Please do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting for this repository when available, or contact the repository owner privately through their GitHub profile.

Include the affected operation, reproduction steps, expected impact, and any suggested mitigation. Do not include real secrets or sensitive user artifacts.

The server is designed for local, single-user MCP execution. Mathematical expressions use an AST allowlist rather than eval; worker processes have timeouts and output bounds; and CAD writes are confined beneath VTS_OUTPUT_ROOT. These controls reduce risk but do not make the server suitable for arbitrary untrusted public multi-tenant exposure.