kanboard-mcp

The server uses environment variables for sensitive credentials (API key, username/password), which is a good practice. It implements role-based access control (RBAC) to enforce permissions at both application and project levels, with a clear hierarchy and access maps defined internally. Debugging flags (`KANBOARD_DEBUG`, `KANBOARD_SKIP_RBAC`) are provided for troubleshooting, with a warning for `KANBOARD_SKIP_RBAC` which, if enabled in production, would bypass all permission checks. API calls include retry mechanisms and handle various authentication methods (global token, user token, bearer, username/password). There are no signs of code obfuscation or direct 'eval'-like constructs. The primary security considerations are the secure configuration of the Kanboard instance itself and the environment variables where credentials are stored.