Clartat-MCP

The server correctly handles sensitive information by requiring a GitHub Personal Access Token (PAT) via environment variables, not hardcoding it. It uses standard and well-vetted libraries for HTTP communication (sttp.client3) and JSON parsing (Circe). Critically, it implements explicit GraphQL string escaping (`escapeGraphQLString`) for user-provided input (issue title, body) when constructing mutation queries, which is a strong defense against GraphQL injection vulnerabilities. No 'eval' or dynamic code execution is observed. Network communication is exclusively with the official GitHub GraphQL API over HTTPS. The token scopes requested (repo, read:org, read:project) are appropriate for its stated functionality.