pd-tools-mcp

The server uses 'child_process.spawn' to execute external ProjectDiscovery tools. While this method is generally safer than 'exec' as it avoids shell interpretation of arguments by default, the wrapper does not perform explicit input sanitization for all user-provided arguments (e.g., 'ports' for naabu, 'scope' for katana). If a highly specific malicious input were crafted that exploits a parsing vulnerability in an underlying ProjectDiscovery tool, it could potentially lead to unexpected behavior. The 'httpx' tool uses a hardcoded path based on the Go home directory, which introduces a dependency on that specific installation location. Overall, the security relies heavily on the integrity and security of the installed ProjectDiscovery tools and the host system's PATH configuration.