emotionsin_ai_mcp

The server's core function involves fetching data from an external Emotionsin.ai backend URL (defaulted but configurable via EMOTIONSIN_BACKEND). The 'profile' parameter in the `get_agent_contract_from_link` tool is used to construct this URL. While `httpx` generally handles URL encoding, any vulnerabilities in the external backend's handling of the `id` parameter could be indirectly exposed (e.g., if it's susceptible to SQL injection or path traversal via the ID). The server itself doesn't use `eval` or similar dangerous functions on user input and follows good practices for environment variable configuration, making it relatively secure from direct exploitation. The persona contract received from the backend is then used as a system prompt for an LLM; potential prompt injection risks lie with the content provided by the Emotionsin.ai service, rather than the MCP server's code itself.