Is Kin MCP server safe?

The component can run operating-system commands or spawn processes.

import cp from 'node:child_process';

const child = cp.spawn(binaryPath, args, {

import cp from 'node:child_process';

const child = cp.spawn(binaryPath, args, {

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component reads files from disk.

fs.readFileSync(new URL('./server-instructions.json', import.meta.url), 'utf8')

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component makes outbound network requests.

const response = await fetch(url, {

const response = await fetch(url, {

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.