LLinkup Model Context ProtocolJavascript version of the Linkup MCP server.

Remove credential values from CLI flags (e.g., --password, --token). Use environment variables, config files with restricted permissions, or interactive prompts instead.

Likely FP if the CLI flag is shown in a help text example (e.g., --token YOUR_TOKEN) without an actual credential value.

Replace npx -y with an explicit npm install step that pins the package to a specific version, then run it. Remove the -y flag to require user confirmation.

Likely FP if the npx command runs a well-known, trusted tool (e.g., create-react-app) in documentation context with no version pinning concern.