medical-mcp

The server runs 100% locally and requires no API keys, significantly reducing external attack surface and credential leakage risks. It actively logs safety warnings regarding medical advice. However, the use of Puppeteer for web scraping (Google Scholar, Cochrane, AAP) introduces a slight risk, as it launches a Chromium browser with `--no-sandbox` and other flags. While common for scraping, a vulnerability in Chromium or a malicious target website could theoretically pose a local execution risk. The code attempts to mitigate this by disabling JavaScript and images in some scraping contexts and running locally, but it's a non-zero risk inherent to browser automation for untrusted content.