ast-sast-mcp-server

The server's primary function is Static Analysis Security Testing (SAST). The core logic in `src/analyzer.ts` is designed to *detect* common security risks like `eval()` and hardcoded secrets, not to utilize them. The `src/server.ts` code itself appears well-contained and does not expose direct vulnerabilities or use dangerous patterns. The `client_demo.ts` includes examples of 'unsafe code' to demonstrate the analyzer's capabilities, but these are test inputs, not part of the server's operational code. No hardcoded secrets or 'eval' calls are found in the server's functional implementation. The use of `@modelcontextprotocol/sdk` and `zod` for request validation enhances robustness. The server primarily uses stdio for communication, limiting direct network attack surface for this specific deployment method.