claude-sessions-mcp

The server uses `child_process.execAsync` to open files (`code "${filePath}"`) via the `/api/open-file` endpoint. While intended for local file management, this endpoint allows an arbitrary `filePath` to be passed from the client side without server-side validation or restriction. This means a malicious actor (or a compromised UI) could potentially command the server to open any file on the user's local system (e.g., sensitive configuration files, private keys) in VS Code. Although `code "..."` mitigates some basic shell injection, the ability to specify arbitrary file paths is a significant local privilege escalation risk. No hardcoded secrets were found. File system operations are confined to expected Claude directories for session management, except for this specific 'open file' functionality.