mcp-server

The local MCP server client (distributed as an MIT-licensed npm package) is designed for privacy, running locally, and explicitly states it does not save/log specifications, access user files outside output directories, or send telemetry. It communicates via HTTPS with the proprietary MetaEngine API for the actual code generation. The core generation logic within the MetaEngine API is not open source and thus cannot be fully audited for internal security risks (e.g., 'eval' use or specific vulnerabilities). However, the documentation guarantees ephemeral processing and no data retention on their servers. The primary risk lies in trusting the proprietary cloud service for generation, but the local client's described behavior is robustly privacy-focused. No obvious malicious patterns or hardcoded secrets were found in the provided documentation for the client component.