Same context as above (built mcp-customs, an MCP server scanner, ran it against this repo). It flagged a spec file read in src/init-server.ts where the path is resolved at startup — looks like a local config path rather than anything agent/tool-call controlled, so lower stakes than a typical finding, but same general category worth a quick look.
No action needed if this is already a known, trusted path — just sharing in case it's useful.
Same context as above (built mcp-customs, an MCP server scanner, ran it against this repo). It flagged a spec file read in src/init-server.ts where the path is resolved at startup — looks like a local config path rather than anything agent/tool-call controlled, so lower stakes than a typical finding, but same general category worth a quick look.
No action needed if this is already a known, trusted path — just sharing in case it's useful.