Tableau-God-Agent-MCP

The server uses Pydantic Settings for secure environment variable loading and implements a Human-in-the-Loop (HITL) approval system for all critical operations, significantly enhancing safety. It leverages established libraries like httpx and tableauserverclient. A potential XML injection risk exists in `src/api_clients/prep_client.py` where user-provided or LLM-generated strings are directly formatted into XML request bodies without explicit sanitization within the provided source code. This relies on upstream components (e.g., the LLM Web Agent or Unified Intelligence Interface) to perform robust input sanitization before reaching the tools. If not properly sanitized upstream, this could lead to unexpected API behavior.