mcpc

The framework provides strong security mechanisms such as Deno's sandboxing for code execution (in `code_execution` mode, via `@mcpc-tech/handle-sandbox`), explicit permission control for the sandbox (`--allow-net`, `--allow-read`), restricted file searching (`search-tool-result` plugin enforces `allowedDir` and rejects overly-broad patterns), and clear handling of environment variables for secrets. However, the overall security highly depends on how users configure the server (e.g., granting broad `--allow-all` permissions to the sandbox) and the trustworthiness of composed third-party MCP servers. An `eval` usage is present in an example, but it's well-commented as 'Don't actually use eval!'. The use of `node:child_process.execFile` in an example for `git diff` also presents a potential risk, though in an example context.