codemode

CRITICAL RISK: This server executes arbitrary Python code provided by an LLM, which can be jailbroken. In 'direct' execution mode (default), code runs with the user's full permissions, allowing complete filesystem and network access. While 'docker' mode is offered for sandboxing, its implementation uses `--network=host`, which negates network isolation by giving the container full access to the host's network stack. This is a significant security flaw for a sandbox and allows executed code to interact with the host network. Additionally, `auto_install` can lead to untrusted package installation, and `detect_and_encode_files` could exfiltrate sensitive local files if the LLM is prompted to output their paths. It is fundamentally unsafe to run with untrusted input.