smartapi-mcp

The server relies on fetching OpenAPI specifications from the SmartAPI registry (smart-api.info) and making requests to base URLs defined within these specifications. A compromise of the SmartAPI registry or a registered API could potentially direct the MCP server to interact with malicious endpoints. Authentication credentials (tokens, API keys, etc.) are handled securely via environment variables or command-line arguments, which is good practice. The `publish.py` script uses `subprocess.run` which can execute arbitrary commands, but this is for development/publishing and not directly part of the server's runtime.