calibre-mcp

The server uses `cors.New` with `AllowOriginFunc` always returning `true`, which enables cross-origin requests from any domain. While this simplifies development or local use, it is a significant security risk if the server is exposed to the public internet, as it allows arbitrary websites to interact with it. SQL queries utilize parameter binding for user input, preventing typical SQL injection vulnerabilities. File path construction uses `filepath.Join` to mitigate path traversal risks. No hardcoded secrets or malicious patterns were identified.