octomind-mcp

The server correctly uses environment variables for sensitive API keys (`APIKEY`) and Redis URLs (`REDIS_URL`), which is good practice. However, a `PUBLIC_MINTLIFY_API_KEY` is hardcoded in `src/search.ts` for documentation access. While labeled 'public' and likely low-risk, hardcoding any keys is generally discouraged. Session data, including `apiKey`, is stored in the configured session store (in-memory or Redis); securing the Redis instance is critical for production deployments. External API calls are made using `axios` to the Octomind platform and Mintlify search, which are standard operations but rely on the security of those external services.