mcp

The server uses `zod` for robust input validation on all tool parameters, significantly reducing injection risks. Authentication relies on a personal DooTask Token passed via the `Authorization: Bearer <token>` header, which is extracted and validated. The `BASE_URL` is hardcoded to `http://nginx`, indicating it's designed to run within a containerized platform where an internal Nginx proxy handles external exposure and HTTPS, abstracting away direct internet exposure. No hardcoded sensitive credentials were found in the runtime configuration. The HTML/Markdown conversion uses `turndown` and `marked`, which, while potentially introducing client-side XSS if rendered unsafely, are standard libraries and do not appear to pose a direct server-side vulnerability in this context. No `eval` or dangerous `child_process` calls were identified.