xiaozhi-mcp-server

The primary security risk is the use of `eval()` in the `calculator` tool implementations (`calculator.py` and `server.py`). These tools directly execute arbitrary Python expressions provided by the AI model. While `calculator.py` attempts to sandbox `eval` to `math` and `random` modules, this is often insufficient to prevent sophisticated arbitrary code execution. The `server.py` example's `eval(python_expression)` is even more dangerous, offering no sandboxing at all. This allows an attacker (or a malfunctioning AI) to execute arbitrary code on the server where the tool is running, potentially leading to system compromise. Additionally, `xiaozhi_chat_web.py` contains a hardcoded JWT token in `XIAOZHI_ENDPOINT`, which is a critical secret management vulnerability.