HomeMCPBridge

The core Swift application uses secure practices like storing credentials in Apple's Keychain (`CredentialManager`). Inter-process communication via stdin/stdout for the MCP server is generally secure. However, connections to Scrypted (both directly in Swift for snapshots and in the `scrypted_bridge.py` utility) explicitly disable SSL certificate validation (`ssl.CERT_NONE` or `InsecureURLSessionDelegate`). While this is a common necessity for local-only Scrypted instances that often use self-signed certificates, it introduces a vulnerability to Man-in-the-Middle (MITM) attacks if the local network is compromised. The `scrypted_bridge.py` HTTP server listens only on `127.0.0.1` (localhost), which limits its network exposure. No obvious malicious patterns or hardcoded sensitive secrets were found outside of the expected configuration points.