React-Flow-MCP-Server

The server includes Zod for robust input validation and `sanitizeString` to mitigate potential injection risks in textual outputs. It primarily uses StdioServerTransport, reducing direct network exposure in its default run mode. No hardcoded secrets or direct `eval` calls are identified. While it relies on external data (React Flow definitions), these are hardcoded within the server, preventing external data injection. Deployment to HTTP transport (e.g., for Copilot Studio) would introduce standard web security considerations (authentication, HTTPS, rate limiting) which are external to this specific server's code but mentioned as requirements.