registry

The core validation scripts (`src/schema_validation/get_mcp_tools.py` called by `check_remote_urls.py` and `filter_remote_urls.py`) are designed to interact with and list tools from user-provided MCP server configurations. If an `mcp.json` file specifies a `command` and `args` (e.g., using `uvx` or `npx` to download and execute remote Python/Node.js scripts, as seen in `servers/vrtejus-pymol-mcp/mcp.json`), the registry's automated validation pipeline will attempt to execute these arbitrary commands locally. This constitutes a severe remote code execution vulnerability for anyone running the registry's validation system against untrusted or malicious `meta.yaml` and `mcp.json` submissions.