PowerMCP

The server architecture relies on `subprocess` calls to interact with external power system software (e.g., PSSE, LTSpice, PowerWorld). While necessary for its function, this always introduces a potential for command injection if inputs are not thoroughly sanitized, though some input validation is present for file paths. A significant security risk lies with the `PSSE` integration, which explicitly requires and uses Python 2.7, an end-of-life version with known security vulnerabilities. Additionally, `ANDES/andes_mcp.py` contains a hardcoded `STORE_DIR` (e.g., `C:\Users\ibm\Documents\GitHub\PowerMCP\ANDES`), which is insecure and highly platform-dependent, necessitating manual modification by the user and potentially leading to unexpected file access issues if not correctly set.