mcp-nomad

The server correctly retrieves Nomad authentication tokens from environment variables, preventing hardcoded secrets. It implements origin validation for HTTP transports to mitigate cross-site request forgery (CSRF) risks. Nomad API interactions are handled by constructing URLs and JSON bodies, which generally prevents command injection. HCL job specification parsing is delegated to the Nomad API itself, reducing direct parsing vulnerabilities. No obvious use of 'eval' or other highly dangerous patterns were found in the provided server code. The npm package's `index.js` uses `childProcess.execFileSync` to run the compiled Go binary with arguments from static configuration, not directly user-provided input, thus limiting command injection risks in the wrapper.