weather-mcp-server

The server uses the 'requests' library to call the 'wttr.in' public API. User-provided city names are passed directly into the URL for the external API call. While 'wttr.in' is generally robust, passing unsanitized user input directly into a URL path could theoretically pose a minor risk if the external API had specific vulnerabilities, though the 'requests' library usually handles basic URL encoding. There are no direct uses of 'eval', 'exec', or 'os.system' with user input. No hardcoded secrets were found. Network requests include a timeout. Overall, it is quite safe for its intended purpose.