mcp-server-qobra

The server is explicitly designed for 'READ-ONLY MODE', preventing any write, update, or delete operations on Qobra data, which is a significant security control. It uses environment variables (QOBRA_API_KEY) for sensitive credentials, preventing hardcoding. The `qobra_client.py` strictly enforces GET requests only. It uses `httpx` for API communication, which is a modern, secure HTTP client. No `eval`, `exec`, or other high-risk functions are used. Input parameters for tools are type-hinted and processed, reducing injection risks. Error handling for API calls is present. The architecture is straightforward and follows best practices for secure API integration. The only potential risk would be if the Qobra API itself had vulnerabilities or if the API key were compromised externally; the server mitigates risks on its side.