FBW-MCP-iCal

The server executes dynamically constructed AppleScript via 'osascript'. While user inputs are escaped using `escapeForAppleScript` to prevent injection within string literals (e.g., in event titles or calendar names), the inherent nature of running AppleScript with system automation permissions on macOS requires a high level of trust. The server itself communicates via stdio, reducing network attack surface. The primary risk is a flaw in the AppleScript escaping logic or an unforeseen vulnerability in the macOS Calendar app's AppleScript API that could allow privilege escalation or unintended actions, though the current escaping appears robust for preventing direct command injection into the interpreted string literals.