sql-stock-mcp-server

The server employs robust SQL injection prevention by using parameterized queries exclusively. Claude only provides simple integer parameters, and the server constructs all SQL internally. However, there's an inconsistency where the `id` column is listed as 'blocked' in the `DATABASE_SCHEMA` definition, but the `getRecentStockPrices` tool explicitly selects it. While `id` is a primary key and generally poses minimal security risk, this deviation from its own stated blocking rule is noteworthy. The sensitive 'author' column is correctly excluded from direct selection in tools. No use of `eval` or similar dangerous patterns was found.