anymcp-io

The project is a static site generator. The primary security considerations are at build-time, particularly related to the processing of contributed C# server files (`mcp/*.cs`). The `servers.js` script reads these files and parses their YAML front matter and extracts C# code as strings. There is no direct execution of the C# code within the Node.js build process, which limits direct code execution vulnerabilities. However, if unvetted malicious C# content (e.g., embedded HTML/JS) is not properly escaped when rendered into the Nunjucks templates (e.g., in `servers.njk`), it could lead to Cross-Site Scripting (XSS) on the generated static website. No explicit use of `eval` or intentional obfuscation was found in the provided JavaScript code. Hardcoded secrets are not present in the catalog's source code; environment variables are specified as requirements for the *contributed MCP servers* themselves.