mcp-vnc

The server correctly uses environment variables for sensitive VNC connection details (host, port, password) instead of hardcoding. Input for mouse clicks, key presses, and text typing is carefully parsed and mapped to VNC protocol events, preventing direct command injection. The project utilizes standard libraries (`@computernewb/nodejs-rfb`, `sharp`) and doesn't contain obvious malicious patterns, 'eval' usage, or unnecessary dangerous system calls. The primary security consideration lies in the inherent risk of granting remote control via VNC to an AI agent, requiring robust security measures on the VNC server side (strong passwords, network isolation) and secure sandboxing for the AI agent itself. The `src/test.ts` file uses `child_process.spawn` for testing, but with hardcoded, safe arguments.