mcp-server-3gpp

The core server logic in `src/index.js` does not use `eval` or execute arbitrary external commands. `eval` is present in `test_speckit_userstories.js` for dynamically loading constants from `index.js` for testing purposes, which is isolated from the server's runtime. Setup scripts (`scripts/postinstall.js`, `scripts/prepare-data.js`, and associated Python scripts) utilize `child_process.exec`/`spawn` and `urllib.request` to install Git LFS, download PDFs from trusted 3GPP/ETSI sources, and run local data processing, which is standard for setup automation. No hardcoded secrets or apparent malicious patterns are observed.