pentest-mcp

The server uses `child_process.spawn` with an array of arguments for executing external tools (Nmap, John the Ripper, Gobuster, Nikto), which is generally safer than direct shell execution (`exec`). A `sanitizeOptions` function attempts to validate command-line options using a regex to prevent common shell metacharacters, further mitigating shell injection risks. However, running powerful external pentesting tools inherently carries risk; if the server itself were compromised or exposed to untrusted users, these tools could be misused to target arbitrary systems or consume significant resources. The project explicitly states it is 'not for educational purposes' and 'designed for cybersecurity professionals', implying the user is expected to understand and manage these inherent risks.