poly-cloud-mcp

The server's core functionality involves executing external CLI commands (`aws`, `gcloud`, `az`, `doctl`) using Deno's `--allow-run` permission, which is explicitly noted and justified. Command arguments are constructed carefully from JSON inputs, minimizing direct shell injection risks through the server itself. It leverages standard CLI authentication methods (e.g., local config files, environment variables like AWS_*, DIGITALOCEAN_ACCESS_TOKEN, or login sessions), avoiding hardcoded secrets. The server operates in a local-agent mode using stdio, meaning it doesn't expose a network attack surface for its own communication, though the wrapped CLIs will make network calls. The project includes a SECURITY.md and uses GitHub's security features, indicating a strong security posture.