ros2_mcp

The server uses `importlib.import_module` to load custom prompts based on user-controlled environment variables (`MCP_PROMPTS_PATH`, `MCP_PROMPTS_MODULE`) or CLI arguments. This presents a critical Remote Code Execution (RCE) vulnerability if an attacker can manipulate these settings to point to a malicious Python module. The prompt rendering (`template.format(**arguments)`) also risks template injection if prompts or arguments are untrusted. While the primary transport is stdio, an SSE (HTTP) transport is available via `uvicorn` and `Starlette` without explicit authentication/authorization mechanisms shown, creating a potential network exposure. Deserialization of `lora_msgs/srv/GetMessages` responses, while using trusted ROS2 libraries, could be an indirect vector if message types are supplied maliciously by a compromised AI agent.