touchdesigner-mcp

No direct malicious logic (exfiltration, backdoor, reverse shell, or credential theft) is evident in this script. The primary risk is supply-chain trust: it downloads a twozero.tox artifact from a fixed external URL without checksum/signature verification, meaning a compromised or substituted artifact could introduce malicious behavior when later used by TouchDesigner/Hermes. Strengthen by pinning the expected hash/signature and validating after download before writing/using the artifact.