edgedelta-mcp-server

The MCP server component itself appears robust, primarily acting as an API wrapper for Edge Delta. It securely handles API tokens and organization IDs via environment variables, headers, or context. It uses the `mcp-go` library for JSON-RPC, which implies structured input, reducing injection risks. The HTTP client uses TLS 1.2+. There are no obvious hardcoded secrets or arbitrary code execution vulnerabilities in the server's core logic. NOTE: The `mcpcurl` client, distributed within the same repository, is designed to execute arbitrary shell commands (specified by `--stdio-server-cmd`) to start the MCP server. While this is an intentional feature for its specific use case (interacting with locally or externally run MCP servers), it represents a significant security risk if `mcpcurl` is used in an untrusted environment or with an untrusted `stdio-server-cmd` argument. The server itself does not inherit this specific vulnerability.