mcp-server-chart-bach

The server uses `axios` to make outbound requests to `VIS_REQUEST_SERVER` (defaulting to AntV's service). While the default is trusted, if `VIS_REQUEST_SERVER` is configured via an environment variable to point to an untrusted endpoint, data could be sent to a malicious server. Input validation is performed using Zod, which helps mitigate injection risks for chart arguments. The streamable HTTP transport uses a wide-open CORS policy (`origin: '*'`), common for public APIs, but should be considered if deploying in a sensitive internal network without proper access control.