mcp-server

The server demonstrates robust security practices. It includes extensive input validation using Zod schemas, command allowlisting, and safe command execution (`child_process.spawn` with `shell: false`) to prevent command injection. API endpoints are validated against an allowlist, and API parameters are sanitized. File path operations are highly secured with a multi-layered `validateFilePath` function that prevents path traversal, Unicode bypasses, and enforces an allowlist of allowed directories. Critical credentials are retrieved from environment variables. A strong warning emphasizes that the server is designed for local use only and must never be exposed publicly, shifting responsibility for secure deployment and AI data exposure to the user.