mcpick

The project is well-structured and focuses on safely modifying configuration files. It uses `valibot` for schema validation of server configurations, preventing malformed entries. File operations are limited to specific user-home directories (`~/.claude.json`, `~/.claude/mcpick/`) and only the `mcpServers` section of the main Claude config is modified, preserving other settings. There is no direct execution of user-supplied commands within McPick itself; it stores these commands for Claude Code to execute. No 'eval', hardcoded secrets, or unusual network activity is observed. The main security consideration is that users could input malicious commands when adding a server, which would then be executed by Claude Code, but McPick itself doesn't execute them and provides schema validation, which is appropriate for a configuration manager.