dolphin-mcp

The server demonstrates strong security practices, especially concerning local filesystem access and network communication. It utilizes `zod` for robust input validation on all tools. For file I/O operations (`file_write`, `read_files`), explicit checks are implemented to prevent path traversal attacks by ensuring all resolved paths remain within the `process.cwd()` (workspace root). The `file_write` tool also uses atomic operations (temp file + rename) for data integrity. Network requests (`src/rest/client.ts`) default to `http://127.0.0.1:7777` for the Dolphin API endpoint, explicitly restricting outbound connections to localhost unless configured otherwise, and includes `X-Client: mcp` header. URL parameters for fetching (`open_in_editor`, `restGetChunk`) are correctly encoded. No obvious `eval` usage, obfuscation, or hardcoded secrets were identified.