strudel-mcp-server

The server uses Playwright to automate a browser (Strudel.cc), allowing dynamic code execution via `page.evaluate()`. This inherent risk is extensively mitigated by multiple layers of defense: - `PatternValidator` performs syntax and safety checks on user-provided code (e.g., preventing `eval()` or `Function()` calls) *before* it's executed in the browser's sandbox. - `PatternStore` rigorously sanitizes filenames using `path.basename` and regex to prevent path traversal and other file system attacks. - File I/O is restricted to a designated 'patterns' directory. - The browser operates within its own sandbox, providing isolation from the host system. - There are no hardcoded secrets or direct `child_process` calls in the core server logic; `child_process` is only used in test files. Input validation (`InputValidator`) is robust across all tools.