notifications-mcp-server

The `notify-claude.sh` helper script, if present and used, is vulnerable to JSON injection via the `MESSAGE` argument, as the message string is not properly escaped when embedded in the `echo` command's JSON output. This could lead to malformed JSON and parsing errors in the Python server. The server heavily relies on `subprocess.run` to execute external macOS commands (`afplay`, `osascript`, `terminal-notifier`) and the helper shell script. While parameters are generally quoted in shell calls and macOS notification systems typically sanitize inputs, passing LLM-generated `title` and `message` arguments to external processes introduces a higher attack surface compared to purely native API calls. The `os.chmod` call to make the `notify-claude.sh` script executable also presents a minor local privilege escalation risk if the script's content is compromised.