Oh My Posh MCP Server

This is the oh-my-posh prompt engine codebase, a Go terminal prompt tool plus a Node.js MCP validator endpoint that only validates configuration content and makes no outbound data exfiltration calls. The code shows careful control-rune stripping and shell escaping; no malicious patterns or hardcoded secrets were observed, and the MCP endpoint accepts unauthenticated requests with wildcard CORS, which is a minor concern given it only performs schema validation. The provided source is truncated, so the remainder of writer.go and the other Go packages were not fully reviewed. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity).

9 files analyzed · 5 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.