epanet-mcp-server

The server has a critical path traversal vulnerability in the `run_epanet_simulation` tool. A manipulated `file_name` argument (e.g., `../secrets.txt`) could allow the server to access and potentially process arbitrary files outside the intended `models` directory. Additionally, the `get_inp_files` tool uses a hardcoded absolute path (`C:/Users/.../models`) which is a security risk (exposing internal system structure) and severely impacts portability. No hardcoded secrets were found in the API keys or critical credentials, but the file system access issues are significant.