iwsdk-rag-mcp

The ingestion pipeline uses `child_process.execSync` to clone the Immersive Web SDK repository from a hardcoded trusted URL (facebook/immersive-web-sdk) and to install/build its dependencies. While these commands are executed in a controlled build environment, any compromise of the IWSDK repository or its dependencies could theoretically lead to arbitrary code execution during the ingestion phase. The live server itself does not expose these powerful functionalities to external input. The embedding model is downloaded from Hugging Face on first run, from a specified and generally trusted model source (`jinaai/jina-embeddings-v2-base-code`). No hardcoded secrets or arbitrary `eval` usage were found.