prompts-mcp

The server uses Handlebars templating with `noEscape: true` for prompt content, which is intentional to preserve code formatting in prompts. While this means the server itself does not attempt to sanitize the *output* to the LLM, the content is intended for an AI, not direct rendering in a browser, mitigating typical XSS risks. All file paths are handled using `path.resolve` and `existsSync` which helps prevent directory traversal vulnerabilities. Configuration parsing includes validation for ports and log levels. No obvious hardcoded secrets or direct arbitrary code execution via user input were found. The directory discovery mechanism allows overrides via environment variables, which is a flexible but secure pattern.