mcp_server_manager

The application employs standard Electron security practices, including context isolation and controlled IPC communication, and arguments for child process spawning are quoted. No direct code injection vulnerabilities were found. However, its core function involves executing user-defined commands and exposing local network services (via ngrok or HTTPS proxy). Sensitive configurations like ngrok authentication tokens and OIDC secrets are stored in the `config.json` file located in `~/.mcpm`. Compromise of this local configuration file could allow an attacker with file system access to execute arbitrary commands or expose unauthorized services. The HTTPS proxy defaults to listening on `0.0.0.0`, which should be noted.