AgriDatabase-MCP-Server

The server uses Supabase client for database interactions, ensuring parameterized queries and preventing SQL injection. All tool arguments are validated using Zod schemas. It is designed for read-only access, with no INSERT/UPDATE/DELETE operations implemented. Environment variables are loaded via dotenv, preventing hardcoded secrets. Error handling appears to be safe, avoiding database schema leaks. No use of dangerous functions like 'eval' or direct child_process execution is observed. The SSE transport implements a connection registry with cleanup for stale sessions. The only minor point is the default permissive CORS for SSE ('Access-Control-Allow-Origin', '*') which should be restricted in production, as noted in the DEPLOYMENT.md.