selenium_mcp

The SSE transport is configured with Cross-Origin Resource Sharing (CORS) set to `origin: '*'`, allowing requests from any domain. This presents a significant security risk if the server is exposed to untrusted networks, as it lacks explicit authentication or authorization, making it vulnerable to unauthorized command execution. The `take_screenshot` tool allows specifying an `outputPath`, which could lead to arbitrary file write vulnerabilities if an attacker can control this path and the server has write permissions to sensitive areas. An unusual debug log string ('QUESTO LOG E' IMPORTANTISSIMO...') is present in the server's main file, which is atypical for production code.