nl2tcl-mcp

The server includes a TCL validator to block dangerous commands (`exec`, `file delete`, `source`, shell pipes, etc.) when executing Yosys TCL. However, it is susceptible to path traversal vulnerabilities: 1. **Arbitrary File Write:** The `yosys_synthesize` tool's `output_json` argument allows writing to arbitrary file paths if an absolute path or `../` sequence is provided, potentially overwriting system files. 2. **Information Disclosure:** The `list_designs` and `get_design_content` tools' `directory` and `name` arguments can be manipulated with absolute paths or `../` to list or read files outside the intended project directories. No hardcoded secrets or direct network listening are apparent (uses stdio transport).