coupler-io-mcp-server

The `get-data` tool executes user-provided SQL queries directly on a downloaded SQLite database. While the database is opened in `readOnly` mode and the input `query` is validated to start with `SELECT` (mitigating write/delete risks), a malicious `SELECT` query could potentially be crafted for resource exhaustion (e.g., complex joins on large datasets) or to probe database structure if not fully isolated. However, the local and temporary nature of the SQLite file downloaded for each execution limits the scope of such an attack. No hardcoded secrets were found; `COUPLER_ACCESS_TOKEN` is correctly sourced from environment variables. Network requests are directed to a controlled Coupler.io API host and use signed URLs for data downloads.