mcp-geo-database

The server primarily interacts with external NCBI services (Entrez E-utilities, FTP) for data. File system operations for downloading are constrained to a user-defined or default directory ('./data') using `os.makedirs(destdir, exist_ok=True)` and `os.path.join` to prevent path traversal. The `parse_soft_file` function reads the content of a specified file, which could potentially expose local files if the `filepath` argument is maliciously crafted to point outside the intended data directory. However, it only reads and prints content, not executes it. There is no usage of `eval`, `exec`, or direct shell command execution. The `Entrez.email` is hardcoded, which is a minor configuration concern but not a direct security vulnerability.