wb-mcp-server

The server utilizes Playwright for web scraping, which launches a headless Chromium browser. While `page.evaluate` allows arbitrary JavaScript execution within the browser context, the code appears to control the injected scripts and only makes API requests to Wildberries domains. Input sanitization is applied via `encodeURIComponent` for user-provided query and address parameters when constructing URLs. The use of `--no-sandbox` for Playwright in the Docker setup is common for containerized environments but is inherently less secure than a sandboxed browser on a host. CORS is broadly enabled for all origins, which is acceptable for a public API but could be a minor consideration depending on deployment context. No obvious hardcoded sensitive secrets or direct `eval` usage were found beyond controlled `page.evaluate` calls.