neurondb

The Node.js implementation of the NeuronMCP server (NeuronMCP/src/index.ts) includes a `PluginManager` that dynamically loads external code using `await import(config.path)`. This is a critical security vulnerability if plugin configuration paths (`config.path`) can be manipulated by an attacker or point to untrusted scripts, potentially leading to arbitrary code execution. While the Go implementation doesn't appear to have this feature, the Node.js version is present. SQL queries are generally parameterized, mitigating SQL injection risks. Communication over standard I/O (stdio) reduces the direct network attack surface for clients, but PostgreSQL connections still require network security. Database credentials are handled via environment variables, which is a good practice.