mcp-server-miro

The server uses Zod for input validation, and sensitive API tokens are correctly loaded from environment variables. There are no obvious 'eval' or command injection vulnerabilities. The `passthrough()` option in some Zod schemas allows unknown fields to pass through validation, which is then forwarded to the Miro API, potentially leading to unexpected behavior or API errors if the Miro API doesn't handle them gracefully, though this is not a direct server vulnerability. Error responses from the Miro API are directly formatted and returned, which could, in rare cases, expose verbose upstream error details if the Miro API itself were to leak sensitive system information (unlikely for a public API).