mcp-cli

The CLI tool is written in Go, which generally provides better memory safety and reduced risk of common scripting vulnerabilities. It processes local YAML/JSON files and environment variables. Network calls are made for OAuth token acquisition for remote MCP servers, using standard HTTP client practices. There are no indications of 'eval' or malicious patterns. A warning is explicitly provided in the `mcp ls -c` command documentation that its output (expanded commands with environment variables) 'may expose sensitive data such as API keys'. This is a disclosure risk if the output is mishandled by the user/agent, but not an inherent vulnerability in the CLI's execution logic.