chuk-mcp-server

The example `calculate` tool provided in the project scaffolding (`src/cli.py`) uses `eval()` on user-provided `expression` input. While it attempts to sanitize input by allowing only a limited set of arithmetic characters and digits, `eval()` is inherently dangerous and can potentially be exploited if the allow-list is not exhaustive against injection techniques. The framework's internal use of `exec()` for dynamic tool wrapper generation (`src/chuk_mcp_server/proxy/mcp_tool_wrapper.py`) is noted with `nosec B102`, indicating awareness, but this is for internally generated code rather than direct user input. Network binding defaults to `0.0.0.0` in cloud/containerized environments, which is standard but `Access-Control-Allow-Origin: *` for CORS in HTTP endpoints is broad and could be a concern if not explicitly desired for all clients.