XiaoheiheMcpServer

A comprehensive security audit cannot be performed without access to the full C# source code files (e.g., XiaoheiheService.cs, LoginService.cs, etc.). Based on the documentation, the server uses Playwright for browser automation, which can introduce vulnerabilities if not carefully managed (e.g., untrusted content loading, browser exploits). It stores user cookies in `data/cookies.json`, which is sensitive data requiring proper file permissions and secure handling. The server also processes local absolute paths for image/video uploads, which could pose a risk if not properly validated against directory traversal or unauthorized file access. No obvious hardcoded secrets or malicious patterns are visible in the provided truncated configuration and documentation files.