circuit-mcp-server

The `render_circuit` tool uses `subprocess.run` to execute an external CLI tool and, by default (`open_image: true`), automatically opens the rendered image using the system's default viewer. This creates a significant security risk when processing untrusted `.cddx` files, as it can lead to arbitrary code execution if the external `circuit-diagram-cli` or the image viewer has vulnerabilities, or if a crafted filename could inject commands. The `setup.py` also downloads binaries and components from GitHub, relying on the integrity of those sources. The `zipfile.ZipFile.extractall` is used when unpacking `.cddx` files into a temporary directory, mitigating direct Zip Slip vulnerability but still processing untrusted archive contents. No hardcoded secrets or direct `eval` calls are found.