mcp_server_manager

The primary security risk is the execution of user-defined commands for MCP servers, ngrok, and HTTPS proxy configurations. Malicious commands configured by the user could be executed, as the application's core function is to manage and run such processes. No direct 'eval' usage or hardcoded sensitive secrets were detected in the provided code snippets. HTTPS proxy utilizes self-signed certificates, which is suitable for local/development use but not for public-facing production environments. The application stores configuration, including potentially sensitive information like ngrok auth tokens and OIDC secrets, in plain JSON files within the user's home directory (`~/.mcpm`), making file system permissions critical for security.