opensrc-mcp

The server employs robust sandboxing using Node.js's `vm.createContext` to execute agent-provided JavaScript. Key security measures include: `deepFreeze` of injected API objects to prevent modification, explicit disabling/undefined of dangerous global functions (`setTimeout`, `require`, `process`, `fetch`, etc.) to prevent arbitrary system access or network calls, a 30-second execution timeout to prevent infinite loops, and explicit path traversal prevention in file reading functions. External network operations (fetching packages/repos) are handled by the server's controlled `opensrc` dependency. While `vm` sandboxes are not entirely infallible against sophisticated attacks, this implementation is highly secure for its intended purpose of executing untrusted JavaScript code.