penpot-mcp

The primary security risk is the 'execute_code' tool, which explicitly allows arbitrary JavaScript code execution within the Penpot plugin's sandboxed environment. While this is the intended functionality for an LLM agent, it introduces a significant risk of malicious code execution or privilege escalation if the LLM's output is compromised (e.g., via prompt injection) or if the server itself is exposed beyond 'localhost'. The REPL server also offers this functionality via a web interface. Currently, connections (HTTP/SSE on port 4401, WebSocket on port 4402, REPL on port 4403) are restricted to 'localhost', mitigating external network attacks. However, a compromised local machine could still exploit this capability.