xiaohongshu-mcp

The service uses `go-rod` for browser automation, which inherently involves rendering external web content and poses risks related to browser vulnerabilities (e.g., zero-days) if exploited. It explicitly mentions being for 'learning purposes only' and prohibiting 'illegal activities'. CORS is set to `*`, which is a common setup for local development/integration but less secure for public-facing deployments. File system operations for cookies and downloaded images are standard for this type of tool but require host system security. Panic recovery is implemented for MCP tool handlers. The image downloader attempts basic file type detection but could still be a vector for malicious content if not carefully managed by the user. The `xsec_token` is passed as a string, its security depends on the underlying Xiaohongshu platform and how it's handled in the `xiaohongshu` package (which is truncated).