sub-agents-mcp

The server employs robust input validation for agent names, prompts, current working directory (CWD), and extra arguments, preventing path traversal and command injection attempts. It uses `child_process.spawn` with `shell: false` for external CLI execution, which is a strong defense against shell injection. Session management file paths are also carefully validated and secured with restrictive file permissions. The primary security consideration for users lies in the trustworthiness and potential vulnerabilities (e.g., command injection via their own prompt arguments or network access) of the underlying AI CLI tools (Cursor, Claude, Gemini, Codex) that this server orchestrates, as these are external to this codebase. No `eval` or obvious hardcoded secrets were found.