simple-ai-coding-agent-mcp-server

The server uses `execSync` and `spawnSync` for operations like `git diff`, `pnpm install`, `pnpm build`, and lint checks (`eslint`, `prettier`, `stylelint`, `tsc`). While these are common development operations, running external commands always carries an inherent risk. The `run_lint_checks` tool executes commands defined in `lint-changed.json` against changed files. If `lint-changed.json` were to contain malicious commands or if `projectPath` could be manipulated to inject commands, it could pose a security risk. However, the `projectPath` is resolved using `path.resolve` which mitigates directory traversal, and the commands themselves are typically well-defined development tools. There are no obvious signs of `eval`, obfuscation, or direct hardcoded secrets for external services.