expense-mcp-server

The server uses `sqlite3` for persistent storage, and all SQL queries are properly parameterized, which prevents common SQL injection vulnerabilities. There are no explicit uses of `eval`, `exec`, or `os.system` that would pose command injection risks. No hardcoded secrets or credentials were found. Data is stored locally, limiting network-based attack surfaces. The primary risks are general to running any local application and depend on the integrity of the `uv` and `fastmcp` dependencies.