imap-readonly-mcp

The server is designed for read-only operations, minimizing potential for mutation. It uses Pydantic's `SecretStr` for sensitive credentials (passwords, client secrets) which is a good practice. OAuth token acquisition for Microsoft Graph is handled via `msal`. Input validation is present for tools. The SQLite cache is managed internally without exposing direct user control over file paths, and cursor decoding handles potential `ValueError` and `JSONDecodeError`. No `eval` or `exec` found. HTML to text conversion uses regex, which can sometimes be a vector, but appears to be for content stripping rather than arbitrary code execution. Overall, appears robust for its stated read-only purpose.