mcp-design-system-extractor

The server connects to external Storybook instances and uses Puppeteer to render dynamic content. Puppeteer is launched with several security-disabling flags (`--no-sandbox`, `--disable-setuid-sandbox`, `--disable-web-security`, `--ignore-certificate-errors`), which significantly reduce the isolation and security of the browsing context. Additionally, the `NODE_TLS_REJECT_UNAUTHORIZED=0` environment variable, used for self-signed certificates, bypasses critical SSL/TLS security checks, making connections vulnerable to man-in-the-middle attacks. While `get_external_css` includes domain validation, these broader configurations expose the system to risks, especially if connecting to untrusted or compromised Storybook instances. The dependency `pac-resolver` (indirectly via `proxy-agent`) uses `degenerator`, which can involve `eval` for PAC file processing, adding a minor attack surface, though typically constrained.