metrc-mcp-server

The server primarily uses parameterized SQL queries and FTS5 for database interactions, which is a strong defense against SQL injection. Input sanitization is performed on search queries before FTS matching. The server sets broad CORS headers (`Access-Control-Allow-Origin: *`), which is acceptable for an AI agent integration but noted. There are no obvious 'eval' or shell command injection vulnerabilities. A minor potential risk could arise from the `get_by_endpoint` function using `LIKE` with user-controlled input (even if normalized), though its practical exploitability is limited in SQLite for this context. The importer script runs offline and reads local files, assuming a trusted source directory.