spreadsheet-read-mcp

External execution of LibreOffice (`soffice`) for recalculation and screenshots introduces a significant attack surface. While the server implements strong path validation (`workspace_root`) to prevent path traversal and resource limits (file size, cache, concurrent processes, response size) to mitigate DoS, the security of LibreOffice's macro execution environment and the specific custom macros (source not provided) are critical points of trust. The project strongly recommends running write/recalc features within a Docker container for isolation. Parsing complex Excel files via `umya_spreadsheet` also presents potential vulnerabilities. The server allows explicit control over overwriting original files via the `--allow-overwrite` flag.