glkvm-mcp

The KVM-side HID server, which facilitates direct control of the physical device, is designed to run with root privileges to access HID gadget devices (`/dev/hidg0`, `/dev/hidg1`). A compromise of this server would grant full root access to the controlled machine, representing a critical risk. While mutual TLS (mTLS) is implemented for secure communication and authentication, the setup involves manual certificate management across multiple machines, which is prone to human error. External dependencies like `ffmpeg` and `tesseract` introduce additional attack surfaces if those binaries contain vulnerabilities or if their invocation arguments could be manipulated (though current usage appears safe). The README itself highlights the 'terrifying' ease of building such a powerful tool.