HEBMCP

The server's core functionality relies on session cookies exported from a user's browser, which are then passed as an environment variable (HEB_COOKIE_TSV) to the Node.js process. The README explicitly warns users not to commit `cookies.tsv` or `.env` files, which is critical. If these files are compromised, an attacker could gain full session control over the user's HEB account. The server itself does not contain obvious malicious patterns or dynamic code execution vulnerabilities like 'eval' and restricts its network activity to `heb.com/graphql`. Robust error handling for authentication (401/403) and rate limits (429) is present. The primary security risk lies in the user's secure handling of their session cookies.