mcp-server-dump

The tool's core functionality involves executing user-provided commands (e.g., `node server.js`) to interact with MCP servers. While this is an intended feature, it introduces a significant security risk if the input `server-command` is untrusted or malicious. The code explicitly acknowledges this with `#nosec G204`. Other sensitive operations, such as file I/O for context files and Hugo output, include explicit path traversal protection and file size limits (`maxContextFileSize`). OAuth tokens are cached with restricted file permissions (`0o600`). Network interactions include timeouts and structured header parsing. No obvious hardcoded secrets or malicious patterns were found in the provided source code, making the tool itself reasonably secure, provided users supply trusted commands.