geminimcp

The server uses `subprocess.Popen` to invoke the `gemini` CLI, correctly setting `shell=False` to mitigate shell injection risks. Prompt input is passed as a command-line argument to the `gemini` executable. A Windows-specific escape function is provided, but the README strongly recommends running in WSL for Windows users, which further enhances security by providing a POSIX-like environment. No 'eval', hardcoded secrets, or direct network calls (beyond invoking the CLI) are present in the wrapper's code. The overall security largely depends on the trustworthiness and robustness of the underlying `gemini` CLI.