datawrapper-mcp

The server handles API tokens as environment variables, which is a good practice. Input data handling in `json_to_dataframe` includes checks for file existence and supported extensions (.csv, .json), mitigating arbitrary file read risks. Direct CSV strings are explicitly rejected, requiring structured JSON or file paths. The `update_chart` handler uses `setattr` for configuration updates, which is generally risky, but is constrained by Pydantic's `validate_assignment=True` and explicit `model_fields` lookup, limiting updates to defined, validated fields. No 'eval' or direct arbitrary code execution patterns were found in the application logic. The project includes a `CODE_OF_CONDUCT.md` and `CONTRIBUTING.md`, indicating a well-managed open-source project.