property-prices-mcp

The server employs good security practices for external data interactions. SPARQL queries for the HM Land Registry endpoint use string escaping (`.replace(/"/g, '\"')`) to prevent injection within string literals. Queries to the local SQLite database for postcode lookups use parameterized statements, which effectively guards against SQL injection. The local postcode database is opened in read-only mode, reducing the risk of data manipulation. Dependency versions are relatively up-to-date, and the `@modelcontextprotocol/sdk` was recently updated to address a DNS rebinding vulnerability. No direct `eval` or user-controlled command execution with unsanitized input was observed. Potential risks are primarily related to the external HM Land Registry API's availability or rate limits, which are outside the server's control.