searchcraft-mcp-server

CRITICAL VULNERABILITY: The `create_vite_app` tool uses `child_process.exec` to clone a Git repository, incorporating the `app_name` parameter directly into the shell command string without proper sanitization or escaping. This allows for command injection, where a malicious `app_name` (e.g., `'; rm -rf / ;'`) could execute arbitrary commands on the host system, leading to severe compromise. Additionally, file path validation for `analyze_json_from_file` and `create_index_from_json` is basic and might not prevent all path traversal attacks, although the `exec` vulnerability is far more critical. The server fetches JSON from URLs and installs external dependencies, which are inherent network risks that need careful monitoring.