verdex-mcp

The server uses Puppeteer to control a browser, which inherently involves risks when interacting with untrusted websites. It injects its own bundled JavaScript into an isolated world using `Runtime.evaluate`, a standard practice in browser automation but one that requires trust in the injected code. User-provided authentication files (JSON) are loaded, which could be a risk if untrusted files are supplied, though the `RolesConfigParser` warns if these files are not found. The project demonstrates good security awareness with a dedicated `SECURITY.md` that outlines best practices for protecting sensitive data (auth files) and managing network access, and uses isolated browser contexts for different roles to enhance security.