viro
Verified Safeby micartey
Overview
JavaFX overlay doodle application for screen sharings and recordings, featuring an MCP endpoint for LLMs to programmatically draw and manipulate shapes.
Installation
nix run github:micartey/viroSecurity Notes
The MCP endpoint exposes 'ImageTools.drawImage' and 'ImageTools.drawImageFromURL' methods which allow loading images from arbitrary local file paths or URLs provided by an LLM. While 'viro' itself merely attempts to load the image, this could be an attack vector for an LLM to attempt local file access or Server-Side Request Forgery (SSRF) if not properly controlled or sandboxed in the LLM's environment. The server runs on localhost, limiting direct external network attacks.
Similar Servers
solon-ai
The Model Context Protocol (MCP) server provides a standardized interface for AI models to interact with external tools, resources, and prompt templates through a structured, bidirectional communication protocol.
quarkus-mcp-server
This server demonstrates a secure Model Context Protocol (MCP) using Server-Sent Events (SSE) for exposing tools, prompts, and resources, with authentication handled by Keycloak or GitHub OAuth2.
mcp-annotated-java-sdk
Annotation-driven framework for building Model Context Protocol (MCP) servers in Java, simplifying the definition and integration of resources, prompts, and tools for LLM applications.
jolokia-mcp-server
Enables an LLM to manage a Java application by providing a bridge to JMX API via Jolokia.