frontmatter-mcp

The server exposes powerful file system and database operations. The `query` tool directly passes user-provided SQL to DuckDB, which is susceptible to SQL injection if the input is not sanitized by the calling client or if the MCP client itself is compromised. Batch file modification tools use `glob` patterns, allowing broad access to files within the `FRONTMATTER_BASE_DIR`, although `_resolve_path` prevents operations outside this directory. Semantic search dependencies download large models from the internet; while configured to a default, an attacker might attempt to manipulate the `FRONTMATTER_EMBEDDING_MODEL` environment variable to load a malicious model.