MCP-Server-Using-Github-Pages

The server architecture relies on static JSON data from GitHub Pages and a Cloudflare Worker for dynamic logic. Input parameters for tools are normalized (e.g., to lowercase) before data lookup, mitigating simple injection risks. Tool names are checked against a predefined list, preventing arbitrary function calls. There are no exposed 'eval' or direct arbitrary code execution vectors. No hardcoded sensitive secrets are apparent in the provided source code. The worker fetches data from a hardcoded public URL (https://ttrpg-mcp.tedt.org/data/), relying on the integrity of that static site, which is part of the same project. This design choice is generally secure as long as the GitHub Pages content remains untampered.