gdpr-mcp

The server primarily operates via stdin/stdout for MCP communication, limiting direct network exposure. It uses SQLite with CGO, a standard but slightly more complex component. OpenAI API key is fetched from environment variables, which is good practice. No 'eval' or similar dynamic code execution or obfuscation is apparent. Network requests are limited to the optional OpenAI embeddings API. The 'SearchVectors' function reads all embeddings into memory for similarity calculation, which could be a denial-of-service risk for very large databases due to memory consumption, but this is an efficiency concern rather than a direct security vulnerability given the expected usage with a single GDPR document.