fgdb-mcp-server

The server demonstrates a strong commitment to security through a layered architecture, comprehensive input validation (e.g., `validate_where_clause` specifically checks for dangerous SQL patterns like 'DROP TABLE', '--', '/*'), and a mandatory safety confirmation system for all mutating operations (insert, update, delete, add/delete field). This confirmation mechanism requires a unique token, preventing direct, unconfirmed execution of high-risk commands. Path validation is present for GDB paths. The ArcPy backend calls are parameterized or use validated input, minimizing SQL injection risks. No direct use of 'eval' or 'exec' on user input was identified. Hardcoded secrets are not apparent. The `SECURITY.md` file outlines a clear policy and best practices. A perfect 10 is difficult due to reliance on external ArcPy libraries, but the Python layer is well-fortified.