td-mcp-server

The server has a strong security-first design, defaulting to read-only operations for SQL queries (write operations require explicit `TD_ENABLE_UPDATES=true`). It includes a `QueryValidator` to restrict SQL commands and prevent dangerous operations. API keys are masked in logs and error messages. Input validation with `zod` is used for CDP/Workflow tools, and SQL identifier/literal escaping is implemented. Comprehensive audit logging tracks all operations. Workflow control operations (kill, retry) are considered safe as they create new attempts or send cancellation requests, not directly modifying data. The primary remaining risk is the `QueryTool` allowing raw SQL after basic validation, where complex Trino-specific injection vectors might theoretically exist, though no obvious flaws were found.