mcp-openfoodtox

The server uses `sqlite3` and `pandas.read_sql_query` for database interactions. All queries observed utilize parameterized inputs (`params=...`), which effectively prevents SQL injection vulnerabilities. No `eval` or `exec` functions were found, nor were any hardcoded secrets or malicious patterns detected. The `FastMCP` server is configured to run with `transport='stdio'`, implying local communication typically used for LLM agent integration, which limits its direct network attack surface. However, `httpx` is a dependency, and the README mentions 'Active internet connection for updates and dataset access', suggesting external network calls might occur as part of a broader system or initial setup not directly within the provided server runtime logic.