mcp-vnc

The server uses environment variables for VNC connection details (host, port, password), which is good practice. Coordinate validation is present for mouse actions. However, the `typeCharacter` function logs the exact characters being typed to `console.error` in plain text. If `stderr` is captured and logged, this could lead to the exposure of sensitive information (e.g., passwords, private messages) typed by the AI agent on the remote VNC desktop. The core security risk is inherent in giving an AI agent remote control capabilities, rather than a flaw in the server's implementation, but the logging of typed characters presents a minor information leak risk.