robot-mcp-server

The `ROBOT_IP` is hardcoded to '127.0.0.1' in `src/core/services/foxglove.ts`, which is a configuration inflexibility rather than a critical vulnerability, but requires modification for non-local robot control. The `navigateToLocation` function uses `TextEncoder().encode(...).toString()` on user-provided `locationName`. While intended for ROS2 message encoding, this pattern could potentially be an injection point if the robot's ROS2 message parser does not properly sanitize or validate the input, leading to unexpected behavior. No 'eval' or obvious malicious patterns were found. The server connects to a local Foxglove WebSocket, implying an internal or trusted robot network, which reduces external attack surface.