evernote-mcp-server

The project demonstrates strong security practices: uses HTTPS-only, leverages Red Hat Hummingbird (Chainguard) minimal base images with zero CVEs, employs npm overrides for transitive dependency vulnerability management, implements automatic token redaction in debug logs, and limits Evernote access to read-only. A critical command injection vulnerability in the `openBrowser` function was identified and fixed in v2.2.0 by transitioning to `child_process.spawn` with array arguments, preventing shell injection. OAuth tokens are persisted in `.env` files, which should be properly secured and excluded from version control in production environments.