api-bdd-test-case-generator-mcp-server

The server uses Node's native 'fs/promises' for file operations, which are appropriately used for reading input specifications and writing generated output files. When deployed via Docker Compose, these file system operations are confined to designated read-only (input specs) and read-write (output features) directories, limiting potential for unintended file access. The 'RefResolver' in its current implementation specifically handles local references ('#/') and would throw an error for external file or HTTP references, mitigating a potential arbitrary file loading risk. No 'eval' or direct command execution vulnerabilities are present in the provided source code. No hardcoded credentials were identified.