mcp-server

The server properly handles sensitive API keys and secrets by requiring them via environment variables (INTRAPAY_CLIENT_KEY, INTRAPAY_CLIENT_SECRET, INTRAPAY_WEBHOOK_SECRET), rather than hardcoding them. It implements a token caching mechanism to minimize authentication calls. Network requests to the external Intra Pay API include retry logic with exponential backoff and comprehensive error normalization. Logging is implemented with caution, explicitly avoiding the logging of secrets. The README advises enabling IP allowlisting on the Intra Pay dashboard, indicating good security awareness. No 'eval' or similar dangerous dynamic code execution patterns were identified.