BananaEA-MCP-Server

The core server (`mql4-tools-server.js`) directly executes external processes (e.g., `metaeditor.exe`, Python scripts) and performs extensive file system operations (read/write). This contradicts explicit documentation and configuration claiming the server acts as an 'interface provider only' with 'no process execution'. User-provided `filePath` parameters in various tools (`compile_mql4`, `validate_syntax`, `analyze_code`, `auto_fix_syntax_errors`, etc.) could potentially be exploited for arbitrary file access (read/write) or, in the case of `compile_mql4`, arbitrary code execution via `metaeditor.exe` if not properly sandboxed. This discrepancy between code and documentation makes it unsafe for deployments expecting an interface-only security model.