charm-mcp-server

The server explicitly handles Protected Health Information (PHI) and includes a critical HIPAA notice, emphasizing user responsibility for compliance (HIPAA-compliant LLMs, BAA, no data retention). It retrieves credentials from environment variables, avoiding hardcoded secrets. OAuth tokens are managed with a shared, client-specific cache and locks for concurrency. Telemetry collection is optional and disabled by default, with clear warnings about PHI in logs if enabled. Input validation is performed at the tool level for required fields, reducing common errors. There is no evidence of `eval`, obfuscation, or arbitrary command execution vulnerabilities in the provided source code.