mcp-gen

The mcp-gen tool itself appears reasonably secure for its intended purpose. It uses `child_process.spawn` to run the generated server, inheriting `stdio` and `process.env`, which could potentially expose sensitive environment variables if the generated server or its dependencies were compromised. It also uses `execSync` for running `npx tsc` during type declaration generation; while `tsc` is a trusted tool, synchronous external command execution generally carries inherent risks. The primary security risk lies with the user-provided TypeScript code that the tool processes, as this code will be executed as part of the generated MCP server. The tool does not appear to contain malicious patterns, obfuscation, or hardcoded secrets.