fastapi-mcp-server

The server's `load_app` function dynamically imports Python modules using `__import__` based on a provided `app_path`. While this is fundamental to its introspection purpose, it means the server's execution environment (`cwd` and `app_path`) must be trusted. If an attacker could control these inputs or the current working directory contains malicious code, arbitrary code execution could occur. However, given its intended use as a local developer tool, run by the user within their own project, this is an acceptable risk for its functionality. No hardcoded secrets, `eval`, `exec`, or direct network listener vulnerabilities were found in the provided code.