STAMP

The server uses `subprocess.run()` to execute `stamp` CLI commands, with the `mode` and `config` parameters directly derived from user input (LLM agent calls). This creates a critical command injection vulnerability where a malicious actor or agent could craft inputs to execute arbitrary system commands, potentially leading to data exfiltration, system compromise, or denial of service. While `_resolve_path` attempts to restrict file system access for `read_file` and `list_files`, it does not mitigate the risk from `subprocess.run` in `_run_stamp` which can bypass file system restrictions entirely. The `stamp` CLI itself may have further vulnerabilities not audited here.