pinmeto-location-mcp

The server uses environment variables for API credentials (PINMETO_ACCOUNT_ID, PINMETO_APP_ID, PINMETO_APP_SECRET), which is a good security practice, with the app secret explicitly marked as sensitive in the manifest. Requests to the PinMeTo API are authenticated using a bearer token obtained via client credentials flow, which is cached for a limited time. Input validation for tool arguments is performed using Zod schemas. There are no obvious `eval` calls, direct command injections, or other critically dangerous patterns found. The use of `axios` for HTTP requests is standard. Logging to `console.error` for failed requests is present but might expose sensitive information if not handled in production logs. Custom User-Agent for axios requests is a good practice for API interaction.