pararam-nexus-mcp

The server uses Pydantic for robust input validation on chat and post IDs, and URL patterns, which is a strong positive for security, mitigating common injection risks. Credentials (`PARARAM_LOGIN`, `PARARAM_PASSWORD`, `PARARAM_2FA_KEY`) are correctly loaded from environment variables. Session cookies are persisted securely. However, the `upload_file_to_chat` and `download_post_attachment` tools accept `file_path` and `output_path` parameters, respectively, which allow an agent to specify arbitrary local file paths. While `file_content` uploads use safe temporary files, direct `file_path` usage in uploads and `output_path` in downloads, without strict path sanitization or restriction to a dedicated agent-controlled directory, could lead to information disclosure or unauthorized file overwrites if the server is run with elevated permissions in a vulnerable environment. The 1MB file size limit on downloads is a good defense against resource exhaustion.