quantum_mcp_server

CRITICAL: The `qiskit_tools.py` file contains a line `print("Using token: ", token, file=sys.stderr)` within the `get_service()` function, which logs the `QISKIT_IBM_TOKEN` to standard error. This is a severe security vulnerability as it exposes a sensitive API key, which could be captured by logging systems or visible in terminal output. This line should be removed or the token should be masked. Additionally, the `run_circuit` tool accepts raw QASM code as a string input, which, while not immediately exploitable for arbitrary code execution (as QASM is a domain-specific language), could potentially be used for denial-of-service attacks if extremely large or malformed circuits are submitted without proper resource limits or validation. However, the primary critical risk is the token leak.