mac-vision-mcp

The server primarily operates locally via stdio, reducing network exposure risks. It relies on well-maintained native Node.js modules (`node-screenshots`, `get-windows`, `mac-screen-capture-permissions`) to interact with macOS system APIs for screen capture and window metadata. Input validation is performed for file paths to prevent directory traversal or invalid file types. Screen Recording permission is explicitly requested from the user, which is a necessary and standard security measure for this functionality. There are no indications of hardcoded secrets or arbitrary code execution (`eval`) within the current implementation. A research document mentions future potential use of `osascript` via `execSync` for browser tab capture, which would require careful sanitization if implemented.