mcp-badge-creator

The project is a client-side React application that runs entirely in the browser. It does not contain server-side code susceptible to typical server vulnerabilities. User preferences are stored in localStorage. Sensitive data (like API keys) is handled through placeholders (`${input:id}`) in generated configurations, promoting secure input practices rather than hardcoding. It makes client-side API requests to various external services (Shields.io, VS Code Marketplace, MCP Registry, package registries), some of which utilize a CORS proxy (`api.allorigins.win`). While this reliance on external services and proxies introduces minimal external dependency risks, no direct malicious patterns, `eval` usage, or hardcoded secrets are evident in the provided source code.