vecscope runs locally, reads the files you point it at, and makes no network connections. The attack surface is file parsing (.npy, .npz, .parquet, .jsonl, .json, .csv) and the MCP server, whose tools (audit_embeddings, sweep_index, compare_embeddings) read any local file path a connected client passes.

Please report vulnerabilities privately through GitHub security advisories rather than public issues. Include the input that triggers the problem when you can.

• np.load is called without allow_pickle, so .npy files cannot execute code.
• The MCP server reads any path the client passes. Run it with the same trust you would give the agent itself.