dep-context-mcp

The server prioritizes a 'local-first' architecture, reading directly from `node_modules` without external network calls for core functionality. Optional features like vector search (with OpenAI) or GitLab source enrichment are clearly documented as requiring external network access and environment variables for sensitive API keys/tokens. The use of `cross-spawn` (via `@modelcontextprotocol/sdk`) is present, but it's for managing dependencies (e.g., potentially triggering `npm install` for internal tasks) which is an expected capability for such a server. No `eval` or obvious malicious patterns are present in the provided source code. User input is not directly passed to shell commands without sanitization in the analyzed code.