SAPDatasphereMCP

The server is explicitly designed for read-only operations, significantly reducing risks of data modification. All sensitive credentials (tenant URL, OAuth client ID/secret, token URL) are loaded from environment variables, preventing hardcoding. TLS verification is enabled by default for HTTPS communication, though it can be optionally disabled with a clear warning regarding security implications (e.g., for corporate proxies). There are no instances of `eval` or `exec` found in the provided source code, and no obfuscation. OData filter and order expressions are passed directly to the SAP Datasphere API, relying on Datasphere's own sanitization; however, given the read-only nature, the risk of malicious injection is mitigated to information leakage rather than data corruption.