mcpc

The project's core functionality involves orchestrating other tools and executing code/commands, which inherently requires flexible permissions. While some examples and CLI usage (`deno run --allow-all`) grant broad access, the `plugin-code-execution` module provides a secure Deno sandbox with granular permission control for user-provided JavaScript code. The framework encourages best practices for handling secrets (e.g., `GITHUB_PERSONAL_ACCESS_TOKEN` via environment variables). A documented `eval` example in plugin documentation includes a warning not to use it in production, which demonstrates awareness but can still be a risk for inexperienced users. Overall, security depends heavily on how users configure and deploy agents, and the trustworthiness of integrated MCP servers.