mcp-scaffold

The server's core function is build-time code generation using JavaParser and JavaPoet, which is generally safe as it doesn't involve runtime dynamic code execution. The generated tools are standard Spring components acting as wrappers for existing business logic. No direct 'eval' or malicious patterns were found. The example uses default H2 in-memory database credentials (sa, empty password) which is acceptable for development/examples but should not be used in production. Network exposure is typically localhost by default, managed by Spring AI's MCP server. The main security consideration would be prompt injection at the AI model layer, which is an inherent risk of AI tool usage, not a specific vulnerability in this server's code.