mcp-multi-server

The 'eval' function is used in 'tests/conftest.py' within a mock for a 'calculate' tool. This is in test code, not directly in the production client library, and its purpose is for mocking a tool invocation. While 'eval' can be highly dangerous if used with untrusted input in production, its isolated use in testing does not directly expose the 'mcp-multi-server' client library to runtime 'eval' vulnerabilities. A key aspect of this library is its reliance on 'mcp_servers.json' to define commands for starting external MCP server processes. This design implies a trust relationship: the user (or system administrator) is responsible for ensuring that the commands specified in 'mcp_servers.json' are safe and trustworthy, as the MultiServerClient will execute them. Maliciously crafted server configurations could lead to arbitrary code execution outside the scope of the library itself.