lighthouse-mcp-server

The server's core functionality involves launching a Chromium browser and navigating to user-provided URLs, which introduces inherent risks of external content. The `src/schemas.ts` file includes URL validation to restrict protocols to HTTP/HTTPS and prevent common malicious URL patterns like `javascript:`. Chrome is launched with hardening flags `--headless`, `--no-sandbox`, and `--disable-dev-shm-usage`. The `--no-sandbox` flag disables Chrome's sandbox, which is a security feature, but is often a necessary concession when running in containerized environments or certain server setups. No explicit 'eval' usage, obfuscation, or hardcoded secrets were identified. The `SECURITY.md` outlines responsible disclosure and recommended security practices for deployment.