build-mcp-server-sdk-v2

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). Recipe 1 in references/examples/server-recipes.md registers a "search" tool that performs fetch(${API_BASE}/search...) and returns the remote JSON as tool output, which is clearly ingesting arbitrary third‑party API content (API_BASE) that the server will read and use in its responses and behavior.