mcp

No direct evidence of explicit malware is present in this module (no obfuscation, no eval/dynamic code execution, no external network calls, and no hardcoded credentials). However, the design creates a high-impact execution surface: it trusts a local JSON config to supply the exact command/args/env used to start MCP servers via stdio, with no allowlisting or validation. If an attacker can tamper with the config file or influence the working directory/config path, this can become an arbitrary local command execution vector. Additionally, tool/prompt/resource invocation inputs and resource URIs are forwarded without validation, increasing the potential blast radius if the MCP server (or inputs) are malicious or compromised.