airtable-mcp

The project demonstrates a strong focus on security, explicitly addressing and fixing past XSS and command injection vulnerabilities (v3.2.4, v3.2.3 release notes). Input validation, URL encoding, and PII masking are implemented across the TypeScript and JavaScript codebases. OAuth2 with PKCE adds a layer of authentication security. The Python implementation utilizes the `requests` library, which generally handles parameter encoding safely. A minor concern is the use of `ast.literal_eval` in the Python `inspector_server.py` for parsing `config_json`; while intended for controlled Smithery configuration, `ast.literal_eval` can be a high-risk function if input is not fully trusted. Overall, the proactive security fixes and robust implementation practices make the server generally safe to run.