mock-mcp

The server primarily acts as a conduit between a test process and an external AI client. While the server's code itself appears robust without direct `eval` or obvious vulnerabilities, a critical security consideration lies in the trust placed in the AI-generated data. The server forwards mock data supplied by the AI client without deep validation against the original OpenAPI schema (only structural validation is performed on the mock data arguments, not content). This means if the external AI client is compromised or manipulated (e.g., via prompt injection), it could generate malicious data (e.g., XSS payloads, SQL injection strings) that is then injected into the test environment. While the server doesn't execute this malicious data, it acts as the delivery mechanism.