ai-project-docs-mcp

The server performs extensive file system operations (read, write, delete, scan directories) based on paths potentially derived from AI-provided input (e.g., `project_path` for `scan_project`, `file_path` for `manage_documentation`). While path construction uses `path.join` and `ProjectManager` attempts to resolve project roots, there's a moderate risk if these inputs are not robustly sanitized against directory traversal attacks (`../`) or absolute paths that could allow an AI to read, write, or delete files outside intended project or global configuration directories. No `eval` or direct code execution from arbitrary strings is observed, and no hardcoded secrets or network exposure beyond stdio communication.