rpg-mcp-servers

The server suite is designed for local or controlled environments. Input validation for dice notation is implemented using regular expressions, mitigating arbitrary code execution through dice strings. MCP tool definitions enforce schema validation, reducing risks from malformed input. SQLite is used for local persistence. No hardcoded external secrets are exposed in the provided code. Running two separate Node.js processes locally (game-state-server and combat-engine-server) limits direct external exposure, assuming proper firewall configurations. The use of 'better-sqlite3' with prepared statements typically protects against SQL injection. However, a comprehensive audit would be needed for all database interaction points and the full MCP SDK.