mcp_ofx

The server's core functionality (API lookups and data retrieval) appears safe, relying on static internal data. However, the `ofx_generate_plugin` and `ofx_generate_param` tools directly embed user-provided strings (like `plugin_name`, `plugin_id`, `param_name`, `label`) into C++ source code templates without explicit sanitization. This creates a risk of C++ injection if a malicious client or user provides specially crafted inputs (e.g., strings containing quotes or C++ control characters). While the Python server itself does not execute this generated C++ code, it produces output that could lead to arbitrary code execution if compiled and run by the end-user without proper input validation at the client side.