datagvat-mcp

The server uses Pydantic's SecretStr for API keys, loads sensitive configuration from environment variables, and utilizes standard HTTP client libraries (httpx). LLM interactions for semantic search are designed to parse responses as strict JSON, mitigating direct LLM code injection risks. The `preview_data` and `preview_schema` tools fetch content from arbitrary URLs based on user input. While `MAX_PREVIEW_BYTES` limits data volume, this represents a potential Server-Side Request Forgery (SSRF) risk if the server's network configuration allows access to internal resources. No 'eval' or obfuscation is present, and the codebase follows generally good security practices for an open-source project, but the SSRF aspect of the preview functionality is a notable concern.