web-icons-generator-cli-mcp

The server uses file system operations (read/write) for icon generation and HTML modification, which is inherent to its functionality. Input validation for image paths and other arguments is handled. `child_process.spawn` is used internally to start the MCP server itself, not to execute arbitrary user input. The SVG monochrome conversion performs string replacements on specific attributes, which is generally safer than full SVG parsing/mutation. No hardcoded secrets or direct network access by the core logic were found. Risks are primarily associated with processing potentially malicious image files (e.g., malformed images causing crashes in `sharp`).