eva-mcp-server

The server uses environment variables for API tokens, which is a good practice for secrets management. It implements a 'read-only' mode to prevent accidental data modifications. However, the server's default behavior (if `EVA_READ_ONLY` environment variable is not explicitly set) is to allow write operations, which directly contradicts statements in some documentation (e.g., `QUICK_START.md`) that imply read-only mode is enabled by default. Users must explicitly configure `EVA_READ_ONLY=true` to enforce read-only safety. No 'eval' or other directly exploitable malicious patterns were found. Network requests use `httpx` with configurable timeouts. Robust error handling is present for API calls.