cua-mcp-server

The server implements robust input validation for sandbox names and task IDs to prevent injection and path traversal attacks. It includes specific URL validation (`isValidBlobUrl`) to prevent Server-Side Request Forgery (SSRF) when fetching task history from Vercel Blob storage. API keys are sourced from environment variables or request headers, not hardcoded. The agent architecture relies on an LLM generating structured tool calls, not direct shell commands from user input, significantly reducing direct execution risks. The primary security concern, as noted in the `AGENTS.md` and `README.md`, is the default wide-open CORS policy (`Access-Control-Allow-Origin: *`) for broad MCP compatibility, which might need tightening for production deployments with untrusted users, and the implication that the server's Anthropic API key is shared among authenticated CUA API key users.