jimeng-mcp-server

The server's source code itself does not contain obvious direct vulnerabilities like `eval` or hardcoded sensitive credentials within the Python files. It uses environment variables for `JIMENG_API_KEY` and `JIMENG_API_URL`, which is good practice. However, the project's core functionality relies on `jimeng-free-api-all`, a reverse-engineered API for JiMeng AI. This inherently introduces several security considerations: (1) The `JIMENG_API_KEY` is a browser `sessionid`, which is less secure than a dedicated API key and can expire or be subject to session hijacking if not properly protected. (2) Reliance on an unofficial, reverse-engineered API means potential instability, lack of security patches, and unpredictable behavior if the upstream official service changes. (3) The project explicitly states it is for 'personal learning and research use' and 'prohibits commercial use' due to its reverse-engineered nature.