claude-mcp-bridge

The default configuration in `src/mcp_service.py` involves hardcoding API keys directly into the source file. While the README provides a strong warning against committing these keys to Git and suggests best practices (like using a template and editing locally), the initial setup design makes accidental exposure of API keys a significant risk if users are not careful. The server itself does not use 'eval' or other directly exploitable patterns for arbitrary code execution. Error logging (`log_error` in `mcp_stdio_server.py`) could expose internal stack traces to stderr, which might be a minor information leak in some deployment scenarios, though less critical for a local desktop integration.