mssql-mcp-server

SQL injection is mitigated for parameterized queries using `request.input()`. The HTTP transport includes API key-based authentication with Azure Table Storage for multi-database support. However, `AzureTableStorageService.upsertConnectionConfig` stores database connection configurations, including passwords, as a JSON string without explicit server-side encryption. This means if a user adds an API key with a password, it will be stored in plaintext in Azure Table Storage, requiring users to handle encryption externally before storing sensitive data. The various `execute` methods (DQL, DML, DDL) rely on method-level validation, but a malicious actor with access to the tool can craft destructive queries if allowed by permissions.