envirofacts-mcp

The server uses `httpx` for external API calls and `pydantic-settings` for configuration, which are good practices. It communicates via stdio, limiting network attack surface. The URL construction in `query_builder.py` directly appends user-provided filter values to the URL path. While the EPA API might sanitize these, this pattern could potentially allow for manipulation of the API request path or injection of unintended query parameters if the user input contains path delimiters (e.g., '/') and the EPA API does not rigorously validate or sanitize its path segments. Given it's a public EPA API with no authentication, the impact is primarily limited to making unintended API calls rather than direct server compromise.