Expense-Tracker-MCP-Server

The server uses parameterized SQL queries, effectively preventing SQL injection. No hardcoded secrets or dangerous functions like 'eval' or 'exec' are present. The SQLite database is created in a temporary directory, which ensures write access but could theoretically be accessed by other processes on the same system in a multi-user environment, although this is a minor concern for a typical local expense tracker. The file access for categories is limited to a local JSON file within the application directory.