simlab-ug-mcp-server

The application runs a Model Context Protocol (MCP) server that can be exposed via HTTP (default port 7072) or STDIO. This server allows external clients (like AI agents) to perform actions such as searching scripts, getting script schemas, loading scripts, setting parameters, and executing scripts. While argument passing to the underlying 'ugshell' process is done via `ProcessBuilder` (which mitigates direct shell command injection via parameter values), the server itself provides capabilities for arbitrary script execution. If the HTTP server is exposed to an untrusted network without additional authentication or authorization, it presents a significant security risk, as it grants full control over the execution environment. The `create-dmg.sh` script, intended for macOS distribution, includes a 'Fix Security.command' that uses `xattr -cr` to remove macOS quarantine flags, advising users to disable a system security feature.