QUACK-MCP-SERVER

The server executes external command-line tools (mypy, pylint) on user-provided code by writing the code to temporary files and passing the file paths as arguments. This mitigates direct shell injection vulnerabilities. However, any intrinsic vulnerability within mypy or pylint that allows arbitrary code execution through crafted input files during static analysis could compromise the server. Additionally, the presence of `TestProcessor` (which runs `pytest` on user code) in the codebase is a critical security concern; while not registered in `quack/server.py` by default in the provided code, enabling it would allow arbitrary code execution, requiring robust sandboxing beyond the current implementation.