osler-mcp

The server includes a robust `_is_safe_query` function that actively blocks SQL injection patterns (e.g., boolean-based, time-based, file access) and write operations (INSERT, UPDATE, DELETE, DROP, CREATE, ALTER, TRUNCATE, REPLACE, MERGE, EXEC, EXECUTE). It parses SQL to prevent multiple statements and restricts queries to 'SELECT' statements. It also flags suspicious identifiers (e.g., PASSWORD, ADMIN, USER) not typically found in medical data contexts. Environment variables for API keys are used for LLM integrations, preventing hardcoded secrets. The `get_table_info` tool directly executes PRAGMA commands, which are inherently safe in this context and bypass the `_is_safe_query` function, but are not user-supplied SQL.