clay-mcp

The server primarily acts as a proxy, forwarding requests to the `https://nexum.clay.earth/tools` backend API. API keys are managed via environment variables (`CLAY_API_KEY`) or URL query parameters. While using URL query parameters for sensitive information like API keys is generally less secure than HTTP headers (due to potential logging or exposure), the actual `fetch` call to the backend uses the `Authorization` header, which is good. Input validation is robustly handled using `zod` schemas for all tool parameters, significantly reducing risks of malformed data or injection into the backend. There is no `eval` or direct arbitrary command execution based on user input in the provided source code. Dependencies like `execa` are used by the underlying `fastmcp` framework for managing the server process itself, not for dynamic command execution from user requests. The main security considerations would shift to the backend `nexum.clay.earth` API regarding how it processes the forwarded `query` and `keywords` fields.