Is Layero MCP server safe?

Findings (1)

• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool import_repo: …Create a Layero project from a repository — path (a) without the dashboard. From then on a push to the branch is a preview, a push to the production branch is production. After the link the tool finishes the setup wizard itself and starts the first build; `setup` in the result says whether that happened. Detected values are NOT written into the project settings: the builder detects the framework, build command and output folder from the repository on every build, so a later change in the repository is picked up. Only a decision is pinned — the app folder of a monorepo and the package manager named in `layero.json`. Until 2.1.1 the project stayed in `pending_setup` while the answer promised a build that never started. Two shapes, same as the CLI: GitHub goes through the App installation (project and webhook in one call); other providers create the project first and then connect the source — that step reports whether the webhook could be registered. If the provider is not connected, the result says `needs_connection` with the dashboard address: the person connects the token there, never through the chat. Monorepo: one project builds one app folder — pass `root_directory`. Several apps in one repository are several projects, one call each, with different `root_directory` and `name`. If the repository is already linked and the call would duplicate an existing project (same folder, or no `root_directory` given), nothing is created: the result is `already_linked` with `linked_projects` — slug, url, root_directory and branch of every project built from this repository. On `created`, `linked_projects` lists the OTHER projects already built from the same repository; `linked_projects_checked: true` says the check was made, so an empty list means there are none (`my_projects(repo=…)` answers the same question later). When the root has no app and detection sees a frontend + backend pair, `app_dir_candidates` names the folders. …