doctor-claude

The server primarily interacts with trusted external medical information sources (medlineplus.gov, ncbi.nlm.nih.gov) via HTTP requests, with explicit domain validation to prevent arbitrary URL fetching. Local file system interaction is limited to managing a user-specific patient profile. There are no clear instances of 'eval', hardcoded secrets, or direct arbitrary command execution based on user input. The `@modelcontextprotocol/sdk` uses `cross-spawn` internally, but this server does not leverage it directly. The main security considerations would involve potential vulnerabilities in web scraping (cheerio library) or the external sites themselves, though these are well-established government/medical domains.