mcp-apifox-server

The server handles sensitive Apifox Access Tokens and Project IDs, which are securely read from environment variables or CLI arguments and are not hardcoded. The `apifox_run_cli_test` tool executes an external `apifox-cli` command. While command arguments are constructed internally, the `cliExecutable` path is configurable; if a user configures this to point to a malicious binary, it poses a significant risk. However, `child_process.spawn` is used, which is generally safer for external command execution as it does not inherently parse shell commands. Code scanning (`controllerScanner.ts`) involves reading and parsing local project files, which is an expected and core functionality handled via TypeScript's AST parser. No direct `eval` or code obfuscation was identified.