mcp-recipe-collector

The MCP server makes HTTP requests to a local recipe API (http://127.0.0.1:8080). For the 'searchRecipes' tool, the user-provided 'term' parameter is directly interpolated into the URL query string. If the underlying recipe API does not implement robust input sanitization for this 'query' parameter, it could be vulnerable to injection attacks (e.g., SQL injection, command injection) if a sophisticated attacker compromises the client interacting with this MCP server. The 'id' parameter for 'getRecipeById' is validated as a number using Zod, mitigating direct injection risk for that endpoint. No obvious hardcoded secrets or malicious patterns were found in the provided source code.