wotblitz-mcp

The server reads data from local game files (WOTB_GAME_PATH), which are assumed to be trusted. Input validation for tool calls is enforced using Zod. No direct 'eval' or obvious malicious patterns were found. The primary security consideration would be a misconfigured WOTB_GAME_PATH pointing to sensitive directories or potential vulnerabilities in third-party parsing libraries (e.g., sharp, XML/YAML parsers) when dealing with malformed game files, though these are generally robust.