mcp-registry

The registry's internal scripts (build, validate, enrich) use `yaml.load` and `JSON.parse` for configuration parsing. These operations are generally safe within the context of data processing and are not executing arbitrary code from external sources. GitHub API calls for enrichment are handled with rate limiting and token-based authentication (if available). The primary security consideration for a *user* lies in the `command` and `args` defined within the `installations.config` of *registered servers*. These are blueprints for execution by external MCP clients, not executed by the registry itself. The registry enforces strict schema validation (Zod) on all server definitions, preventing malformed entries.