mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery (CVE-2026-15750) | HOL Guard CVE