mcp-captcha-solver

The server uses the `Function` constructor (similar to `eval`) for evaluating math expressions in `solveMathCaptchaLocally`. While this is generally risky, the input `expression` is heavily sanitized to only allow numeric and basic arithmetic characters, significantly mitigating the risk for this specific use case. A hardcoded `developer_tag` is present in `captcha-mcp/tools/services.js` for the `jfbym` service. The server relies on numerous third-party captcha-solving APIs, requiring trust in their security. The `captcha_solver.js` file (Tampermonkey script) is outside the server's execution context and thus not fully audited as part of the MCP server, but it also contains hardcoded URLs and performs network requests.