destiny2-mcp-server

The server demonstrates strong security practices: `BUNGIE_API_KEY` is strictly loaded from environment variables and never hardcoded. It uses a `sanitize` function to redact API keys from logs and error messages. Input validation is performed using Zod schemas for tool parameters, reducing injection risks. API calls include rate limiting, exponential backoff, and timeouts to handle external service interactions robustly. The `SECURITY.md` explicitly addresses a known vulnerability in a dependency (`@modelcontextprotocol/sdk`) and clarifies why this server is not affected due to its stdio transport. No 'eval' or obvious obfuscation is present. Overall, it is well-engineered for secure operation.