doffin-documents-mcp

The server, by default, operates in 'mock mode' (documents.mock.enabled:true), meaning it does not physically generate PDF/Word files or interact with the file system for output. Document generation methods primarily calculate metadata and store results in an in-memory map. No 'eval' or other dynamic code execution is present. Input parameters are explicitly typed and validated (e.g., asText(), asInt()). CORS is configured to specific origins. The primary risk would arise if 'mockEnabled' were set to 'false' and the underlying (unseen) document generation library had vulnerabilities, or if the 'outputDir' could be manipulated by a sophisticated attack (mitigated by 'sanitizeFileName'). As presented, it's quite safe.