infomate-mcp

The server fetches content from a hardcoded external URL (infomate.club/vas3k) and parses it using basic string manipulation and regex, rather than a full DOM parser. While regex for HTML is often fragile, in this context (parsing a fixed, known external source), it does not appear to introduce direct injection vulnerabilities. Article URLs are validated to start with 'http' or are prepended with the base domain. File system access is limited to reading the project's own README.md. No 'eval' or similar dangerous dynamic code execution patterns were found. No obvious hardcoded secrets are present in the provided code.