Is ABS Data (observed) MCP server safe?

Findings (2)

• highWrite-action tools reachable without authenticationauth.open-write
• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool execute: …Run JavaScript in an isolated sandbox whose only capability is `abs`, a client with the same four verbs as this server (searchTables, describeTable, searchOptions, getData) and the same guarantees: every selection is verified against ABS before fetching. Use it for multi-series or multi-table analysis — fetch several series, compute growth rates, rank capitals, join tables — and `return` only the computed result, so large payloads never reach the conversation. No network beyond `abs`. Budgets: 10s CPU, 50 calls, 25s wall clock, 200KB result. Your code runs inside an async function; use `await`; console.log is captured. // The `abs` object available in execute(): interface Abs { searchTables(input: { query?: string; geography?: string; frequency?: "A"|"S"|"Q"|"M"|"W"|"D"; limit?: number }): Promise<{ results: TableSummary[]; total: number }>; describeTable(table: string): Promise<{ table: TableSummary; dimensions: { id: string; position: number; optionCount: number; options?: { code: string; label: string|null }[] }[]; keyFormat: string }>; searchOptions(input: { table: string; dimension: string; query: string; limit?: number }): Promise<{ options: { code: string; label: string|null; parent?: string|null }[]; total: number }>; getData(input: { table: string; select?: Record<string, string|string[]>; startPeriod?: string; endPeriod?: string; lastN?: number; firstN?: number; maxRows?: number }): Promise<{ key: string; rows: { series: string; period: string; value: number|null; unit?: string|null }[]; rowsReturned: number; truncated: boolean; seriesMatched: number; fullDataUrl: string }>; } interface TableSummary { id: string; name: string|null; seriesCount: number; frequencies: string[]; coverage: { from: string|null; to: string|null }; dimensions: string[]; family: string|null; geography: string|null; matchedOptions?: { dimension: string; code: string; label: string|null }[] } // getData throws an Error whose message is JSON: { reason, dimension, message, validOptions?, alternatives? } — catch it, read validOptions, correct and retry.…