seo-audit

This fragment is declarative configuration, not malicious code itself. However, it authorizes runtime download-and-execution of an unpinned third-party package ("shadcn@latest") via npx, creating a meaningful supply-chain execution risk: the effective MCP server code can change over time and could be swapped by a compromised upstream release.