ketchup-draw-mcp-server

The server's code appears generally safe. It doesn't use `eval` or exhibit obfuscation. Network requests are made to `ketchup-ai.com` and `api.urusai.cc` which are external services; their security is assumed. Proxy support via `undici` is implemented correctly using environment variables, preventing hardcoded proxy details. No hardcoded secrets were found. An unused `node-catbox` dependency is present in `package.json`, but the image upload logic in `src/index.ts` uses direct `fetch` calls, which is a minor inefficiency but not a security flaw.