epanet-mcp-server

The `run_epanet_simulation` tool in `main_epanet.py` directly concatenates user-provided `file_name` with 'models/'. This creates a path traversal vulnerability (e.g., using `../../etc/passwd` as `file_name`) which could allow reading arbitrary files outside the intended 'models' directory if not properly sanitized and handled by the underlying `epanet` library. Additionally, `get_inp_files` hardcodes a Windows-specific developer path ('C:/Users/xrism/Documents/GitHub/MCP-Server-Exmample/models'), which is a configuration risk for deployment.