mcp-weather-server

The document search, summarization, and storage services allow file system operations (read, write, search) based on user-provided paths (`folder_path`, `document_path`, `output_folder`, `filename`). While `Path.normalize()` is used, it might not be sufficient to prevent all path traversal attacks, potentially allowing access to arbitrary files outside the intended project directory (the `user.dir` where the server is run). This is a significant local file system security risk if the server processes untrusted input from an LLM or external client. The `OPENWEATHER_API_KEY` is handled correctly via environment variables. SQL queries for task management use prepared statements, mitigating SQL injection risks.