baseline-mcp

The server processes JSON-RPC requests and uses internal, trusted data sources from the `web-features` npm package and local JSON files. It relies on the `@modelcontextprotocol/sdk` for transport and request handling. No direct `eval` of user input, unvalidated external network calls, or hardcoded sensitive secrets are evident in the server's code. Tools designed for file analysis, such as `list_features_in_file` and `get_min_browser_support_for_file`, expect `fileContent` (the content of the file) as input, not `filePath`, meaning the server does not directly access the filesystem based on user-provided paths. The prompts for LLMs (`find-features-in-file`, `min-browser-support-report`) suggest operations involving file paths, but the actual server tools that implement these operations require the file content to be provided by the client, preventing server-side arbitrary file access.