phosphor-icons-mcp

The server fetches icons from a trusted GitHub repository and uses `zod` for input validation, which is good. Image processing is handled by `sharp`. The `saveToFile` and `saveDir` parameters in `get-icon` allow writing files to the local filesystem. While `path.resolve` and `path.dirname` are used to mitigate path traversal, and icon names are sanitized, any direct filesystem write from user input carries inherent risk if not perfectly secured. However, given the sanitization and path resolution, the immediate risk is low. No `eval` or blatant code injection vulnerabilities were found.