markitdown-mcp

The server implements robust path validation (`validate_and_sanitize_path`) to prevent path traversal attacks, checks for dangerous file extensions, and restricts absolute paths to safe directories. Temporary files are used for base64 content with explicit cleanup. Error messages are sanitized to avoid information leakage. No 'eval', code obfuscation, or hardcoded secrets were found. The primary security consideration is the resilience of the underlying 'markitdown' library when parsing potentially malicious document formats, which is an external dependency risk. However, the server itself follows strong defensive programming practices.