strudel-mcp

The server utilizes `StdioServerTransport`, meaning communication happens over standard I/O, which significantly limits direct network attack surfaces for the server itself. Input schemas are validated using `zod`. While user-provided Strudel mini notation is parsed and processed, the server itself does not `eval` or directly execute arbitrary code on user input. Generated code is returned to the client, with instructions implying execution in a separate client-side Strudel environment (e.g., `strudel.cc`). The primary security consideration would be potential vulnerabilities within the underlying `@strudel/mini` or `@strudel/core` parsing libraries if specifically crafted musical notation could exploit them, but this is a dependency-level risk. No hardcoded secrets were identified.