mcp-czkawka

The server interacts with the local file system and executes an external CLI tool (`czkawka_cli`) via `child_process.spawn`. While Zod schemas are used for robust input validation, preventing common command injection vulnerabilities by ensuring arguments are properly typed and not shell-interpreted, the inherent nature of executing external commands carries a higher risk profile than purely in-process operations. The HTTP/SSE transport (if enabled via `http-server.ts`) exposes a network endpoint, which is typical for a server but requires local network security considerations. No direct hardcoded secrets or 'eval' usage found. The `CZKAWKA_CLI_PATH` is correctly handled as an environment variable.