terragrunt-mcp-server

The server demonstrates strong security practices for file operations with robust path validation, directory whitelisting (defaulting to CWD), and path traversal detection in `FileWriter`. Critical components leverage environment variables for sensitive configuration, avoiding hardcoded secrets. While `child_process` is used, it's for fixed, internal commands (`terragrunt --version`, `terragrunt hcl fmt`) and not susceptible to direct command injection from user input. Network calls to `terragrunt.gruntwork.io` are part of core functionality for documentation retrieval. The main risk factor is potentially exposing internal error details via MCP responses, although the protocol includes an `isError` flag.