canton-mcp-server

The server employs a 'DAML-Safe by Construction' philosophy with 'Gate 1' enforcement for code validation, which significantly enhances security. The `daml_automater` tool has been refactored to return client-side instructions rather than executing commands on the server, greatly reducing server-side execution risks. The `daml_reason` tool handles missing DAML compiler gracefully, falling back to LLM-only analysis for compilation aspects. The `DirectFileResourceLoader` uses `git` subprocess commands for metadata retrieval, which is generally low risk. The `x402` payment bypass via `X-Internal-API-Key` introduces a potential risk if compromised. While `docker-py` is present for `CantonManager` in the codebase, it is not directly invoked by the public-facing tools for server-side operations post-refactor.