mq-mcp

The server's core functionality involves evaluating user-provided `mq` query strings against HTML or Markdown content (`engine.eval(&query, ...)`). While `mq-lang` is a specialized query language (similar to `jq` for JSON) and is likely designed with sandboxing in mind, any `eval`-like mechanism on user-supplied input introduces a potential attack surface. A vulnerability within the `mq-lang` engine could theoretically be exploited through this interface. No other direct security risks like hardcoded secrets or arbitrary shell command injection outside of the `mq-lang` context are evident. The installation script utilizes checksums for binary verification, which is a good security practice.