Mycelium

The server has critical SQL injection vulnerabilities due to the direct concatenation of user-controlled input into SQL queries. Specifically, in `src/tools/context.ts`, the `mycelium_history` tool takes a `type` parameter which is directly inserted into a SQL query without sanitization, allowing for arbitrary SQL execution. While `logTask` attempts to escape single quotes, this is an insufficient mitigation for untrusted input. The `mycelium_preferences` tool also uses string interpolation for SQL updates, though the inputs are validated by Zod prior to insertion, reinforcing a risky pattern in the SQL layer. Hardcoded API endpoints are for internal Grove services, not sensitive credentials.