mcp-toggle

The project uses shell scripts which inherently carry some risk if inputs are untrusted. Specifically, `mcp-auto-update.sh` uses `source` to load an internal update file (`~/.cache/mcp/.mcp-update`). While the script controls the content of this file, the `EXIT_STATUS` variable within that file is not quoted during writing, creating a theoretical, albeit low, risk of command injection if external input could manipulate the exit status of the `update.sh` script in a malicious way. However, the project explicitly follows good security practices by warning against hardcoding secrets, using environment variables for sensitive data, and leveraging `jq` for robust JSON parsing, which mitigates many common shell script vulnerabilities. A security audit is also mentioned in the README.