adeo-mozaic-mcp

The server primarily communicates via `stdio` (standard input/output), which significantly limits its direct network attack surface. Build scripts (`scripts/build-index.ts`) execute external commands (`git clone`, `npm install`) to fetch source repositories and build the local SQLite database. While `execSync` is powerful, its usage is confined to a developer-initiated build process on predefined, trusted URLs (ADEO's GitHub repositories), not exposed to arbitrary user input at runtime. All database interactions (`better-sqlite3`) use parameterized queries, preventing SQL injection vulnerabilities. No hardcoded secrets or 'eval' calls were identified in the provided runtime source code.