bluekit-mcp-server

The server uses `execSync` for git operations (`git clone`, `git checkout`) in `CloneTools.ts` and spawns external processes via `npx` for Mermaid validation in `MermaidValidatorClient.ts`. While `gitUrl`s are derived from local repositories during registration, rather than direct user input, and `npx` targets a specific known package, these interactions with external processes and fetching external code (git repos) introduce inherent supply-chain and execution risks. File system operations are extensive but generally confined to the project or user home directory, with path normalization applied to mitigate directory traversal. No obvious `eval` or direct arbitrary user command injection vulnerabilities were found, nor hardcoded sensitive secrets.