mcp-design-system-extractor

The server uses Puppeteer (headless Chrome) for dynamic content rendering, which is configured with several security-hardening arguments (e.g., --no-sandbox, --disable-web-security). Network requests for Storybook content are primarily directed to the configured `STORYBOOK_URL`. The `get_external_css` tool includes a critical security check (`isDomainAllowed`) to ensure that external CSS URLs are restricted to the same domain as the Storybook, preventing arbitrary external file fetches. The setup script uses `execSync` but only for local build and environment detection purposes, not runtime operations. Overall, a good effort has been made to mitigate common risks for a tool interacting with external web content, but inherent risks of running external processes and interacting with untrusted web content (if the Storybook itself is compromised) remain.