redmine-mcp-server

The server uses standard API key or basic authentication for connecting to the Redmine instance, passed via environment variables or CLI flags (not hardcoded). It runs via standard I/O (stdio) and does not directly expose network ports, limiting its direct network attack surface. By default, the server operates in a read-only mode, disabling destructive API calls. A notable point is that the default Redmine server URL is HTTP (http://127.0.0.1:3000), which means credentials would be sent in plain text if Redmine itself is not configured for HTTPS, posing a risk for non-local or insecure Redmine deployments. The 'X-Redmine-Switch-User' header, if used with an administrator account, allows impersonation, which is a powerful feature of Redmine's API that the MCP server exposes; its misuse depends on the Redmine account's privileges and the security of the MCP server's deployment.