blockbench-mcp-plugin

The server includes a `risky_eval` tool that allows arbitrary JavaScript code execution, despite attempts to filter out console commands and comments. This is a critical security vulnerability, as an exploited or malicious client could execute arbitrary code within the Blockbench Electron application's context, potentially accessing native Node.js APIs (even with Blockbench's permission model) or local resources. The server also manually creates a TCP server to handle HTTP requests, which could introduce subtle network vulnerabilities if not perfectly implemented. While it defaults to localhost, the port and endpoint are configurable, increasing the attack surface if exposed.