path (e.g., `/Users/user/some_file.png` or `/etc/passwd`) as the output destination. If the server process has write permissions to that location, it could overwrite arbitrary files, leading to data loss or denial of service. The server does not expose a network interface directly, communicating over stdin/stdout via MCP, which reduces external attack surface. It relies on macOS's built-in Screen Recording permissions.