shadcnspace-mcp

The server utilizes Zod for input validation, mitigating common injection risks. Network requests are made to a hardcoded external domain (tailwind-admin.com), reducing the risk of arbitrary SSRF. The `getBlockInstall` tool, while its description in the README implies returning implementation details, actually outputs an `npx` installation command, not executing arbitrary code itself. The only potential minor concern is how component names (user-provided) are directly used in URL paths for fetching details (e.g., `https://tailwind-admin.com/r/${name}.json`). While Zod ensures it's a string, if `name` could contain malicious path traversal characters that bypass external LLM sanitization and are not blocked by the `fetch` implementation, it could lead to unexpected resource access on the `tailwind-admin.com` domain. However, this is a low risk given typical component naming conventions.