vite-mcp

The plugin runs within a Vite development server and sets up a WebSocket connection (HMR) to a browser-side bridge. This bridge executes adapter handlers based on messages received over the WebSocket. While this is the core functionality, and input/output schemas are used for validation, an attacker gaining control of the WebSocket channel could potentially execute arbitrary browser-side JavaScript through forged tool calls. The HTTP endpoints also use `Access-Control-Allow-Origin: *`, which is common for dev servers but means they are accessible from any origin. For its intended use as a local development tool, the risks are generally acceptable, but it's important to be aware of the direct code execution mechanism in the browser environment.