finance-engine-mcp-rs

Input parsing includes robust sanitization and validation for length, null bytes, and control characters to prevent injection-like issues. Flexible deserializers (`deserialize_flexible_f64`, `deserialize_bool_flexible_opt`) improve resilience to varied input formats. Environment variables for LlamaStack integration (`VECTOR_STORE_NAME`, `LLAMA_STACK_HOST`, `LLAMA_STACK_PORT`, `LLAMA_STACK_SECURE`) are read dynamically and not hardcoded, mitigating credential exposure. External network calls are made to configurable LlamaStack endpoints, not arbitrary user-controlled URLs. No direct `eval` or similar dynamic code execution patterns are identifiable in the Rust source code. The project highlights security practices such as non-root container users and CI/CD security audits. Potential risks primarily reside in the security posture of the external LlamaStack dependency and its configuration, which is outside the scope of this project's code.