ohos-dev-distributed-cpp-callgraph-analysis

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup script (scripts/setup_lsp.py) performs runtime downloads from https://go.dev/dl/{archive.name} (and its .sha256) and then runs go install github.com/isaacphi/mcp-language-server@v0.1.1, which fetches, builds, and installs remote code that will be executed as a required dependency for the LSP bootstrap.