dolibarr-mcp-server

The server uses environment variables and Docker secrets for API keys, preventing hardcoding. Input validation is performed for required fields and data types. No use of 'eval' or other directly dangerous functions was found. Network communication uses httpx, supporting HTTPS. The server is designed to run as a non-root user within Docker. A notable functional discrepancy exists where the `dolibarr_create_task` and `dolibarr_modify_task` tools in `dolibarr_tasks_server.py` expect `planned_workload` in seconds, but their documentation (READMEs) states 'Planned hours'. The code explicitly errors if it detects an input value that is small (less than 1 hour when interpreted as seconds), suggesting the user should convert hours to seconds before calling the tool, which contradicts the stated input format in the documentation. This is a usability bug rather than a security vulnerability.