mcp-language-server

The server's core function involves executing an external, user-configured Language Server Protocol (LSP) binary as a child process. This LSP child process is granted extensive file system access (read, write, create, rename, delete) within the specified workspace directory to fulfill its duties. While this is inherent to LSP functionality, it means the server's security heavily relies on the trustworthiness of the *user-selected* LSP executable. If a malicious LSP server is configured, it could potentially compromise the workspace or (less directly) the host system. The server itself does not expose network ports, employ `eval`, or contain hardcoded secrets, and validates LSP command existence with `exec.LookPath` and workspace path validity. The risk is primarily in the user's choice of external LSP.