claude-code-mcp

The server's core function involves executing the Claude CLI with '--dangerously-skip-permissions', explicitly granting broad system access to the underlying LLM. While this is a documented feature and intended behavior, it inherently poses a significant security risk if not deployed in a controlled environment or if untrusted prompts are allowed. The `spawnAsync` function uses `shell: false`, mitigating direct shell injection vulnerabilities from command arguments. Input validation for `CLAUDE_CLI_NAME` prevents relative path execution, which is a good safeguard. However, a malicious prompt targeting the Claude CLI itself or the broader system via Claude's capabilities remains a possibility. Users must be fully aware of the elevated permissions granted.