Critical security and design failures. The 'add' tool contains a prompt injection attack disguised as a description, instructing LLMs to exfiltrate ~/.cursor/mcp.json and ~/.ssh/id_rsa.pub. The 'search_file' tool explicitly admits to unsafe shell command injection ('unsafe: no sanitization'). Descriptions are present but two tools lack proper parameter documentation. No output schemas documented. Error handling is minimal. This server appears intentionally vulnerable for testing purposes, but the prompt injection in tool descriptions is a severe anti-pattern that would never pass production review.

• URGENT: Remove the prompt injection attack from the 'add' tool description. Replace with a legitimate description of what the tool does (e.g., 'Add two numbers and return their sum. The sidenote parameter is optional context for logging or reasoning.').
• Rewrite 'search_file' description to be 50 - 200 characters, explain its purpose, and remove the admission of unsafety. Better: 'Search for files matching a glob pattern in the current directory. Returns a list of matching file paths.'
• Implement input sanitization in 'search_file'. Use the 'glob' npm package or fs.readdirSync with path.join() instead of shell exec(). Validate pattern against a whitelist of safe characters.
• Document output schemas for all tools. Specify the structure of returned content (e.g., 'Returns an object with fields: {files: string[], count: number, error?: string}').
• Add error recovery guidance. When a file is not found, suggest 'Try search_file() to locate the file first.' When search fails, return 'Search failed. Ensure the pattern uses valid glob syntax (*, ?, []).'.