gooddata-mcp-server

The project's README initially states 'Read-Only by Design', which is directly contradicted by the `mcp_server.py` file. The `mcp_server.py` implements significant write operations for metrics, insights, and dashboards (create, update, delete). This discrepancy in documentation is a critical point of concern, as users relying solely on the README might operate under false assumptions of safety. However, the actual implementation of these write operations includes robust safety mechanisms: a two-phase commit pattern (`preview_*` then `apply_*` with a confirmation token), automatic backups before any modification, and detailed audit logging to a local file system (`~/.config/stackless/gooddata/<customer>/audit.jsonl`). Credentials (`GOODDATA_HOST`, `GOODDATA_TOKEN`) are loaded from environment variables (e.g., via `.env` file) and are not hardcoded. No 'eval' or other directly exploitable malicious patterns were found in the provided source.