mcp-weather-server

API keys (OpenWeather, OpenRouter) are correctly handled via environment variables. Input validation is performed using Zod schemas for tool parameters, mitigating common injection risks. Filename sanitization is implemented for saving reports, preventing path traversal. CORS is enabled for all origins, which is explicitly noted in the README as suitable for local development but a security risk for production, requiring proper configuration for deployment. Interaction with OpenRouter (a third-party LLM) introduces an external dependency for analysis, implying data transfer to OpenRouter, but this is clearly part of the server's functionality and not an arbitrary data leak. No 'eval' or obvious malicious code patterns were found.