devdash-mcp

The server uses `subprocess` calls for building and launching the QML Gauges Explorer (`cmake`), as well as for screenshot capture (`wmctrl`, `imagemagick`, `scrot`). A critical security consideration is the `DEVDASH_QML_GAUGES_PATH` environment variable. If this path is maliciously configured by an administrator, the `qml_explorer_build` and `qml_explorer_launch` tools could execute arbitrary commands. However, direct user input to tools is generally sanitized (e.g., JSON encoding for WebSocket requests) or derived from trusted system commands (like X11 window IDs), reducing direct injection risks from typical tool arguments. The risk is primarily from a compromised or maliciously configured local environment.