Tabby-MCP

The server exposes powerful terminal control and system interaction capabilities (e.g., `exec_command`, `send_input`, `quick_connect`). A critical security feature is the 'Pair Programming Mode' which, by default, prompts the user for confirmation before executing arbitrary commands via `exec_command`. This significantly mitigates the risk of a rogue AI or malicious input. However, the `send_input` and `quick_connect` tools, which can manipulate interactive terminal sessions or initiate SSH connections, do not appear to have a similar confirmation dialog by default. Running locally on `http://localhost:3001` reduces external network exposure, but local processes can still interact with it. No obvious hardcoded secrets or 'eval' calls found directly within the provided code, but the nature of executing arbitrary commands necessitates careful use and confirmation.