caitlyn-openapi-mcp

The project demonstrates strong security practices including clear documentation on responsible disclosure, use of environment variables for configuration, and avoidance of `eval`/`exec` patterns. It uses `pickle.load` for caching embeddings and resolved OpenAPI specs; this introduces a deserialization vulnerability if an attacker can write malicious files to the cache directory, though this risk is generally low for typical deployments. A critical user responsibility is to ensure the `OPENAPI_SPEC_URL` points to a trusted and secure source, as external references are resolved.