code-atlas-mcp

The server uses `child_process.spawn` to invoke an external `code-atlas` CLI tool for analysis. Arguments passed to `spawn` are resolved to absolute paths and handled as an array of strings, which is generally safer against shell injection than direct shell execution (`exec`). Input schemas are validated using `zod`. The server itself uses `StdioServerTransport`, meaning it does not expose network ports directly, reducing the network attack surface. No `eval` or hardcoded sensitive credentials were found. The primary security consideration would be potential vulnerabilities within the external `code-atlas` CLI itself, which is outside the scope of this MCP server's code.