DB_MCP_SERVER

The server includes a robust 'isReadOnlyQuery' function that whitelists allowed SQL commands (SELECT, SHOW, DESCRIBE, EXPLAIN) and blacklists dangerous keywords (INSERT, UPDATE, DELETE, DROP, CREATE, ALTER, TRUNCATE, REPLACE, INTO OUTFILE, INTO DUMPFILE, LOAD_FILE). This significantly mitigates SQL injection risks for write/schema modification operations. The keyword check uses `includes()`, which can sometimes be overzealous and block legitimate read-only queries if a blacklisted keyword appears within a string literal (e.g., `SELECT 'insert'`), but this is a strict safeguard rather than a vulnerability. Environment variables are used for database credentials, preventing hardcoded secrets. The server uses StdioServerTransport, limiting direct network exposure for this specific component.