postmark-mcp

The server correctly uses environment variables for sensitive data like the Postmark server token, and the README explicitly warns against storing secrets in version control. It employs Zod for input validation, which helps prevent malformed requests. Logging practices appear secure, avoiding direct exposure of sensitive information in console outputs. Network requests are limited to the official Postmark API. There is no usage of 'eval' or similar dangerous patterns. The main point of caution, common to any tool that manages external credentials, is securing the environment where the server runs and ensuring proper access controls for the `.env` file.