binja-codemode-mcp

The server executes arbitrary Python code provided by the LLM. However, it implements strong security measures: - Code is validated using an AST parser (`CodeValidator`) to block forbidden modules (e.g., `os`, `subprocess`, `socket`, `importlib`, `sys`, `shutil`) and dangerous built-ins/attributes (e.g., `eval`, `exec`, `open`, `__import__`, `__subclasses__`). - Execution occurs in a restricted global environment, exposing only safe built-ins and the `binja` API object. - There is a 30-second execution timeout to prevent resource exhaustion. - The HTTP server binds only to localhost (`127.0.0.1`). - API key authentication is required for all requests. While `exec` is used, the comprehensive sandboxing significantly mitigates risk. The README explicitly warns users to 'only use with trusted MCP clients and LLMs,' which is appropriate for a tool that inherently deals with arbitrary code execution for analysis.