mcpi-server-status

The application uses parameterized queries for SQLite, mitigating SQL injection risks. The HTML template is a static string, reducing server-side XSS vulnerabilities. Input from external MCPI servers (names, versions) is displayed directly without explicit HTML sanitization in the client-side JavaScript, which could theoretically allow client-side XSS if a malicious server provides crafted data, though the impact is generally low for this type of monitoring application. No hardcoded secrets or 'eval' calls found. Network communication uses standard UDP for status checks.