security-scanner-mcp

The server executes external commands via `asyncio.create_subprocess_exec`, which is generally safer than shell-based execution as arguments are passed as a list. However, parameters like `target` and `severity` are directly passed to the Nuclei binary without explicit input validation in the Python code. While Nuclei is expected to handle its arguments safely, crafted inputs could potentially lead to unexpected behavior. The `SCAN_RESULTS_DIR` and `NUCLEI_BIN` paths are configurable via environment variables, which is standard but means their security depends on the environment's integrity. No 'eval', obfuscation, or hardcoded secrets were found. The tool is designed to run a powerful scanner, so inherent risks related to network traffic generation and resource usage should be acknowledged.