Teamwork-MCP

The server follows good practices for handling credentials (environment variables, .env file, or command-line arguments) and implements tool filtering for restricted access. It uses HTTPS for API communication. However, the API client's request interceptor logs the full request body to file (`combined.log`), which, depending on the tool invoked (e.g., `createCompany`), could expose sensitive data in local log files. While the Authorization header is redacted, specific data passed in the body for creation or update operations is logged. There is no `eval` or obvious obfuscation. The server acts as a proxy, relying on the Teamwork API's internal sanitization for input parameters.