decomp-me-mcp

The server primarily interacts with the decomp.me API and manages local state files. No direct 'eval' or malicious code execution patterns are evident. File I/O for claims, scratch tokens, completed functions, and cookies uses a temporary directory by default, which is configurable via environment variables. File locking is used for concurrency with local state files. The `decomp_search_context` tool uses regular expressions (`re.compile`) where the `pattern` parameter comes from user input, which could theoretically be susceptible to ReDoS if an extremely complex and untrusted pattern is provided, but this is mediated by the AI assistant. `DECOMP_API_BASE` is configurable via an environment variable, which, if misconfigured to a malicious endpoint, could lead to unintended data exchange.